{ "Event": { "published": true, "date": "2026-04-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-30", "timestamp": 1777593782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8f380184-c1b3-4d17-88db-2fd523b3f481", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4b394f-448a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777549836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549836, "uuid": "9796a962-30cf-4dd4-82f1-34fae27c8c1f", "comment": "Malware payload (Mirai)", "value": "7f2aef0be264d3292385ca1dc57ad4f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549836, "uuid": "dc1a9ffd-ae8b-490e-9df7-20a19ceec2d4", "comment": "Malware payload (Mirai)", "value": "00ebb70b58ae4b760c5c2bd014641b89086ab9545d21d9f257c6b20e1ade8b4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549836, "uuid": "595b2f0f-343a-4855-80f8-f88477e667f3", "comment": "Malware payload (Mirai)", "value": "952354d0e7dc476e11f97898e2ae478d72f7d82c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549836, "uuid": "41860dde-6689-451c-8e87-70ba15803ae9", "comment": "Malware payload (Mirai)", "value": "28b8dfee835f42b209a1bd546453f4277162aa1124805976d047c665a6463f784fc412638659d64b722c5883ab346ad2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549836, "uuid": "ead1ee33-758c-4b16-8f99-2891c10d43df", "value": "T191631907EB43DE73D45310F012FB6B764A32FD2A5836C786E7647CA0AA265D0A617378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549836, "uuid": "41dfc72d-fcb2-4af5-bfc9-9fac4da6d5af", "value": "1536:NNfdZSvG6qlmNHZnU2EBDrLtnKyJO6+3gyBNPCvRrUniM5g:HfHSt2cHZnknTUFLND2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777549836, "uuid": "192babab-4c67-4ba5-b948-4eae80c416f4", "value": 67444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777549836, "uuid": "e0c82510-cf62-4fa6-b723-20cb57eacf91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549836, "uuid": "40542bd5-ddf9-4879-beac-a2bb2f3e4193", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80481e28-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538540, "uuid": "5556ebc8-d373-4bc9-bc56-fa709b54decd", "comment": "Malware payload (XWorm)", "value": "eb0385c09ba91fd1716472f4a9a2eadb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538540, "uuid": "71c864f2-cd3b-4ce7-9727-3163c690f17f", "comment": "Malware payload (XWorm)", "value": "0102d81d2b0e669dcbd1108e846db132a112d9d81314b9cc01f78d4ef591c744", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538540, "uuid": "4968a0ed-cfe8-4b4a-b4de-f267ba032a78", "comment": "Malware payload (XWorm)", "value": "2785c5eeee9bae36e05d40f0fdf562ea0834d404", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538540, "uuid": "6f94983f-21be-44ac-bd7f-2ffdd8605b7e", "comment": "Malware payload (XWorm)", "value": "81c8919dacffae3175b5e5f2fd138db5c5ec80062d8c32e7b7d9052ebb28ccd0223b0776974e758c8be546428ece16ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538540, "uuid": "dc97b768-7969-474c-a273-5928b81f09bc", "value": "T1703723069F28EE6E5EFC4BB8487A5B1F4FD28D00831873283758FDEA991DF25116E056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538540, "uuid": "060e65cf-7aa1-4d2a-b432-9bb23fdbc963", "value": "49152:C2J6U2J6o2J6D2J6u2J6+2J682J6q2J6M2J6d2J6w2J6a2J6Jri/2J6C2J6y2J6B:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538540, "uuid": "fed7adcb-703a-4b2f-bfb3-d11901e2a789", "value": 22643804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538540, "uuid": "a8e9f059-71cd-40fe-8c74-088b3c8f09d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538540, "uuid": "5f7d130d-5396-4de3-8230-42d8d17739d4", "value": "invoice-1645080830.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192db933-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538367, "uuid": "c165f7b0-a2dc-4217-b862-2da510ed8835", "comment": "Malware payload (XWorm)", "value": "69bc6d90f669b773e720fe22491fed43", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538367, "uuid": "2a639bf4-2418-4a6b-8485-1f6461872216", "comment": "Malware payload (XWorm)", "value": "012844a4d35c494d0db7ec17a42e6f8caec19a9db44dc482fa3e5a70a791027b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538367, "uuid": "58a8355c-745d-4a97-82ff-50365317219b", "comment": "Malware payload (XWorm)", "value": "874555485778a81012b1d7b81d45807a89c0eceb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538367, "uuid": "17d59154-0d4c-40d5-800f-dc242aad799f", "comment": "Malware payload (XWorm)", "value": "be3103cca2309c4c8ca1e17a82f78951d1c45c301c0002418b41c5c608d6dfb864ec495b3eaef4ebed9172b28af8214a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538367, "uuid": "bc703e34-ebd6-42b6-8c67-382c278b1d17", "value": "T13A3723254AECAF47D2A9329C303E5B9E07F89C010828FC5D6BA46DB7C39F522751D5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538367, "uuid": "c1cfdbab-e79d-4689-90ec-1576c22c9b96", "value": "49152:bJ+zfJ+z9J+zWJ+z2J+zvJ+zxJ+zYJ+zcJ+zUJ+zuJ+zeJ+zAKTsF+J+zyJ+zHJV:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538367, "uuid": "f4fbe9c6-3660-449d-816e-10d0b48d9473", "value": 22903951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538367, "uuid": "0a7c0c24-6936-4a02-a837-31e87f7225b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538367, "uuid": "f9ed26a9-e804-4268-b13b-6faf075c5cf6", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076bd0bb-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514285, "uuid": "f1b5221b-15bb-468c-aa5e-499f0b36cf36", "comment": "Malware payload (Mirai)", "value": "c9c2b3c937a96ccccfea19b0d102e89d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514285, "uuid": "31e9d26b-ac1e-4f1e-a4b9-3695115dfbab", "comment": "Malware payload (Mirai)", "value": "016bd7dfee73774ea1bf653cef91cb5187e17a71e783cd4d6b52358e5b02d8f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514285, "uuid": "e81583df-7b27-414b-ba81-21e2ddc1c007", "comment": "Malware payload (Mirai)", "value": "faa81bb29ad8104ef944b4a63081878aa322914b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514285, "uuid": "8dabf7ee-5367-4eea-997f-2df124fa9f4d", "comment": "Malware payload (Mirai)", "value": "afeb95c0958275f459f6125cc57e6d3284fc93aa0e56255c4731a89ac37e4fd2e2059efb4cbff6336d84d8f8384ebdf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514285, "uuid": "6dd4e705-6bea-4fd6-ac0d-889144f05a41", "value": "T13524F947B991CF12C1C111FEFE5E418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514285, "uuid": "8c74fcb2-b250-48c6-ae6b-7b96822cbd3a", "value": "6144:0zo84GbDpMuI7glVJvqa3k/ZifHeSVI0PfjEy/:0/4eMuIUlbqa3x/eS+03jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514285, "uuid": "c33bb22e-e311-45ef-8a5c-fe571f48470f", "value": 221948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514285, "uuid": "f8e8cec7-8d37-4827-bf67-ee4010cf2f1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514285, "uuid": "1b465e9d-7dfe-4b5e-b4f0-f2b45a8e2fe2", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01521e03-4429-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777507833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777507833, "uuid": "9a9a17e4-cf22-4bc8-9774-304445ca6b0d", "comment": "Malware payload", "value": "b54fdb103475681d721890b27d06edc0", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777507833, "uuid": "90cdf5e6-efc9-4934-bad2-7199ffc8368a", "comment": "Malware payload", "value": "01718933eb502e4ec9d4b1210a88cb026882d615605dd8d7fbf1c4057b7c0867", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777507833, "uuid": "52368ff5-d250-478f-b272-b3be5acfab60", "comment": "Malware payload", "value": "1c24da264bce471366156b4721bacb83201ba759", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777507833, "uuid": "def1d29f-d83e-49ae-b6cd-cde6c75c2db3", "comment": "Malware payload", "value": "3ac8e4cf434b17ba747fd71a079ee4cacde73436a7d55eb4183bea4f718a95c9a27778bb1407167016a0b7751fee2e66", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777507833, "uuid": "244f190d-3db0-4974-a7a0-f784f9aee15b", "value": "T1E365391BBCA409FAC0AA533289775191BBB2BC450F3117D73E60B2782F726D89E75784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777507833, "uuid": "1373496c-33d0-43c0-abd0-b2c06ddf70d1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777507833, "uuid": "b2504e08-5ed3-4e2e-bea5-b2d04c071bd4", "value": "24576:HFT7CDpyTuLNx2VqtC0cgryG+HQ/NBele5zK2I/LD6eURI:HF/CNyTuxxhE0RyGnGnvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777507833, "uuid": "1a55745d-d599-4058-a014-a27e999c6e04", "value": 1537536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777507833, "uuid": "6e30bd75-1b56-484c-9458-cc6a7a14cde5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777507833, "uuid": "ed71167a-a976-4ff0-80b6-0e7e0e654a1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1716c5e1-44ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777578736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578736, "uuid": "56624d5a-1beb-4a45-b391-ca5bbb7a42e3", "comment": "Malware payload (Mirai)", "value": "24b12ab017995a4d45a3fc854e1b19ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578736, "uuid": "ec00c830-4dc2-4097-a76e-99ce17adf41f", "comment": "Malware payload (Mirai)", "value": "019df454f6accab72dcb3c8723043e8a4ce512ef15748547d370ef89872685a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578736, "uuid": "57ad5417-e1ea-4c8a-8fdf-ba72adc1c86d", "comment": "Malware payload (Mirai)", "value": "2cd2dc1ff4a8b3cc0856399cd6b19a0b745a5181", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578736, "uuid": "2b9d8dc8-b2ed-4326-9f56-eb119e294921", "comment": "Malware payload (Mirai)", "value": "0085926ce08c94347c0e4135f99108e5faf8f4459fdbdcd3004061df7544040176cf3711fd4db2669b2dece02feeaf46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777578736, "uuid": "80dc6db8-8804-48b7-9108-7bf8501958f0", "value": "T1EA9319227E760E17C4C6A4B612F30B30F5B2AF5B28B8855A7C716DC9AF646C032177B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777578736, "uuid": "a2c84d04-a4ac-44b6-a8ba-ccec45378729", "value": "1536:5BoSbIMZPqpZbtOoI+OLpiWqTRn5tXONWq5AHsAlhEtBgU:5j3G75W859ONll5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777578736, "uuid": "e6e5e002-451e-4129-bc12-088838aa8a31", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777578736, "uuid": "f8d61a83-7c40-4c90-958d-b6f3ef62f861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777578736, "uuid": "1a43a49f-0acc-40ad-b767-1cd7e20ccd84", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97d2029-44a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777560540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560540, "uuid": "7d9a9083-4c5b-4e5d-ac0d-77c0613d9059", "comment": "Malware payload", "value": "260113bdfcaa5814a0e7c3d7c39989f7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560540, "uuid": "0bfe0920-5be6-427d-a0d2-36fdd30a2f9a", "comment": "Malware payload", "value": "01adcda091aeeb4818f370b49617ed3813641d2e86701ecbe1ef0f887cc4a17b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560540, "uuid": "fd460b31-1291-490f-a0b5-18b1a309dc2b", "comment": "Malware payload", "value": "98c8406f04be141c1937245a263a49ec18bcb683", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560540, "uuid": "e1bb9581-d816-4881-8d49-e0ddc0d28e0d", "comment": "Malware payload", "value": "9623aafed9069f676600d0a4970feb8cf75b2b620c6cd6445b556c7aec72c192c059c7146d82befd27823d9aaec347fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560540, "uuid": "ebf46c9e-e9b1-4832-ad81-4c848dccbbb7", "value": "T187137D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C19B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560540, "uuid": "d67a968e-1b73-4e51-b3f9-99c65fe366e5", "value": "768:bP+x9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bP+6cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777560540, "uuid": "3e4fb189-756c-4ed2-8269-8e36b4aa0634", "value": 45429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777560540, "uuid": "69a75e94-9b35-407d-9791-8fb3eeaaaf4a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560540, "uuid": "36f5bb89-a865-474e-aca5-261c2d905413", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5800574e-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565101, "uuid": "75db3545-a3f2-4501-9abf-eb5eec3c503d", "comment": "Malware payload (Mirai)", "value": "f147410051fe260b66b3628110d7d17a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565101, "uuid": "84e776f0-5dcd-44c3-aa0d-9103eab9fa80", "comment": "Malware payload (Mirai)", "value": "01f0e3d1e990e3d3c46c9e1e8c1f4a4692426920a16d6698ce31d1c8717ed537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565101, "uuid": "8af686b1-2f30-410d-82e9-605029f1ab36", "comment": "Malware payload (Mirai)", "value": "2dc0af6084d38f8a18af55af2e3afec703db6499", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565101, "uuid": "2efdc35f-9026-4383-9169-81cc7c33136d", "comment": "Malware payload (Mirai)", "value": "df352f90605932cbd091e694102e7bd5aa5a099f534ff99d7e586f01df94d07fa43495ebf4d58b0f8e5dc03d939e2334", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565101, "uuid": "e928aefa-6243-4758-a121-03f2683d4b2c", "value": "T1D9357F52FF082527DE090AF066FB2774F752246381F4D1323B042FAB586267998E7DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565101, "uuid": "2d670f02-b2cf-4517-b3e9-f5ae87982719", "value": "24576:ZSTMu0ymJkK22BBP/5+TELntZX5J38ZawsFCzsupu6:ZSTMu0ymJkK2wBP/5+TELntZpJ38ZTRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565101, "uuid": "ea93cbac-099d-4395-82d0-dd3d90a912e0", "value": 1122936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565101, "uuid": "732c5079-c861-49f9-a5a0-5d8b463cfbc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565101, "uuid": "cf93fff3-0742-410a-b383-f24174132bff", "value": "powerpc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095e5cde-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514289, "uuid": "1e4d163e-fee3-461b-a8e5-dff716b3542d", "comment": "Malware payload (Mirai)", "value": "bcafdcdd0a7ff952dcd83fa67fd91591", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514289, "uuid": "8d5cebf9-fb74-4421-a43d-036b80cfadf6", "comment": "Malware payload (Mirai)", "value": "0328ac92a916a7a7f8c4024b816aca57f5c2aac2d947731caac414a1247f1cf4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514289, "uuid": "42dbc705-a72b-4ba5-8542-2ee3cdffb13c", "comment": "Malware payload (Mirai)", "value": "7f2acee7cb86a50abeda660a9a7eeda862084c73", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514289, "uuid": "f5b94a7c-34f2-45a3-bad1-ff65369cc1bc", "comment": "Malware payload (Mirai)", "value": "7623cee020a40f6adf32ca18a20a9234bde358c8df640535dfca20eaf92aa493af8e2d7c9e4dbb82aec4cb499febf0e6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514289, "uuid": "82359390-2904-42b7-b466-a0e5be54040f", "value": "T1674171C981B528F57899DD00B0E74901B069E6E26E494B17ACDC7D37EC89F043C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514289, "uuid": "beb40db4-66ae-4724-896e-daa521b28a79", "value": "48:9XuBXuAXuNAXuTXuiXudXuZXuQXu3XuOXuuQfXubXu2XuDiXu6iTXuXXut:9XuBXuAXuNAXuTXuiXudXuZXuQXu3XuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514289, "uuid": "6a819d51-48f8-4907-94fa-b62182d64a06", "value": 1925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514289, "uuid": "f9d4b468-ceba-4f27-9925-9884e8705b7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514289, "uuid": "745275e3-12a6-4b10-9b92-afeebd590b3f", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2b27fb-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514270, "uuid": "43f21839-e731-44f7-b444-ab61520d1cbb", "comment": "Malware payload (Mirai)", "value": "a9b528f1e06b094f3aa1e1283b9caf5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514270, "uuid": "e7414ced-214f-4633-ade9-cf44eb630a5f", "comment": "Malware payload (Mirai)", "value": "043a247df856e148233519e579641420046dfd9696305b62369090274166dede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514270, "uuid": "e99f4cc8-8028-4b16-92c0-81436fc75f44", "comment": "Malware payload (Mirai)", "value": "6c07bff736fe0ee11925bd440c2374103f53cca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514270, "uuid": "49825ac4-b666-4902-a819-7c41be9c7df4", "comment": "Malware payload (Mirai)", "value": "7cc9fbe948d0755980595285ab145e8b4d5eaab7c188b690f14fd9783d6fb334538fe8591f4ad121f2615373f89475ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514270, "uuid": "c8323edc-b125-43f8-8749-5e3518cacabf", "value": "T14DF31856ED819B11C5C152BAFE0E528E33131B7CE2DE32129D246F747B8A8BF0E7A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514270, "uuid": "6422fcc4-67c2-4d90-ab86-767879730a2c", "value": "3072:RhJNEpfEdVW1L1ChBxcIdQejgUXi7tyaOA5qyYX//uoKspjfQauP:DJNEpfeW1L1ChQsRTXi7Mad5FA/uoKeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514270, "uuid": "efe90900-2a33-423a-a087-08858474db85", "value": 166548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514270, "uuid": "08da075c-cf0b-461e-9041-def0ef3c21a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514270, "uuid": "49dfbf27-309c-43ad-b8cc-c8e0353b49f3", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b562037-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538505, "uuid": "fd0d2f74-e8d7-44e2-baeb-a016ea7dfa30", "comment": "Malware payload (XWorm)", "value": "69e6c965afe0973dce513cb3cef35d46", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538505, "uuid": "70877104-c860-4252-8cb0-c26031927119", "comment": "Malware payload (XWorm)", "value": "0573e074557ae1d08f417b64ba2146db7bc224c183e75fba683554f5e5423a17", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538505, "uuid": "eda52a36-7d76-4957-9000-1709af79a607", "comment": "Malware payload (XWorm)", "value": "d6a8e50f453045ff1eeb443f55ece43ac8cf0c53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538505, "uuid": "db65945f-bd87-4215-bfae-e7357a0728f7", "comment": "Malware payload (XWorm)", "value": "5cda3f66fcdc67917b13a5c399ad7e3003540db7ec37c9d09e0d5e4191705af22cc3343b4b91eba82b8c1513ff2be37a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538505, "uuid": "6dd5131d-7a16-4351-88bc-d13079430d66", "value": "T1C73723190CEEADAD1EF8353802BA191D16D64C492A25FFC4E63FA9C385FBDD430A7116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538505, "uuid": "396e5036-753f-410d-ba62-7ec0096dd46a", "value": "49152:iUcygUcyQUcyDUcy4UcyoUcyGUcyEUcy1UcyZUcyeUcy7Ucy+BlUcy8UcyfUcyX3:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538505, "uuid": "5ae7e8bb-91a3-4dea-988a-2ed353c7cb40", "value": 23684326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538505, "uuid": "56b94b9d-047c-4d13-9151-6cd0d8dea727", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538505, "uuid": "0850b62c-6ee8-45b5-a68e-f3ba24c6ef75", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c632d42a-44bb-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777570869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570869, "uuid": "954b82c3-5700-452a-af61-a51cd9947594", "comment": "Malware payload (CoinMiner)", "value": "f77ab37692a6604b8a2ca139ee0a0345", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570869, "uuid": "34004b76-5d08-4817-acba-8c6f9eee05b0", "comment": "Malware payload (CoinMiner)", "value": "06e64ca96b4f0fd1847856148a893693859a0935ad284f9550ed83c8fecb7340", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570869, "uuid": "0553347e-924e-4f18-a3f1-0dd9f106c843", "comment": "Malware payload (CoinMiner)", "value": "a6edc5815f559c385a30e37d824060fcea9a7afa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570869, "uuid": "8815021d-b8ed-407e-853b-46a01115eed4", "comment": "Malware payload (CoinMiner)", "value": "7b7d285070037a71fe83d5863a0fa6ec69ed63b4e822601e4a5d1734bb9b126468d50c260f67a0a86d2a1327ffc6c0c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570869, "uuid": "e6fd95f2-4e90-4c81-ad61-b4f23348f313", "value": "T15E4110F7E910CA713D49DE0ABEB9C304D9C224B79F1F5D2858C22C5BA50A25834F5FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570869, "uuid": "46efc3e0-a6da-445f-bba5-a5dd881c220e", "value": "24:GonOtQK+Ok+KetybBj4C8S68XFYe7Y6eRUNZQBQMH4C8Sqve7QStQmIVSHb32rQg:yQqk1djUqFhmUPQtH/cStDqSH72EDPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570869, "uuid": "c42927bb-06b9-4c2b-a594-94778f970016", "value": 2329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570869, "uuid": "15164357-962f-4b0f-a238-860b43c39dbc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570869, "uuid": "da78b404-9cd0-416e-80bd-74fcae5fa879", "value": "xg.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628bb449-44d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581440, "uuid": "6a9cb227-e65a-41be-9e56-7e864a87c2fd", "comment": "Malware payload", "value": "93d1210b3d3e990f7e928787e59c9e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581440, "uuid": "17dc534d-a9d0-4e2b-b922-85e16ced4a12", "comment": "Malware payload", "value": "0723e82ec096c58bb36a9bcb8c3523d48d5b273232f79c8fdf573fb10d1bef24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581440, "uuid": "7b951aec-7eff-4292-901d-78dfc709f6e0", "comment": "Malware payload", "value": "58a14b08f6e11d1d3aa0ad35da9564ffed9bd022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581440, "uuid": "d07e5ac4-0aba-4948-a5ca-3b6c5fb86402", "comment": "Malware payload", "value": "2f9ff38ae729b93bef36bad802a56557edc8c1053ae2012fb049778390bd4a040f6cfe67a1859481247ed4bde6587d99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581440, "uuid": "ce57b035-92c1-40c8-b114-dcd164b07fe5", "value": "T177731808FD63C1F6F64344B4416A5F505F709C2BB0E3D6A2FF446B629936716AF18A2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581440, "uuid": "5bfc1d14-9cda-4877-a6c0-5f9195d87554", "value": "1536:GFMmB5TKh4v1V+e6Hfv2i546L1xZyhA7kM9PYE:GF/eh4tVx6pe6RxScPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581440, "uuid": "62e1cad3-e069-4c95-96b8-3dbdc5fec61a", "value": 79176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581440, "uuid": "b69b4dcc-5eab-48a2-8dad-44ef70a7be49", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581440, "uuid": "1edf3e6a-f3e3-4457-9938-665dc3d5cb9a", "value": "NPD4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccbf7d4-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514268, "uuid": "74d28406-a149-4739-b432-02cf1fbce526", "comment": "Malware payload (Mirai)", "value": "77a1dfaf30f3bb9247879efdd270e95f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514268, "uuid": "73cd2b9f-a153-4295-a37b-0a66be73e972", "comment": "Malware payload (Mirai)", "value": "0735d9d662be4a6e5033a4e926f6a1a4d7221114aeb6aa5fcdbf3d21346efc4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514268, "uuid": "f663ed7c-497e-49ad-b1ed-23fe32db28cc", "comment": "Malware payload (Mirai)", "value": "341f6215de36646f79cedd00d3fc7c34c9e66a40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514268, "uuid": "edce2dac-b7e5-4b88-8dc4-7ae4f4b4cec4", "comment": "Malware payload (Mirai)", "value": "d411111444920fe867f99d8cb4cc18472aa14df89a5b8520764e168b226f1dd6288b7b4b1e78c898b8c8b7692da58147", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514268, "uuid": "8253a3f9-b364-479b-9102-eab73b5e669c", "value": "T18BE33A06B30D0943D2672EF43B3B27D1C3EFDA9125F4EA44251FAA4992B1D325589DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514268, "uuid": "f08b7802-15fb-4f95-bfe2-305b2ee18e16", "value": "1536:XoRwIXhHagSGXVG4n7WE7IlUx7czNxn77AUnPEHyYq6x7cuN+L4VC/zJTGCWUU7A:Xm9agO47B7bxYz3UQMSX/zJBWS5h+Y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514268, "uuid": "9800215e-9383-4a06-bd94-01043be3674e", "value": 154540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514268, "uuid": "82d5a2f1-588e-44e7-a098-4662109858bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514268, "uuid": "42da6c70-14cc-4177-a8e6-b1639921b9d5", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cdc99e-44b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777568688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777568688, "uuid": "b047ec7c-c586-4ff4-9d8d-8472cfa69099", "comment": "Malware payload", "value": "651c49ffa047e192af8b5fb94058ec6d", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777568688, "uuid": "97dc1f9f-8d3c-461c-a841-0f525edd06ec", "comment": "Malware payload", "value": "087a2eee92bcad418e5a058007256cc1756d0fbad102cd8c5eb7d4e26e12b7bf", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777568688, "uuid": "1c874816-b977-489d-8800-a24f4f331d57", "comment": "Malware payload", "value": "137d6c397c66a09f80aa768913f024c27c0545bd", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777568688, "uuid": "c017d8b2-03f8-4e32-9b90-9ce7a73404ec", "comment": "Malware payload", "value": "53019fa56b6526ea600f78c0d334fd05d413286dc02ffb4b023a0b8cfb8bbac0e916b6a506dffc793fc43511cbf0fc8f", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777568688, "uuid": "6c273134-e188-4fcf-9465-8fe8d5140ae8", "value": "T1B0E61233B38A653EF07E5A365AB6E210543B7A61AD128D1FD7F4046CCF252A03D3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777568688, "uuid": "d07f04e4-0acc-4e05-9389-9d1798aadd2e", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777568688, "uuid": "0ce6f815-6d14-4641-ba76-0d13acda9609", "value": "98304:KL8NcPbCmKmKC44vTCUvuxyfftgKcd/Vzs4zf/dpH6RNWRzcwxMym:tEFKmKC44vTCUvux0KhdNPXKWRzTSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777568688, "uuid": "5e82a16b-83ed-440a-8105-301535358851", "value": 13898000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777568688, "uuid": "cca576f3-d78d-45e6-9e46-e87f0c4df0f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777568688, "uuid": "f18290e5-495b-41ed-b2a3-12d8fe34cb04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535f49a1-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565093, "uuid": "99f0e9f4-caec-4e9f-a510-3edb7c378b10", "comment": "Malware payload (Mirai)", "value": "b8206e63f07724559d55039a1281cbe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565093, "uuid": "ab66a7de-bfff-4b36-aa8e-0f507530d6df", "comment": "Malware payload (Mirai)", "value": "0a3b334d70200e7f291c1f3a165ec7966adce6508be6c275b3608d4f5142529c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565093, "uuid": "af20186a-5f79-4c76-a11e-c26c81a3719c", "comment": "Malware payload (Mirai)", "value": "57193ad1c570a2b6bb9492308bdb064848aac79f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565093, "uuid": "1d310d4f-5f76-4129-9971-20087c379b81", "comment": "Malware payload (Mirai)", "value": "872264fffff6c6ddea2c4a9c2c9fcf945cea96c529e721a110dff0ef4d8b6955a150fc700ff9a30bb006c8781c4ab23f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565093, "uuid": "b814836f-bc06-4eae-b26b-105b68cf14be", "value": "T1DFD4BF41730D3EB6E376743E80920B266F18AF4095832F2761F4B65A69B35AB1F3C587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565093, "uuid": "67aecd0e-45fe-4760-b8eb-8a8e5c61828b", "value": "12288:GD8ViqXUnGXbOkyUr1IgoKN+TE04hVHvYzI+f:3VT1kQmToVHvYzRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565093, "uuid": "076f876d-36ed-4697-bcda-69fa46d270d9", "value": 600076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565093, "uuid": "f0cf41d1-4f0b-443b-8450-bd5ecd5b4acf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565093, "uuid": "1768df03-b13e-48d9-a7c8-41a8890360c5", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433f2f65-44be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777571938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571938, "uuid": "487e5d17-1a0a-42fe-a2bf-931ad672cffd", "comment": "Malware payload (Mirai)", "value": "d2b00139689965da7a5ab761909e8c9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571938, "uuid": "f421b00b-d776-4f7c-abda-cb5d5f5a5bfd", "comment": "Malware payload (Mirai)", "value": "0c7003882a1557bb0556fcc92d769164758c2c759f500949b734244132ad4c94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571938, "uuid": "ecd362cb-2eb3-4651-aaeb-dfc27730abd9", "comment": "Malware payload (Mirai)", "value": "1ce82188bc64f24b924e54b760840a4b458fc776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571938, "uuid": "b966824e-90f4-4df7-bfdc-a2f788009db6", "comment": "Malware payload (Mirai)", "value": "4c0a304d3ec8c9b42f15345f0cf7e9995ef8d00276138b64e9d236c52ca652e3e8f63912a04e840c6087cb31a76339db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571938, "uuid": "4d2afa3d-d352-4871-aa8b-bd9a93e80bd6", "value": "T144735C42B30C0947D2671EF03B3F33E5D3AEE68121E4EB85650EEB4592B6D325586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571938, "uuid": "26ca3dcc-e166-46f2-abec-8779a66be4be", "value": "1536:Re7e4fXHvuHujr5YCA4V0EU9PuB9uegZW9kHvpVnJXqatJ9HMyE+NT:I3fXHvuHujr5+w0jWSHvZDLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777571938, "uuid": "469b29fe-2178-490f-b7ff-8918ab0eca30", "value": 75856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777571938, "uuid": "0a19ed36-d5de-402b-8f5e-69abf21a8fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571938, "uuid": "93dab661-80a3-4558-a82e-71ab5ece6c51", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259ee272-4456-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777527221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777527221, "uuid": "d8390325-e7aa-4236-9970-37cc7b088cb8", "comment": "Malware payload", "value": "ca8456cddf9609ff00f3821851e723c8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777527221, "uuid": "f881060c-c491-4667-97ef-be5269ed2363", "comment": "Malware payload", "value": "0c78d3f75335104cf6c56a029150677a7dc9bbc020031adf3c491fcd151c59c6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777527221, "uuid": "abeb84c6-2f22-43d9-b38f-6aa8b628711a", "comment": "Malware payload", "value": "6f1bd73ef4248bd233f90062e25c5146a2b5730c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777527221, "uuid": "76c743ce-6d49-48d5-80f3-f5c309e0008b", "comment": "Malware payload", "value": "80e370edb80dec5872370f142f658d30218e0d79f72c7690ba28fe888dc52c69325e5a418b3eec5117476f5f541103e5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777527221, "uuid": "db83bd04-ba85-4ceb-a7a1-5f10d33ef357", "value": "T1B5D3D08D4C5E01E50246686507DF1277EF3CB4A64258CADBFBFED6A5AF088AC40B7394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777527221, "uuid": "58c52b7b-b493-4931-b471-d58231fced46", "value": "1536:xS9zc2CfM81KdgU/o+pL42sRyUy6f0UUkmbs:xS1CfM81KdgUQ+pL42s7f0UUhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777527221, "uuid": "944300cd-5715-4584-9060-9f1158a37f75", "value": 132394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777527221, "uuid": "514208a6-2be8-4acd-ba9e-dc27efd468a4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777527221, "uuid": "6642e3a8-5de8-4436-9c4b-90e50ceda15b", "value": "Work_Nova_Data_553.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f968ab9-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514809, "uuid": "c3eb934e-0392-491a-9c04-7e9ac046b1be", "comment": "Malware payload (Mirai)", "value": "5490f7550624478f0aadfcb93c63866e", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514809, "uuid": "2bd36a98-135f-40ff-8679-7ba990ec2f48", "comment": "Malware payload (Mirai)", "value": "0cca6e881427723c8ae9f364f9fb9017f8aa46c3eadc3c8e2c1c9ff6b5ef5c28", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514809, "uuid": "84521ef5-cd09-4519-b4f0-56b6ae801571", "comment": "Malware payload (Mirai)", "value": "e8814babf81dc2922d00be1cf1584cdb33e97410", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514809, "uuid": "1153e919-a6da-46df-b3ca-f454270a795a", "comment": "Malware payload (Mirai)", "value": "f3034c4839de2238f725044a6daf1048d3c12603d13669b9fbf890fe6e3950423a61475d4e42a28a5f4815e8ed94e416", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514809, "uuid": "0a44ba2e-ab55-4b39-a1cb-8acbe8f5689c", "value": "T1175301A550E5F424C56293F522048F0A238ADA827F04CCDC34DE135BAD9EF9F9F956D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514809, "uuid": "6fb85d35-b391-4f02-bd49-4070145da402", "value": "1536:XznwRRM10ac1B010ZtaS4SV/zQUjsPwttl6vKwfsLkg4azHo:TrREB5taUVLQlwtt0kLGazHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514809, "uuid": "7d6d40fe-c0c5-4e19-8aba-c81ad2e499f2", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514809, "uuid": "2b0f2c43-aa3d-4984-b9b8-deec1683fd30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514809, "uuid": "45559549-402b-4093-8a90-ce80eea7a3b4", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3f04d6-44c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777572844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572844, "uuid": "52078526-67e9-4394-ba1d-135ee1110ad6", "comment": "Malware payload (Mirai)", "value": "6e00da8e253603690318738d661d043b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572844, "uuid": "7a37b11f-11da-4ffa-87e8-7c109a7759b7", "comment": "Malware payload (Mirai)", "value": "0f2568af829c7ef2302df08f001dc04348cb7dae05504a362ae1f0667c3789f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572844, "uuid": "803d0f9d-1cc5-4e91-84fe-f56458015137", "comment": "Malware payload (Mirai)", "value": "3bf985275cd2104bc5993367297d0f01a3d59ab2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572844, "uuid": "0ab865bd-24ff-4a90-b692-828aca016017", "comment": "Malware payload (Mirai)", "value": "49f8f2cfbdff156004097234fc2d25a6c4ef92a8fc960c094989b3de472176dca34db87a01472a394402d6a28b5846ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572844, "uuid": "8392985a-f8c9-4e59-b3c2-3934dbc79eaa", "value": "T107F31A56EB418B03C0D22BBAFA9F425533239B64D3E733059928BFF43F867994E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572844, "uuid": "c1d3f95a-d2b2-4924-a0bd-fad678065196", "value": "3072:c3KV6aUhAro90MmXbJk1SSPD+VXvYTXsfeG6b6YM/9vS35pmzwI9jxWdO:wY6aU+ro90MEbJkLPiVXvYTXgeG6HM//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777572844, "uuid": "7ae78722-3665-4eb6-a941-83ea08b11512", "value": 170954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777572844, "uuid": "fb84a977-8d6c-4096-b3f2-66622d450361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572844, "uuid": "18f364dc-8788-4270-a73b-5cbece9ef8ef", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b68ddb0-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514292, "uuid": "8afd8c1d-6a81-4ec9-b491-b5fa380a6a8d", "comment": "Malware payload (Mirai)", "value": "29e07ca29ecae2b0988711316339db75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514292, "uuid": "78d013aa-b48e-4b50-85bb-5575a95ba7cf", "comment": "Malware payload (Mirai)", "value": "10433914187823e5c4ee9f83f9c270ce6a0fcc66fcf4f13e6f64e6142754a5c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514292, "uuid": "d65101b4-f406-4f27-a7ab-fd3a1d220f1e", "comment": "Malware payload (Mirai)", "value": "6656205b04d9e3b625f11ec10289f324c0d39834", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514292, "uuid": "2a1da763-aefc-466e-8319-ddf7a34f4714", "comment": "Malware payload (Mirai)", "value": "7a420ac495533d4ec5c461fab0327b4e5675c982b8cd1d2e07e3896de1ab9704c9737d49bb9ebba8b1ce3f870b03a9f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514292, "uuid": "83e97c57-bf96-49ba-8c53-a4ef6ca74bae", "value": "T14CE32945FC519B16CAD662BBFF4E428D772B0768D2EE31039D255F20378B96A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514292, "uuid": "cfe7a0c3-02b1-482e-85ca-dfc5f3d1aa5f", "value": "3072:TRape659xxg9khDqjGChePPpTp24v2coS72yLqztxD6RJ:9ape659jg2hDOORF24Oco62H5d6RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514292, "uuid": "6bae25a9-67c7-406f-a444-dfb84aaa026a", "value": 154712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514292, "uuid": "ac12bd9a-ccd4-4a49-8404-c4c56bbd2de3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514292, "uuid": "7464be0d-2d6c-4eb6-a46a-b1d2bddfa9c5", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c292af1-4445-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777520118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520118, "uuid": "e1229982-91ad-4ad8-b5c7-cd7a02148d62", "comment": "Malware payload (NanoCore)", "value": "faaeee9e4039dea586eb6589e3de942f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520118, "uuid": "4ca0db22-57cf-421a-bacd-7f8f34485d79", "comment": "Malware payload (NanoCore)", "value": "10946ad5201785a8c9bdb96fcd07c94642584e0bca7254ea22a95d7d41562fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520118, "uuid": "a285ec3f-8dda-4847-ae74-611297eba0dc", "comment": "Malware payload (NanoCore)", "value": "8ef78dc65fd3f907c9576e7797445dce08095eb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520118, "uuid": "77f750b5-f404-4ac2-947c-568cc8389b79", "comment": "Malware payload (NanoCore)", "value": "23a6dbe71a9c5c0c028f24a23e05c5a22e539de7bdb84bdab91cdf142ed98c00ad845b045d79d67a1c37e2f065584562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520118, "uuid": "fad9d28b-8de3-4289-b3ba-2492406c86fc", "value": "T14414BF2677B94A2FE2DE8679701206439378C2E398C3F3DE28D855B68F167E1060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520118, "uuid": "ace22d09-c64d-4854-8f95-fb9bc513a7ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520118, "uuid": "c2067b7a-abca-43c7-94aa-311dbe973c51", "value": "6144:MLV6Bta6dtJmakIM5TBGmPDZ1ZgJB6QUWP:MLV6BtpmkSBGmPDZ1gB65WP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777520118, "uuid": "e86e19a2-04e8-4022-ac72-9fb08942b276", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777520118, "uuid": "6d35ecfb-9325-4ce5-a986-a0e704761179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520118, "uuid": "24ac9b7d-496b-4e08-bea6-2b0892c1544f", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad629ba5-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535609, "uuid": "7de4e05d-00a5-4984-8309-faee042928f9", "comment": "Malware payload (XWorm)", "value": "71da4882f9651406e71837eb0cfcfbeb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535609, "uuid": "06e0cd60-e731-4ae3-8456-e4b2e64ed6b2", "comment": "Malware payload (XWorm)", "value": "11398ba7fedb8c84624603a368d28205d942ccd0b47ce3a4f2af99f8f596a720", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535609, "uuid": "f0f697f7-51e3-4e23-808d-a7260f77d7d6", "comment": "Malware payload (XWorm)", "value": "ad225cc6bcf7f7daa8338dd0b61fe70998150b12", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535609, "uuid": "f3e0b4c3-3169-4fda-9f0d-2736bac6a55f", "comment": "Malware payload (XWorm)", "value": "bd4dea9a8f8dfecc9f3806dc9154ead65006d3fb3d991a3e10e956727a730aacf29b70f20a2b1eef4146d20035e983ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535609, "uuid": "681c9a4a-44f7-4599-b465-29d892bd620e", "value": "T1D33723045FBB56BDCBA0018504F83B0A2FD9885D557F3EE3E78A78A217B79AF24D4610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535609, "uuid": "40574b1b-5a24-46af-ab15-060d4ac78d1d", "value": "49152:WByN2ki8dzGHiZbEVtZnZkBtmyOcLQvIQYKdZmZEfoaZ/Z7pl66P77XLInybuGbq:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535609, "uuid": "73b47be3-6f49-47cf-ac81-21420f7ac7a2", "value": 23944458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535609, "uuid": "75d92ca1-e69b-4d35-bcc9-0e74023a0eaf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535609, "uuid": "30ba9d44-6138-42eb-a911-693a38fd9f1f", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25be0153-44bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777570600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570600, "uuid": "a1023d4c-73dc-4722-9a22-e5ab92476aa9", "comment": "Malware payload", "value": "9fe1ddfcb930e466f97750196db8383a", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570600, "uuid": "f9c7c48a-4216-4a76-81c8-eb440300da1c", "comment": "Malware payload", "value": "118af5aab31c8a7f7045313310a110bc0f498d894b92c7829eaed76ef79665b5", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570600, "uuid": "f774ebfa-e410-44f7-85cf-7a10e02392e6", "comment": "Malware payload", "value": "3267a7454c78e7d8910facbe083e906802eb5609", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570600, "uuid": "9adac645-d8c1-46d1-b605-abf1b307dca6", "comment": "Malware payload", "value": "b417313166c1e253a22a7f567bfd3d01ded82171a9378cf4072e3d8a5655853e65d3fce143c609bef44c5c9dc833a5bc", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570600, "uuid": "476f78e3-9750-4ec8-838b-1ebf1e539e44", "value": "T11EA29E4FF784AABE1F921FA386360CD9ED6C556785D01CCAD312D14A2FE1E2594930F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570600, "uuid": "77eb64c3-58da-4729-9003-1ff4fd90cc70", "value": "384:uIsKYu8IxQo5MFhSNorUVRZiTdOQ94DTK0/8f+uRbTG6j382N7FclWM1c5hZtX:uIsKY6Q0MslLOOQynVU2uRm6j382N7ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570600, "uuid": "53a0bac5-2974-4960-a511-771f58283e82", "value": 23160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570600, "uuid": "e8f4c502-dfb4-4161-b6c0-18b4df966c7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570600, "uuid": "ac5a83b7-9777-4bf2-a1fb-7080a64a8ae4", "value": "apeje.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1845393-445b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777529603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529603, "uuid": "90877103-3988-4870-b669-0bd0c6c0fc48", "comment": "Malware payload", "value": "0485159c61ab4d6b72d317a9a9eff596", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529603, "uuid": "593ae723-2794-4fd5-ac8a-7b0bbb7ed495", "comment": "Malware payload", "value": "11b235d0a5e57c354a21e3fc2632bf91e7fc8927f9d50202c82fe3c1ffab292e", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529603, "uuid": "0d273247-a8e1-4055-aac3-ed99401ff19c", "comment": "Malware payload", "value": "ebe934b0abf52737eacb70920fce260719c02d53", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529603, "uuid": "28897f99-29aa-42f1-a7a2-52e28fba596c", "comment": "Malware payload", "value": "f1c33ccca56abcdd617391e1a173915a001087920d284eb065bb1575f6e83ded0acf49da8fdf65c550bf8c06553d0e01", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777529603, "uuid": "fa6c217d-8513-4c8b-a5e5-34ec53684d71", "value": "T11AD39CCB499E88FC8B1FA128C51F5D53EA4F56131A1DC5A1BAEEED403F11E61B09ACD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777529603, "uuid": "cad4ff9d-5020-48e1-be44-df108b8ad1a2", "value": "768:16yqYcnvmfc0avK6eogVi9ivY/frHkU6fwXZiFV2VHzWmJvsAR5GjUvZ47qIqJrR:1QguKYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777529603, "uuid": "e3b52836-bd5c-4406-94b3-c1ebc0d6a3b8", "value": 137093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777529603, "uuid": "c26656a1-aae2-4429-a188-6d57d2e909be", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777529603, "uuid": "0d2e7258-49c5-4cd1-8f08-fe1d5118f173", "value": "Audio_Stable_v8.6.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4434fb4c-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514817, "uuid": "6e4f6d05-162f-41fb-8e21-9e15afa5e818", "comment": "Malware payload (Mirai)", "value": "ad42b7cf57574af5caf88c8f06e91c61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514817, "uuid": "514d8281-700d-4b5a-a516-8e03d377ef0b", "comment": "Malware payload (Mirai)", "value": "11f348acdbd7ffc78c1f13e6cadc23d5ca82a3370a961e5bbabd62be1787f486", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514817, "uuid": "320bdaf9-8635-4644-8b12-334e87103e0a", "comment": "Malware payload (Mirai)", "value": "e4e580ac080a86caa25fd6fd33cc52f841150fe5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514817, "uuid": "f6a27a6c-2ae2-4cb6-8969-16f388a9481e", "comment": "Malware payload (Mirai)", "value": "8e2ba5b60d598827f95e59f657fe129261e770ba746c63da2575a0555ab2f074d6fedc603bcc8d46cd8c1b95ee118eea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514817, "uuid": "84a16f00-8b25-43e8-99af-67e6063ed30f", "value": "T1DDC3F185FB636991D0A342FDA4C00AC387912E318BA217480699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514817, "uuid": "b623180e-811f-4791-a805-5af1b8f73faf", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTnx:eMQRtXU9kLCP8ifbxTnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514817, "uuid": "6e782627-3e00-466a-b58f-90c8c24de543", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514817, "uuid": "c8ac3625-43f7-4681-9b83-5070a097381b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514817, "uuid": "b3239e7c-719d-4bc0-8d2d-47b7378c54f6", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc483f4b-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535312, "uuid": "6a424363-77c1-417f-a3a1-6808728219d9", "comment": "Malware payload (XWorm)", "value": "cc5f4dfa5a1ccf54008376e1c83eeedc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535312, "uuid": "7bdbc9a1-12a4-4a75-a732-eb7ca95c0bb0", "comment": "Malware payload (XWorm)", "value": "12949d5c1becde424c375652315eb2fcf84bbbed130e67ea9bad255e405cc1c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535312, "uuid": "b06fc8dc-87f9-4773-8063-462d043be6be", "comment": "Malware payload (XWorm)", "value": "6df65463a19f27c243f71b526fa384afc93e6e32", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535312, "uuid": "7a85897c-c38a-4883-8940-990d0490da97", "comment": "Malware payload (XWorm)", "value": "584a8024e190f489819710b5de0db870ad97045eb8352a8f07b1b746adc044c82a0f281d7a4d1a0ba45d5747608883fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535312, "uuid": "3d0c1fd1-3618-4682-8b55-aa3211cd2e7f", "value": "T1FE37230544FF2F3F65AC2AC9406B073A4BE04B40415DADA69BDA94DD3A0EF3F71292D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535312, "uuid": "9a7c2dad-863e-4de3-989e-706f97bc042c", "value": "49152:Z9BwkLZwj2ulSSxcS+bBxbSxcveNE3KhINMkmhfXSxcPSxcPybjSxcOAuLUFFm6Y:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535312, "uuid": "9e5cd663-a52b-402d-92de-09793ef5a326", "value": 24204586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535312, "uuid": "36c4cf47-742e-4528-a0cc-ebbc59647c32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535312, "uuid": "ea68c79f-742b-4203-bd75-1aa078fe07e2", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4b945e-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514265, "uuid": "d527b188-e191-4775-b27d-67b24d10d4c5", "comment": "Malware payload (Mirai)", "value": "e5299890246aaaecf4a18edeb0bcf497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514265, "uuid": "2a2e9715-b3d1-4c05-afa5-ba6f22a908a2", "comment": "Malware payload (Mirai)", "value": "14db2155c219efa8b05f851f164d5bd7c4fe118951025b43f80b9db01e600f27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514265, "uuid": "86c11ad7-7c19-4822-9b62-2f7abf953f64", "comment": "Malware payload (Mirai)", "value": "c819f8353d96e8505e2e9ad6a97cc65672d5c57d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514265, "uuid": "b2a7c2ae-07d1-4cd8-a302-884922116b6c", "comment": "Malware payload (Mirai)", "value": "52f64f3ecb502ea297d0f44f88f0320393e06fbf27d1bd404c6b7632f736a2ce5b76ccb393a551340409319d35cf6523", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514265, "uuid": "7ca026fe-3d9c-4f39-8540-12e7c7ded10a", "value": "T176342A87F900DF7EFC0BA2B244670D15B030BF7618621677F126BDA6AE390D5192BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514265, "uuid": "3f41bb2f-07ca-4a5b-bc8d-f3dfc03f1c22", "value": "6144:FOBeVME4wCpHvyVPA5db+OQLkjIL0mMKXi:AeVW/3QEmMKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514265, "uuid": "44d430b7-6495-422f-8b04-31dbc9c3ffd2", "value": 232280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514265, "uuid": "be6ae1e8-0750-4824-9528-b62325adbc01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514265, "uuid": "e95da393-11b0-447f-9c4b-2eda97f9e804", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6f5bbb-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535613, "uuid": "df0aaca1-1251-4d80-ab97-66d2b95301ee", "comment": "Malware payload (XWorm)", "value": "917af6feac6beca1ed33cb696c4d83e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535613, "uuid": "0f3e51d7-994a-48c5-87cb-3e34b95b4d30", "comment": "Malware payload (XWorm)", "value": "14f519665f69d35d68cbfc6b740fd5aad113f227f7dc03834ce63b5dd4f45fe9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535613, "uuid": "c23731fe-d7f6-45a2-b2a0-20cf7f171721", "comment": "Malware payload (XWorm)", "value": "c6e17d4b91480b44b8dc43f948724e3d4756cf1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535613, "uuid": "28fad1ce-3c29-452f-9fc1-cdc7c36a5e51", "comment": "Malware payload (XWorm)", "value": "c82f8f1dac90fd93cd3c94713e28f61434133d2c9b5ab9bdcbc0dee51e736eb7503064206a426e5ac9ed5742187509d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535613, "uuid": "e3c536c6-92d4-4ff7-82c2-b90ca4e71802", "value": "T1A43723660DAC4EFEA39B1B6818AC075EE1C90E3748568DDCC554729810AEFFD858F4CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535613, "uuid": "c43b47e6-7483-4cbc-9f83-143dfb1d03d6", "value": "49152:YPc6PcbPcaPcPPcXPctPcxPcXPc8PcfPcRPcW0fOPcvPcQPcSPc+Pc60ftPccPci:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535613, "uuid": "548b8486-5ab5-4ad3-87d1-c1b24a6920ee", "value": 23164055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535613, "uuid": "4cd68fc7-246a-4057-97cd-6cea6a1ea0f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535613, "uuid": "130f12ab-a750-4612-a5cf-334e9a8f7065", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e88f5b-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565096, "uuid": "2997df8b-922d-4729-9757-57c9edc68f78", "comment": "Malware payload (Mirai)", "value": "df5b9bc0ea878ed9787ac3b8d38ede75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565096, "uuid": "fe84f894-ef3c-4e2d-a41a-7cf67c125a88", "comment": "Malware payload (Mirai)", "value": "15e516044e8aa5af9ee37ebb5cac28aab205a996012ccb56a7aa57d4147e1edd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565096, "uuid": "a6113404-1697-4d69-a899-1c9ac885a7e0", "comment": "Malware payload (Mirai)", "value": "eab38021d6b2e4abe43ce0c1816cf93c1791ce8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565096, "uuid": "a7150a6d-c46b-4cd5-9aaa-2d30d1b281a8", "comment": "Malware payload (Mirai)", "value": "c59920de6cd99357ce0654ee7279924358427a1fa149c3e5c647f61651e736981a825ac7e71456fcfca3f8074619cfb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565096, "uuid": "e71ffbea-462f-48d5-953e-82b9682e05f1", "value": "T182157D2AB2B3B57CE00BC03447DBCAA25535F07522212DBB26C4DA353D6ADE51369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565096, "uuid": "ed542e0b-ec1f-4e5d-bc82-a63a000ea0c2", "value": "12288:WjG0IxNgu/gP7sKd9Hayw33+SpmT/3pO5DW+BiObttaqoqc1ayUH+cd1HX:SGbxNguIP7EBkstJBiYt/x+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565096, "uuid": "ae573d15-c63e-437b-ad5a-edb742dcc7d4", "value": 957256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565096, "uuid": "b95b2b04-bf17-4f3b-a7e9-1973ba1b11d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565096, "uuid": "32b5ffd0-ac21-4370-8435-aba4006b9f19", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7b86e9-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514269, "uuid": "58931392-0528-4f59-abb3-ca74bd5d6476", "comment": "Malware payload (Mirai)", "value": "20d44b27b4c779a9c17ff20ef0410559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514269, "uuid": "1f8074b3-985b-4c42-bdbb-9ea4251ca340", "comment": "Malware payload (Mirai)", "value": "1615a587097393c1e5dfa347fed8c170694e83b0a2c50940060782a3de6cef7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514269, "uuid": "f5310a5b-677e-4970-bc32-b9b4856fae22", "comment": "Malware payload (Mirai)", "value": "dcd298892da2444339ba07138045493be169a5ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514269, "uuid": "83570e7d-1956-4d36-acaa-8c267708a9b8", "comment": "Malware payload (Mirai)", "value": "0fce2b0f4c9e77024553feb6ed3c95da17809350ed0e83b8c8a64746b296af0fdd3f56f53118d00e58371d4686e6f72e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514269, "uuid": "1d4c48d8-1d94-411a-974c-e9c20fd80346", "value": "T1A8242B137A81C9FEC486D1F04BEFA5329975F82D0635714A3794FFB12A09EA02B6D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514269, "uuid": "402a1f38-75c6-48fd-8bcf-2dba89654af8", "value": "3072:kxxfr5bSSKvgM6JvoefDW8R59yuuWuWSiS7UvDoUZLwB6BoixA1Y1ml1zFPdL7fK:kxhlSSKvgM6h1fD7D8SL1BDk2E7ddPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514269, "uuid": "cd40240d-0ef2-43d8-bbcf-85db95fcc7b5", "value": 213648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514269, "uuid": "223e4c6b-2c2a-4bce-a07e-6852de01459d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514269, "uuid": "477686cc-8260-432f-8579-cf121482258d", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d700a8-4460-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777531518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531518, "uuid": "bf50535f-43a0-4829-810f-90c7b4fabbbc", "comment": "Malware payload", "value": "081504253d83bd89f879d5a8b4dba6d3", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531518, "uuid": "b92876fa-f674-41ba-9130-785677e47c3d", "comment": "Malware payload", "value": "164c09471088b677ff1bde410ce8218857df33d7d4fb78aa629784ce0619de69", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531518, "uuid": "51b9feff-ead5-4b1a-975d-49c3be784c31", "comment": "Malware payload", "value": "946e6bd06ed9ca23df462e6d83f99636ed47b5e6", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531518, "uuid": "db9dd884-d149-44ee-9df1-3c972a7231ef", "comment": "Malware payload", "value": "80e7ef07c6a99f4192ec84d90110f6d9fc7831b5bf0e1c402f29dcdd32024862f2b10ddbd66ed21c11f6f4926853f3d8", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531518, "uuid": "f570cebd-ad01-4909-87ec-5bb69b7f3cc9", "value": "T1A4D3668A098F88F887676064B5DB7D03EBA5D72F060CD641FB5FE9A16F1159CA0B93C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531518, "uuid": "00200eda-8ea9-4a71-9880-a356c8fed81e", "value": "768:O3di/VY6PU3jY9pt8XV3FhlS8KDJg6EtKWeBHFsyMXyjyxaQqMJH27BtG7f4:6UuR/sEgW64yjyxvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531518, "uuid": "18271b33-b2d8-4c29-a15f-cb3d69bee8b8", "value": 136032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531518, "uuid": "9bd7df2a-147c-4f0c-b55a-d9c1fd737b6d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531518, "uuid": "34830d24-6bde-4fa7-b0a1-fd8098aff2b6", "value": "Finance_Release_Updated_8018.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d605da92-44a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1777559729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559729, "uuid": "cb12a119-a860-47e6-b442-2acf3a169c8e", "comment": "Malware payload (Joker)", "value": "3940564904b0274eaf483d61e21c3d8a", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559729, "uuid": "e07a3bb8-b1ea-436f-8a93-c825d363d98b", "comment": "Malware payload (Joker)", "value": "16a26c9b0b721fe1752a6cef9ae1a5913764b2cd627a091b96f42909bbe102f7", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559729, "uuid": "5a1a6978-71df-466c-a4db-5db3994470c4", "comment": "Malware payload (Joker)", "value": "44d1db577322dbb7dbad09cf452f61061b1e34ab", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559729, "uuid": "4f80f812-2a0a-4d44-a629-cb584eb8fb08", "comment": "Malware payload (Joker)", "value": "e9f8d7a492e391618321ad85bb1d44f4fbe98a7658525830caa14799009c247ff37dc7f52350ba87c9684b05a1e1609d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777559729, "uuid": "6546a19f-2276-455a-9d09-e5f53a133cc3", "value": "T18327120EE70D642FF993EA7C449F5520F9A37C0AA912DBE75510B25C4A73AC42F5B388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777559729, "uuid": "1f6985cd-7c63-413d-8c2a-99ae0424aed2", "value": "393216:K7U2VQWke16FBfeEXoO8l8K49r4kopcjSXSYulVDFAEyHJ1:mKrfeEYOU2LopBXwLFAEyHJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777559729, "uuid": "b9b56fad-1f9d-4f20-80ce-4eb902e63e94", "value": 21244329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777559729, "uuid": "77de92d9-a2f5-4e58-aa0b-4c8c44d1c4bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777559729, "uuid": "4c67a6af-2127-48fc-9943-4f9b1ea44016", "value": "com.lite.cleaner.phonemanage_1.8.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb8f52f-44d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581323, "uuid": "635e28c9-aac9-4932-a612-808b9b587d16", "comment": "Malware payload", "value": "e4226dcc0bc50bde72161ef5c6911e9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581323, "uuid": "2aceb7e5-2953-450e-a39b-8d383d55f12b", "comment": "Malware payload", "value": "16c416c0468e8d5f6e9d0c46d12e581fd75071a6d3095cfec4257492ff3df396", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581323, "uuid": "17f9a4b1-e898-4f2c-937a-0c557b04800e", "comment": "Malware payload", "value": "d362fe897b6ffe843a748cfa25654b1b290846a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581323, "uuid": "8fd2e891-f969-4b52-9743-a444ada202ca", "comment": "Malware payload", "value": "264be7502de82a35750fc47a3fbf03e9f6c562f93e3cbade2af69b7fac1beee3141b1f00f2cf4249fc0e4e22d1728d93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581323, "uuid": "913dcde7-d1e2-416a-923e-03a68641fefe", "value": "T1F893F94EEE641ADBE46FDF3044294707199E7C7F51F163299238ED4432D920869F7CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581323, "uuid": "12675f2c-ab99-446b-995a-1db412bbcd77", "value": "1536:E0Wd19DrA4vbLn1TVfzMv4hlwaLg/nruIIqUi+lCKkCs73:2d1xAk/hwd/nD4JICq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581323, "uuid": "d640a8c9-e546-4712-8074-58591c62017c", "value": 96952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581323, "uuid": "bec71a09-3313-44d4-9c69-40abb0643904", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581323, "uuid": "00ec1ec5-0c71-4cb7-9e35-6210673ff346", "value": "blWB", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d5ac73-44ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777592018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592018, "uuid": "d5d1758d-65c5-48b5-afb1-c7e9ad5249a2", "comment": "Malware payload", "value": "d46ff94bded0e384d2fcbcf561e01605", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592018, "uuid": "4ffc930c-1838-4a76-a63f-84b61c22af3d", "comment": "Malware payload", "value": "16e1d010abace8b3bc137f13ea3e5a16535ca2baafd0379e76f71b4c5c8ef989", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592018, "uuid": "4be839e7-acbc-4f3d-8e41-d47b88126bb9", "comment": "Malware payload", "value": "fc7b4e9bad266bfa82119ada852cf67dbe47a946", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592018, "uuid": "4af6ed03-e00c-4b68-8fcd-138337366db9", "comment": "Malware payload", "value": "b9485da34e3bc20fc807fd4e71e60f2b7b531a01d0648e7910b4bcc2c80c780c6ce729df51f7fd19784265624a436085", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592018, "uuid": "02eb81b2-6a1d-41b4-b0b5-e2cb28eb74a9", "value": "T1DC83C58C3AD67079C251B4BB386B720F7A2F5D8061FC8124F9ADD558EB37308B566B24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592018, "uuid": "f17b1d0b-c406-42c9-8a10-ccff5b001b94", "value": "384:NX5Szmv5bowEmcPMKIlcWZEcJ40yR5+bYY0miiD0LDclYAOLP9N:NXYe5b5cPMLlcW6o40yz+bBsb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777592018, "uuid": "bf91e8b8-70d2-47f4-8b1f-30d27fec69d6", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777592018, "uuid": "8d9cc0de-1ec8-4c75-a9f7-e9404883e602", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592018, "uuid": "ae0dd08e-6ab8-4e0d-8008-65664912e73d", "value": "FuHQEKus6LO8E38T6j5aFlNcorqv0DeedvcbTFyO_Yk (1).iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a10809-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535616, "uuid": "4fc472d7-a68f-472a-880b-1617505d742b", "comment": "Malware payload (XWorm)", "value": "c33a2f4ea15aa3f3e337806146f29c62", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535616, "uuid": "bcf9575c-a950-48f4-a524-74f30d8044b0", "comment": "Malware payload (XWorm)", "value": "180372215d134894e5c64d9210e5aab52ab11f7f09eed081fa046cacd9d5f9e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535616, "uuid": "60fcfd03-050a-445c-b1bf-176348d5feb5", "comment": "Malware payload (XWorm)", "value": "f18d1fd8da42d62cb6f3abd8e5108e0301c98abb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535616, "uuid": "ff7eb733-1c20-468d-9d05-4f5f515d0183", "comment": "Malware payload (XWorm)", "value": "d3e6409f4f3532f38238d7e87cb62aa6a70c114c417408b94f5070bc14e9060328dac7a5218235173f4d3b15ab12f19b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535616, "uuid": "79845779-1ed8-4e82-b5a7-c36da0b1d023", "value": "T1163723442B2C4D3F84B6D92052B71F456AFD8E2600A79BA7DDE4485F9F5EF21100F2EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535616, "uuid": "aa6d99e0-4483-4cc6-9796-5ebd7d21a097", "value": "49152:HHvUTnJV56/r9aKklxOvfBAcP/vxMhZ4tCafTFPmDv2PmWRFZH1ZYqRLQR/R1Nvk:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535616, "uuid": "57d6f536-2c7d-4b9a-be9c-1a8b215ef100", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535616, "uuid": "2c9620c0-96ac-4133-abef-ef24f96871e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535616, "uuid": "8ea55e38-4232-42a4-a425-49b44c4d00ad", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbdb589-4491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777552519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777552519, "uuid": "538608e7-ddf8-4385-b683-bb79e8a123e1", "comment": "Malware payload", "value": "e204dc854d42dacdf577aa557c83f75d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777552519, "uuid": "d62e459f-f673-46b0-a0ed-2fd6183a8a43", "comment": "Malware payload", "value": "18094b17de26671cf043ffa8db3beb2c595261d9d2010b2e0732184cc78353e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777552519, "uuid": "d3da9795-f19f-41fb-b52d-93b1291d404b", "comment": "Malware payload", "value": "1fac0d4d141e7a3e3ba42d4b990d85977ecaafd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777552519, "uuid": "e193cc43-e833-4301-a7e7-7be55eb5a42e", "comment": "Malware payload", "value": "74bbe14fae66fa49e4e678371c47c35682513af6427b36bfd53a7bcbaa0ec5f02ca248b06f34dc4cb802cf5596f32f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777552519, "uuid": "7da19425-690a-4f06-b510-26c54b0ed499", "value": "T1E084DF52F7595E67C08DC134184685002AACFEEAB3E2D3017BB782F87C6A9764F6C359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777552519, "uuid": "cc911bce-8f39-48dd-9193-b0942d3a5436", "value": "6144:URQQ0Colzrk1YihvBjS7wb3T5/v2Xu7fnuFdpTyDyJmr6YF:/+wzCYihQwD5Yu78oDyJmuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777552519, "uuid": "a925be9d-a6b6-42a0-9483-d4bf67017b79", "value": 385148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777552519, "uuid": "ac1d8645-f8fc-4a6d-9882-a9fd571458c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777552519, "uuid": "e3871f3e-0932-4afa-beb7-cf189bcdd4c2", "value": "sys_atd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e24a77-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535306, "uuid": "d3d7eac7-c751-4e39-80bd-bd69888714ca", "comment": "Malware payload (XWorm)", "value": "7731853647ffd1cd4171b7fd458f7538", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535306, "uuid": "f7b7ac3a-526e-46f2-aeb1-641e2e928cca", "comment": "Malware payload (XWorm)", "value": "191ce5a2b736c17cc8b88c5140083352076dadc316dc5ccc097a09dbc75ca15e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535306, "uuid": "15805d7a-8a92-47a5-84b7-3bf655790af6", "comment": "Malware payload (XWorm)", "value": "0592eeee9910406d785075ff4a03167ee7417440", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535306, "uuid": "ba24554e-e128-41a6-b002-6cfb10621e7d", "comment": "Malware payload (XWorm)", "value": "8513485c7e2f0dad6429a2b8ccd39d0843710fa785f8c028593decf6a1f72376df700e336a24852817fea0ce8f5585f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535306, "uuid": "488aaa87-7188-431c-85e1-d26a740faf0f", "value": "T1183723EBAF6E0B67C96502B910950C2ED8D08E7682901DEBD8F56C8DB34FF1510295EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535306, "uuid": "e005b793-2390-4cf5-bd01-c26662988c6e", "value": "49152:POnTOnfOnCOnxOnPOnFOn5On6OncOnvOn8OnacIxOn/OnEOnSOnCOntcIqOnOOnk:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535306, "uuid": "f9094c8b-5b13-4931-932f-cff25467a2d4", "value": 22903929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535306, "uuid": "e0528915-a87d-4410-b428-b6eeb7fd5655", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535306, "uuid": "ebf1b976-284c-4836-93cd-63cd11120c73", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe50a72-442c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777509280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777509280, "uuid": "203cf7a1-04d2-47a8-8fd8-fd3a8f06f794", "comment": "Malware payload", "value": "24b527bb282830db8a50ede627b84df9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777509280, "uuid": "9fb65f8f-16f9-4c15-b39f-1fcc6cf977ce", "comment": "Malware payload", "value": "196af0ea6826f60dc12606b9cc45ebad0cdf6d7f70f96dcbe52cfbeb6dc4639d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777509280, "uuid": "0c005d97-fdc1-4818-89bb-c0f2cdea7513", "comment": "Malware payload", "value": "f90637677c3211af9ad6e4028d0c335927ad44f6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777509280, "uuid": "6d361fae-9653-4b1a-96a0-b04774fc2881", "comment": "Malware payload", "value": "7b7706c124b0c9a14eb354c9a9c962ab7c8daf1469282c5f56d612943dc08b0482aabd3f10ba5e088ef9302495a93ca6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777509280, "uuid": "0ebfb333-7bb7-4c51-877d-d0d2b1ec9cb3", "value": "T1D413C331A3A45D2B38AA654C622C4418FF8B0E9FF1014FB6CDB205BD6EAF5C88BDD540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777509280, "uuid": "db34bd5c-16bb-4e7d-9a98-b583f76b1dc5", "value": "768:DWgZP+W/AX6ti4sDd+WWCbd1XMDtURFowGK/0/:XkW/S6t65V51WtURF7/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777509280, "uuid": "14e71eb1-1391-45d3-9a15-98af9a82d573", "value": 43346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777509280, "uuid": "ed02e147-d720-4282-9995-8c8bf399a9d5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777509280, "uuid": "280edc33-9c2a-46df-9881-6cd96ead5e67", "value": "voicemessage_open_to_extract_and_listen.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5a4ada-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535448, "uuid": "a1be7f9f-a8df-4857-99d2-d8b72b11b614", "comment": "Malware payload (XWorm)", "value": "989249ee01e459c0e600d8221cda88d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535448, "uuid": "3b81e199-5747-4c60-a78c-0228be123cd0", "comment": "Malware payload (XWorm)", "value": "1980425981def693abf54a9e71f2acddb0ae75abf7d7c359a86a0bd6355401a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535448, "uuid": "9335ae4a-50fa-45bd-a4e4-7f45babfac8e", "comment": "Malware payload (XWorm)", "value": "4150dd5b8be5d04ad9f73df7241b82a0c9cbe907", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535448, "uuid": "6db10968-e1e6-4631-af3e-e2285a091799", "comment": "Malware payload (XWorm)", "value": "1aa38788fffac46f15e02e1736f431b4777cdb7f8394f96f98102b0bb86f5ec8100795e3155176736034615b3bbcd349", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535448, "uuid": "db23c603-f2ad-47f7-8cac-a6f3ad1d9ae6", "value": "T1D53723459669DEFE0B283104B4ED1F3EAE29460E5B14D0FE83FB206FE9ADD54321642D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535448, "uuid": "b9928a7c-634c-4681-90fe-719381d74368", "value": "49152:ykLJJkLJNkLJwkLJAkLJLkLJ5kLJJkLJBkLJKkLJ/kLJ/kLJ4tkLJJkLJ3kLJ2ks:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535448, "uuid": "7aa4218c-c303-45d3-bf0e-4e7329e7bb5e", "value": 23944456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535448, "uuid": "2c556737-2d66-459d-b75c-4ca4a8f0509a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535448, "uuid": "70471245-05b7-4aab-b1e7-6c157b84cfe0", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22266406-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538382, "uuid": "b1d4fc81-4743-4246-a508-75e731b54fc6", "comment": "Malware payload (XWorm)", "value": "b75acb6d4f1aee22942d2484a92b62f0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538382, "uuid": "fa8f815f-df55-44a1-90d7-7ed5e66779c5", "comment": "Malware payload (XWorm)", "value": "1a704237bb8aac82ea5d541dc103028437e4be4d870b24285fb0744aa699cf86", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538382, "uuid": "96118ff6-b949-43f1-a6dc-5f9f6c773843", "comment": "Malware payload (XWorm)", "value": "bc3c23a73116933c326b22185ef0713e804819a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538382, "uuid": "4dc66fa2-d4ea-4be2-9912-65decf015c65", "comment": "Malware payload (XWorm)", "value": "9a15ea3b584e84d7d98c4d7b5f33dd1dff84db0d751fb9e584dcca016239dc9f8793e2db145af4cae914528955e3246d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538382, "uuid": "fd79371e-64c9-4060-a839-7c0c9bb6d409", "value": "T1783723388D9D58B88AFD537C543E5E0A66742E44E8607C3BA9C79DC683FFE09135E01A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538382, "uuid": "c7860f44-8e7c-4fa6-a25e-2ceeb51eb307", "value": "49152:Y2ryB0L62ryB0LL2ryB0L32ryB0L42ryB0LA2ryB0Lq2ryB0L92ryB0LP2ryB0L2:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538382, "uuid": "bf0d5856-ee6d-4890-80db-5bb849cb0b05", "value": 23164065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538382, "uuid": "d992f681-3a32-47e2-a877-13b839856394", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538382, "uuid": "0b6f8922-3470-43d4-a3a9-4fee8ac5f1c7", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef1ce28-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535639, "uuid": "9311e23b-89cb-44a0-abe1-f2206d9c4c1e", "comment": "Malware payload (XWorm)", "value": "dd17ca1a3d2e253d21055c26ff10b9d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535639, "uuid": "309434f6-d056-42ab-8f0e-43c604616eb4", "comment": "Malware payload (XWorm)", "value": "1a81b6e47785ab9c640e6149d0e8481fa4ff7fdab205b757da2f9987721b839f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535639, "uuid": "5cb65f3b-1e98-498c-baaf-c93fca955656", "comment": "Malware payload (XWorm)", "value": "18699e52813c7eb4062cbae9aea06ff7b426afbb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535639, "uuid": "d09a375d-74ff-46dc-958a-279e33fb13a8", "comment": "Malware payload (XWorm)", "value": "8c4c1082dc3fede1fc48bb5dc721e5b61dd058843c21bf946e52f2bd2dc4335bac5b2f938bcb1528e9dc65f6f4729d19", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535639, "uuid": "ea98d8f1-5dbf-4292-8492-4c8ded35db29", "value": "T1CF3723074711BE5F1D0CB5DC25BE1DAF2BDA1A0A2082F5E6B34E3806A75DBB5210E17B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535639, "uuid": "2f67bd09-93cc-41b6-a510-84d3d753c0e1", "value": "49152:bhhhfhnhohqh4hqh7hNh0h9hyBwYYHShhhZhMhYhWBwYYHVhhhKhHhAhwhBhLhDP:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535639, "uuid": "46f1763f-86f0-445a-a659-3c12d2b84b3e", "value": 22643812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535639, "uuid": "5a783e4f-4f96-46cf-a400-80a5ef1c819b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535639, "uuid": "1184710e-eaa1-4a1c-90c3-c41e94c6e1d1", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541b500a-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565095, "uuid": "52898170-cc98-4129-b180-a8d61db5eef2", "comment": "Malware payload (Mirai)", "value": "41eaa4167dba4f32b222a896e8b9a82f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565095, "uuid": "64b79ed4-e12d-4e3d-9758-76edf03d474f", "comment": "Malware payload (Mirai)", "value": "1b0ab8eb49a11bbf81d0f6a2242a789716a07bedc0a5e8abf16f436be1e941a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565095, "uuid": "a5d08fba-099c-46db-a44c-869f8c2b0021", "comment": "Malware payload (Mirai)", "value": "1e9559c785ee1a55556e3b7035d83264e12ae329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565095, "uuid": "f66c70e1-c297-4590-8d62-9bb4681366a7", "comment": "Malware payload (Mirai)", "value": "1bd1a947fd79f3c687c045d1d58761aa2281ec49c209ee357be9309e89ea66af58e2899f0407eaf337d1bf306d1610a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565095, "uuid": "a07b2583-0d82-493b-9de7-1a4ed298d0a6", "value": "T1BDF47D59FE4E3C41E3CBE3789B4E87E1E22FB190D32351623981534D94C6AE9CBB0656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565095, "uuid": "36ca4ce2-34e1-451a-855c-d76a30997a9b", "value": "12288:XA8gXcv9wvK7ktrJHbyMYF6auLV5X4Wqv4Lw5lmtKi:wjXrK7UHZy6f5XNRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565095, "uuid": "1f9ac32f-d535-4fe7-ad84-6238b75506dd", "value": 729328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565095, "uuid": "64205f54-7a42-448d-a75f-46727af7bf4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565095, "uuid": "4111fc41-2669-401f-a61a-b434e8d22554", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc19be9-44af-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777565544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565544, "uuid": "78e3eb67-c9bb-424d-84b6-3f2747069619", "comment": "Malware payload (AgentTesla)", "value": "040d73b66b2daef1ab6d3582dcef551b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565544, "uuid": "05cb9d19-ed10-4f98-b132-d778ce443be3", "comment": "Malware payload (AgentTesla)", "value": "1bcef2581d32b1f631a27a54de845474df714af8ed35729333bc0e0ebd02607d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565544, "uuid": "0034b8fb-56b0-44d4-8ea9-f0efbc2629d0", "comment": "Malware payload (AgentTesla)", "value": "ce60a8cf096cf96983d0e14003ff0249d7c8ab5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565544, "uuid": "467e2dfb-5ed2-443a-8a35-63a78c1c8603", "comment": "Malware payload (AgentTesla)", "value": "82bef11129a8ba9428b524838d05deed891f0da00ba1e7922f02bdc80fa73f0ae069e2aa3f81236972e04e43155ebfab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565544, "uuid": "cd5f1ce5-2657-4ed6-a54e-79d77442e162", "value": "T1CB15DFB18F631F20C73C0778C82BA08D67F49927E356DA8F6EF841E45A52764E6136D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565544, "uuid": "7546776f-66f1-45c1-a82d-88240cfe1412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565544, "uuid": "963b1839-3dca-4158-bc96-3e18b479476b", "value": "24576:aqFWfwppQ4uZoQGE+JiCkHEQCvoGFfY/:AIppQ/ZZYkHOvvFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565544, "uuid": "082cbbe2-05a4-4ded-96d1-8e025a4d803a", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565544, "uuid": "b9ff5d95-a3e2-4ce0-8311-71cd2ac24458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565544, "uuid": "6e8067e5-0581-4ea0-9dc2-12bf704a1f27", "value": "transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ee8aaf-4486-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777548076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548076, "uuid": "7c2fbc93-39e9-4141-97dd-3b2560de7a97", "comment": "Malware payload", "value": "db8a962c0316974fab59aeebb2d3b44b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548076, "uuid": "611a2e96-b2d7-4ef2-b398-24c0ab43f602", "comment": "Malware payload", "value": "1c1fa255a5a223db0d421816f0423c348d79aa45cb110bc4df6d7a3455532912", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548076, "uuid": "dc6f7b18-119e-4479-bee6-77edf27e1ef2", "comment": "Malware payload", "value": "6183687865545c21a2f25275cd8038e8262df968", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548076, "uuid": "a703aa80-e6bc-4e74-8aac-efdeacd5b318", "comment": "Malware payload", "value": "6fb78d0e419ceac9a972f55a6e1ce4b6638f655103282d2d50c05ccf75662257c9471c54bc6d3a31b18e147a74b1e843", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548076, "uuid": "6e5a2b7b-1136-460e-a824-1e40e00fe524", "value": "T14784F238AAFA0019B1B3DF54AEF47456E86FBB633B0E985D1091034E0632D45EDA573E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548076, "uuid": "208c563a-b6b4-462a-b3f4-6ebec281c569", "value": "12288:ZhMHhlA31NqrFL8Q3vItGWI94oR9QTlhnShqBUq6j:Zh2BuXiRmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777548076, "uuid": "667e2bbe-9939-4057-a080-77afe7b240c2", "value": 406886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777548076, "uuid": "8a980d69-93f5-470b-8e34-95bed6499d9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548076, "uuid": "fb3995e5-acd0-4c8e-a946-7dcdbf45d893", "value": "Sales Order - Order Confrimation VR 14063130878526 - 0061-26-EXOL-Q_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b59afe-448c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1777550676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550676, "uuid": "e8bd43a6-438c-4f1a-a258-63a1840acdb6", "comment": "Malware payload (DarkTortilla)", "value": "88d4adc28f056e3e14a82f6bb16df900", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550676, "uuid": "c40b001a-5783-449d-97e9-f38fdc0e8ee8", "comment": "Malware payload (DarkTortilla)", "value": "1caa5d30a5b6e2856313997012425e3c55490a5f8ba200d5ae5f080939a7d02c", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550676, "uuid": "df666fe4-07b2-420f-9daa-a39f513e4732", "comment": "Malware payload (DarkTortilla)", "value": "6baa2d8602ef42e3a5606e0117509178b03f30b6", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550676, "uuid": "759fe2bd-7ac6-4a71-883d-fff28a62f904", "comment": "Malware payload (DarkTortilla)", "value": "5922b2504815b6cb706a220faa3092b68545676ac4a5028dc9a0e80412076e085e4e7d9a37fd65281bc531f6fcb8a9f1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550676, "uuid": "fea39765-c9af-4f1a-9be8-f8c05ea797fd", "value": "T158E4D0229AC62F10C73827BDC476104073F4CE465316EABF7EE903E6E952B96FA57181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550676, "uuid": "a781e905-dbfc-455c-a319-59b3f00b617c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550676, "uuid": "1c86bd42-7d0a-4b52-95bf-c1fdee7025c1", "value": "12288:dNU/9kPEArJil/rhQYrXLZZoZ4r5QdE+hPiPK4JzuVFYr:dnY5XLZZoQGE+JiCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550676, "uuid": "56a5cfd4-8247-437e-b6f3-93504d840af3", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550676, "uuid": "8a1814a6-8789-45f4-9fff-c956a037a884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550676, "uuid": "0b42faa9-59d0-405d-a3b8-d3fe1cfadc30", "value": "ORDEN DE COMPRA Grupo ESPERANZA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7704bb3b-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538524, "uuid": "3a8357f6-0dc5-45c1-9779-d4731b3f8a88", "comment": "Malware payload (XWorm)", "value": "c87244cbe4cf72f29ab72d65d68833a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538524, "uuid": "91770ea1-16af-4ef9-b11f-d05324e4f663", "comment": "Malware payload (XWorm)", "value": "1cb4b26436d076a46f5bc36c0a7fdadb49e9604e1c5ac934e885cf3c9acb90fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538524, "uuid": "c934d49f-0ba6-4584-bf5e-b388acaccfda", "comment": "Malware payload (XWorm)", "value": "c2e3fd3f19d5710fc695eaceda85dae29626b9d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538524, "uuid": "fe426891-9317-4246-8fd0-5a3bfa98f18d", "comment": "Malware payload (XWorm)", "value": "a390ac0a10c89d4eebfd3545dbea032cd9e4a798f56178ebb1cc2474e1732edb778f356fa359c51066a88ef08d4b4104", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538524, "uuid": "cc3810b0-e46c-4876-933d-56e7714b7285", "value": "T1F7372311591D983F829C41AE582F1D5AAFC2CF8983D52D988397ADCB670F71F027289F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538524, "uuid": "e792eb36-bd79-4879-996d-f8300a057c1b", "value": "49152:uH1HrH5HgH8HGHFHLHrHfHNH+7lKTHtHLHAHcHh7lKMHMHtHPH9HTH/HhHeHRHp8:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538524, "uuid": "f1c5fd86-7b0b-4e00-89c8-cde4418005b4", "value": 23684348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538524, "uuid": "6e212d4f-0790-4e72-9731-274fdeb08d42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538524, "uuid": "9a3184e1-3ba7-409d-ae2e-262c1ec8f462", "value": "invoice-1645080830.pdf (54).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0204ea51-4447-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777520719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520719, "uuid": "6ae0209a-523b-4b15-a45e-219f6ba1ac28", "comment": "Malware payload (njrat)", "value": "e83ff8231c01d3d2074ca287258113d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520719, "uuid": "fd743988-00c5-4298-b2c5-15280c17dea7", "comment": "Malware payload (njrat)", "value": "1d69b7888780e37de9662fdd16942fcf37ece14e64274bfad2a28abae532360b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520719, "uuid": "42dfeec7-c7b8-4a7a-b440-92436b2aa52d", "comment": "Malware payload (njrat)", "value": "079f47079c96d482d6b89fa90757c91535654a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520719, "uuid": "3e70f4f0-a0a9-4089-b302-0ed33373b3e0", "comment": "Malware payload (njrat)", "value": "5ce6aa5f8455492dbc0b7fcb165a9b47078b532585d05e635f5f242e17c620e6e9bf792464ba5e23380f50d11f242dae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520719, "uuid": "c15ea58b-6423-4698-bfe6-2eeb2cb07c0c", "value": "T125E2194CB6E38154D07D84B785A6E3211774E1675723E26FCEE968E22F671CC8A8CDE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520719, "uuid": "8d73fe3c-64b1-478e-bacd-fe740f2527a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520719, "uuid": "c39bcbd6-6499-48cd-be42-e79634a7edd6", "value": "384:tU005Q4kW8+I4YZsi+t22CA4GZstFPI8eT+C4lDUodg9TdFpyFEIGsJjwE7UMcrZ:a3Lzt2AzchaouDbEEIGfRX5+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777520719, "uuid": "b45a1ed7-19e0-4ff8-98dc-f1414ff19d0a", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777520719, "uuid": "93a3f5cf-4d45-4d00-b83a-c67f3e360a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520719, "uuid": "08a42561-44fe-4226-a9ef-9ec1aa23c644", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ac62c3-44aa-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777563425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777563425, "uuid": "db822f7e-1db9-4b66-921c-28f53152dfee", "comment": "Malware payload (QuasarRAT)", "value": "69c45677ca158e6eccbafcfa02197e50", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777563425, "uuid": "b47ea1f6-c044-48a5-a8e6-cdc7e60aa668", "comment": "Malware payload (QuasarRAT)", "value": "1e49e5f2d02d715b5e77edc22c6e738306d27b0151e7a8c33ad6ad192617b975", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777563425, "uuid": "53a2ecd2-6cf0-4195-891b-7840e1f6dfec", "comment": "Malware payload (QuasarRAT)", "value": "698666dc37205d2b50d7108e50011ecec44446af", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777563425, "uuid": "60c763ec-85c4-4977-9493-2d4439a76f8c", "comment": "Malware payload (QuasarRAT)", "value": "fccb5ec36e110be19c1fb54d300f9779666dceb02ba4d349fb97db60df37357eb51ce0cad552b1724b214cd0a0226943", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777563425, "uuid": "0f4a2e3f-fcaf-4a94-995a-2d2bf87f2beb", "value": "T1A9A528217B5A99ECC59AC074834646B25A3270CB0F35A9FF4488967C3E7AAF51F3C358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777563425, "uuid": "09847659-5766-49b4-b287-9ea02299da22", "value": "12b60beb06d0fb5c4b02ffdad04bfa1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777563425, "uuid": "fef1f382-784b-40a1-b045-e79a17b78211", "value": "24576:cAPotCNrD86VFaumRRJLZ3SJa+n32UG/CZKJw3posKi:Ts40umRRJLfQ32UG/COk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777563425, "uuid": "b92f77d6-9324-4f21-838d-c44ac4a6786d", "value": 2078872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777563425, "uuid": "d11a0afc-3eb1-4012-af45-e941595d66b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777563425, "uuid": "9c4c873a-118c-4ca9-9d4c-103cec9c0543", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f483b8d-44bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777571099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571099, "uuid": "0821de43-85be-4f24-98aa-461c7415639a", "comment": "Malware payload (Mirai)", "value": "357135ac31b5555a0e52c06063cf85d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571099, "uuid": "9150fa0e-56ad-44ad-a4f4-10d20c1ce33d", "comment": "Malware payload (Mirai)", "value": "2209327e4acdda59ac3c027d040134d947ec2b4aa525e90a6ecdad0e047b2599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571099, "uuid": "b81beacf-498d-41ee-8734-9b29278de80c", "comment": "Malware payload (Mirai)", "value": "d11aa64e7dea02cd9f387c4a0c1684810abcafd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571099, "uuid": "42790b96-50f9-4415-9cc3-6e7dedb8798a", "comment": "Malware payload (Mirai)", "value": "cc1c412929a63a7cce29fd235941fef386f8acd65d4748e47a231b16292929627515965534f66756faeea213d2ecc60f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571099, "uuid": "ef257ed4-0d41-4744-a07f-d3af7dd3ba14", "value": "T104636C13A58090FDC4D6C1B45B7FB222EA33B57A5138B35A2BC4EE162F1DE10AE5DB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571099, "uuid": "d6ec9e20-9935-4b30-b6cb-51c74ade3234", "value": "1536:LjKcGN8JRMlEtuIZRU4sCgTLNpSFX53csxu:LqSJKE841shTaFXJ9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777571099, "uuid": "f46c346d-bc98-47d7-98ce-3b2bfc2ba7bf", "value": 71208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777571099, "uuid": "c7da7102-a4c7-4bea-8e32-bde491e4c231", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571099, "uuid": "c4e4d530-2ad5-4478-b6f9-71485eab8c2b", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc90f766-4479-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777542614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777542614, "uuid": "06ff3b74-bc16-4e96-91f5-e6fe849779ba", "comment": "Malware payload (DCRat)", "value": "208477a99dd021397a883960d0115c6d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777542614, "uuid": "7898ca64-d307-4924-bfc1-955f5217f6a7", "comment": "Malware payload (DCRat)", "value": "223733ec708531603b51bf10fc3126cb4dfd47f4aaada4a75acd168eb06b9d50", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777542614, "uuid": "be1e7435-7379-49f3-bac9-368f1e807beb", "comment": "Malware payload (DCRat)", "value": "7695a822cf67d5e8ea1a6a87e7a06dcef0548ee5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777542614, "uuid": "56a88852-9a0f-4f81-a33a-c9ace9f83a70", "comment": "Malware payload (DCRat)", "value": "2742c4f43261a72059bded20a4ebf97793a80c7598248cb64eec41287318791281456e9918c854dc6cb41d5b8488cd7b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777542614, "uuid": "2865d209-56af-473e-accf-9b7e9f7132d9", "value": "T12D454A017E84CA12F0192633C2FF490847B8AC516BA6E71B7EBA376D55123937D1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777542614, "uuid": "20d679b5-5a07-41b4-bca8-8a9719498563", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777542614, "uuid": "97142b06-3f45-4610-904a-273cca472f8f", "value": "24576:U2G/nvxW3Ww0twMQNrHBXYjVzxYxEbtyXAjo7dcCHBPR2mpfmN:UbA30PQQV2XAUrR3fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777542614, "uuid": "fc87fa60-32ed-467e-a834-6bac9232203a", "value": 1164932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777542614, "uuid": "e5d876e6-3ce9-4493-9671-bec379ab502a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777542614, "uuid": "662dfd45-aec0-4119-b5e2-b81b9e6dd627", "value": "Hardserialnumber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52caf39-44a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777561473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561473, "uuid": "c410a8f5-1691-47b3-ae21-5fcc66f33405", "comment": "Malware payload", "value": "6d34b699d884e465d420f3ec0aa58d81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561473, "uuid": "129c5af1-1bac-4905-8833-968fc54a9a6f", "comment": "Malware payload", "value": "22bcecf8480117104317b499713f889a56bde9fc0630271ea88c96ec088f6e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561473, "uuid": "0d1b8405-dc3f-4a75-a4c6-de7f00eea322", "comment": "Malware payload", "value": "29b9df38540235c59a6a3c766e2d12ac15795792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561473, "uuid": "e3b9874b-d2f5-41ca-aecc-7cc4519cf3e4", "comment": "Malware payload", "value": "094ce1f32fd2d8a4fc993825537a2496315b13d553432c4831aa647d6ec5ad78732665e028b4b0f1bc9570d72ae79142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561473, "uuid": "931fccf2-1b30-4b0f-8465-71bc1fcdb5a3", "value": "T15C159D5AA7B404A9D167C13CC6534217F7F2B4552360ABDF03B48AAA7F23BE2563E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561473, "uuid": "3d09f6d2-6e0c-4598-9deb-b5d3ec6867f5", "value": "886a4d80a85093dd715d3b22fc5c7b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561473, "uuid": "cadc80c1-1deb-419a-ab35-4dd00277386c", "value": "24576:6ENebAyZAiuoVUvETfG0bPy++ST1iR/p3:6KebAGAiu0UyrBTQx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777561473, "uuid": "3c5bc303-30fe-4943-88a6-f7815020aaa5", "value": 917454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777561473, "uuid": "6fea435b-04f3-4040-a3b8-3b606d3fcf77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561473, "uuid": "536a8080-82b5-4e90-ae7f-6e63b9eea088", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a72a20-446e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777537881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537881, "uuid": "0eaea600-4779-4aa4-8234-06553d4c7da3", "comment": "Malware payload (AgentTesla)", "value": "7e20cfdfe5cddb47f0c57a1f6b4f3248", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537881, "uuid": "a85b8162-d9d9-4dec-9d6a-3324c4e0431c", "comment": "Malware payload (AgentTesla)", "value": "2446f05639a644c181e731289ddfdf6e536bca7a6254cc04fee2d82875b267a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537881, "uuid": "9963ebd5-4945-4d7e-acab-51c19e15f6ce", "comment": "Malware payload (AgentTesla)", "value": "ca983e4f99b29b2706d0a255148ea04831a05454", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537881, "uuid": "8b18405e-5faf-4eac-ae86-07d5a24eb8c3", "comment": "Malware payload (AgentTesla)", "value": "f426fd092902aef4761a3d01ee9f985ee82f9182e68e6d3a944b9e3ef02197650867d2fcd80d3d683e12613c3ed1a5ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537881, "uuid": "215ca34e-4f8b-412a-ba40-1da2dd88295e", "value": "T18BC42316FA409233DE6453B23D7B5C3BA84B6E5451198D5BA38C2A3FF4F6A859D2F300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537881, "uuid": "e15b7ab7-3e8d-4ee4-a1dd-5130af43291a", "value": "12288:6bwPZLlVOgCh6wozmj5qQoDdph7udQ0cQJ6SRJ1I4X/En:6bwPZp08wozcEDdzUQ0cWRJ1Ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777537881, "uuid": "ce2e588d-6019-4a03-a9da-b6a00fae5ec0", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777537881, "uuid": "68890938-9efa-40d1-bca6-eb9df2d46ec1", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537881, "uuid": "44c01ecf-e0da-4f6a-ae1e-430a29f31f6c", "value": "ca983e4f99b29b2706d0a255148ea04831a05454.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053b9320-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514282, "uuid": "e9d3f822-c95e-4cb6-a54e-5e78889d3587", "comment": "Malware payload (Mirai)", "value": "e7bbaddfb60d89d5e91436fc329086c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514282, "uuid": "b6dff351-3909-4f6a-8430-180b31a9481c", "comment": "Malware payload (Mirai)", "value": "24f2b872f69ee7b9b6b772842a2e18c1ed00adb4658bb6e814e0858879b58024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514282, "uuid": "4d8ee64f-592d-4ca2-bd00-4406cd36e3be", "comment": "Malware payload (Mirai)", "value": "ca5adb7c269e70c0889ca6369bcbdcd366167d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514282, "uuid": "4921a1a9-a38c-4c5b-872f-e1f96784643b", "comment": "Malware payload (Mirai)", "value": "b57b403b977a0971667d65e9f997445f22bce7b5480759f92c350c5b9f186d5a835c30cb29ba76d30772f7b3237c3714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514282, "uuid": "7f5745a5-d1f4-4db3-afa6-798db04e5ab7", "value": "T1E0043902E603CAB2C41301B112F7CB755E71F9B3AE25C452D3BCFEA1AD656D1A5093AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514282, "uuid": "88b3ea4c-2cbe-4000-8566-1750e6281da1", "value": "3072:/2qdSTlRycPFBex9HvqvxHJT5K0C2sMtUmRlp9M:+qdMsjqvxptDyMKS9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514282, "uuid": "7160486f-f9da-4ceb-a5da-656027840fb5", "value": 184464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514282, "uuid": "61f672aa-e661-4fc1-a4ae-a3444021b13f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514282, "uuid": "7f1cd42d-76f2-4841-86db-dd025516234c", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6f1694-4443-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777519050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777519050, "uuid": "0a31902a-d8fc-4bed-9c55-47c2b2d2f246", "comment": "Malware payload (MassLogger)", "value": "5b864090a0a190362efe3c77717a1e10", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777519050, "uuid": "88ab9817-d25c-4470-8a8f-2e52e36747da", "comment": "Malware payload (MassLogger)", "value": "25dff711ac42a914c0bd5c7ecf2861e7ccdf8115a9b4305e6d4592781e603807", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777519050, "uuid": "2513acfb-84e0-4075-b301-d0cd3e07c048", "comment": "Malware payload (MassLogger)", "value": "de470ef41000729049ebff7380ccef18707e7e49", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777519050, "uuid": "b05816af-9f28-4376-987a-4ddd34a90b92", "comment": "Malware payload (MassLogger)", "value": "9f62e650faec6aeea0dd8a6f1bd5598913478cd8d983bfa3fb14ad62d693a0b35b41a959f0239bff191f1f361517e79d", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777519050, "uuid": "c14e3cf4-28b3-4625-8af0-5f03609f4aa3", "value": "T1404533905B703C6763DDE29874BF6B5E81E37B1B8944F4D6A1F147B60A4A380835B82F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777519050, "uuid": "39d8090d-b572-45bd-9eb4-8ee7c230fe43", "value": "24576:VSWyr1El2bhUoUsCAFnXFA/S1usZD9uoxE0YObfj:Mg2bI7AFVn1ZE5OX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777519050, "uuid": "a408f46b-905b-4c95-882c-a62b5c4b75fa", "value": 1226331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777519050, "uuid": "f40485d9-f15f-46a5-b5e3-58338dda1ed1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777519050, "uuid": "1aa10b9a-c47d-4a19-93d9-966870750471", "value": "0RJ80CP6.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43749d25-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514816, "uuid": "bac6911c-ace5-4854-8ee9-bc568f0a03ab", "comment": "Malware payload (Mirai)", "value": "a48da6cdfd1e09e9a013226615555767", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514816, "uuid": "28ff70dd-1135-4891-abf1-d5ed76832c87", "comment": "Malware payload (Mirai)", "value": "25f2cfc80db98a64ad69e6c094c3974c04c8a15a7a0351487d399baef1fb9ae4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514816, "uuid": "12595cb0-25ed-4e41-9216-826f98123264", "comment": "Malware payload (Mirai)", "value": "eacdf00684a456211ebe050ff9df0f59c37ae3cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514816, "uuid": "cff581ce-350e-4fad-ba4a-a044a556e9bd", "comment": "Malware payload (Mirai)", "value": "e4ebec69e54d5942eba29c28d26482e39dab254bcb84d6e65d3c76851b1880b49d9a4cff420e8a584460eab70c36b104", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514816, "uuid": "83e1e001-8429-4d83-9f45-c7a34c80821f", "value": "T180B3D085B210AE55C02272FCB0870A90D3B16D7B4B9A150B44B3F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514816, "uuid": "569f7f86-4d24-4f61-a302-fc8961ef6873", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwux:aevXCLr59hmNwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514816, "uuid": "061af5b1-1ee1-4b66-92c5-ae14791d2650", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514816, "uuid": "11b4f30a-9e17-4e89-a9a7-2c731863b0ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514816, "uuid": "b9e4cf04-7d0f-4044-b15c-9c907b323ec4", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa45d69c-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777537027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537027, "uuid": "59cf83a0-507c-4a06-934e-3174eff3012a", "comment": "Malware payload (XWorm)", "value": "bee31ce9a935b11fde2983413efd2d70", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537027, "uuid": "1cbd29a7-cd85-4985-8538-0259c3619ce6", "comment": "Malware payload (XWorm)", "value": "26654d5f619e06286e84c1b19a09e00a1d7b673aa6c34d88dc1edc8fc3b6528c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537027, "uuid": "e2ade84a-eac6-4e33-aaaa-62cf7dca882e", "comment": "Malware payload (XWorm)", "value": "7003633dde219fc6dcf1d401a7c7a642fa5f3d01", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537027, "uuid": "cfef5c3c-fcea-4fb7-9d15-a88564473234", "comment": "Malware payload (XWorm)", "value": "d797f455dab47c825f7c82ad88db8d543647300aad377771ed4d3496ac7ee4fc4a3b191b8290ab948cee2d9c5ddfd8c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537027, "uuid": "eb2a14ec-85d1-4765-ae8d-ee566bc365c4", "value": "T1CD37230FC8392BFA45AC11B8946E234B67C0DF1112439A9D5B9F3C2548BBA5E1C68DDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537027, "uuid": "98b505ec-fb29-4626-8bd3-f67dc273321f", "value": "49152:fIfI2IwIvIfIZI9IVIOIfIHIx8QIOIzIVIxIb8hIAIoIsINIMITIsI2I/IOIoIpk:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777537027, "uuid": "ccda9e68-5619-48b6-b9fe-909ee01b0bfa", "value": 23944464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777537027, "uuid": "02fd86d8-7d12-4591-aae7-83c282a08b2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537027, "uuid": "0cfebd5d-cd59-4139-aa57-50868235fba1", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213c4a72-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535374, "uuid": "27c4cd86-f4d9-44ec-b5b3-655a7c1ca55f", "comment": "Malware payload (XWorm)", "value": "8591191ec7cce9df42c680fdee5a4162", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535374, "uuid": "cab0bbb6-7b68-4f81-9659-10fce5c585bc", "comment": "Malware payload (XWorm)", "value": "26e34c3106b930bd8fd532d0ece30dea4afea71bde0fe24b2dd6d7ab48cfaeac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535374, "uuid": "476ea352-7162-4d3e-9ab6-55bc00b06e0b", "comment": "Malware payload (XWorm)", "value": "2a8b3e3a32a562611f403a8edc577fa15e8fc0a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535374, "uuid": "aac058c4-67b8-4558-87ed-61b5e8c1ef51", "comment": "Malware payload (XWorm)", "value": "beadde2b2fd7851077694bce80c2c8d185b79bde1f3827ba7cda9078a69e5a61cb245b62791e90fbfd19a7ee5b77facb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535374, "uuid": "2f4fc6d7-db11-479b-bbed-8f76fe302928", "value": "T17A3722010DF7AC9C6AE6E52015391FCEA89C4EC004679BA593D45CAEEA0EF0435F76DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535374, "uuid": "5b8ba2d3-db25-4c83-8fcd-7ba4433c6d47", "value": "49152:pEbjld4EbjldSEbjldJEbjld2Ebjld4Ebjld+EbjldIEbjldfEbjldfEbjldKEbv:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535374, "uuid": "7f5af261-b8a5-4e82-bcef-8241d75adff2", "value": 23684336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535374, "uuid": "6c137501-cbb4-46df-914e-1e0ec361832b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535374, "uuid": "2d67c182-db9d-472c-93cf-f680f1e2b202", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99085a88-4445-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777520113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520113, "uuid": "121bfe2c-8fa5-4652-bcdd-84ce6b5ea372", "comment": "Malware payload (NanoCore)", "value": "54e0cd4189e7dc5dbcb964f5321e4b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520113, "uuid": "da50d072-a93b-4838-8f30-96106f57a934", "comment": "Malware payload (NanoCore)", "value": "26f11161bf574a5d3e3fd97699f73de6464ca2fef3b91ecee21d9083bf7dece1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520113, "uuid": "1565f7d3-aaf3-42cd-9098-f995a3f66d86", "comment": "Malware payload (NanoCore)", "value": "83b9c323c3a3c6768190033158b77c40a4e88670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520113, "uuid": "dc7525ff-dbd0-44e0-8100-41e00d0bfb49", "comment": "Malware payload (NanoCore)", "value": "132340ec2925b8b79030f021b9ab640ee8018e14045b00e42b4110f4caba21ae66b7a39f38cddd53784cd876bd84d77f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520113, "uuid": "6cb45351-15e8-4e9a-80bb-54477a97902c", "value": "T10914CF6537E8492FE3DE8678701242028379C2E398D3F3EE28D461B69F667E44A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520113, "uuid": "10b5aa5f-c57f-4949-9b81-e96eb363a305", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520113, "uuid": "4b0bdc1b-de1c-46d7-b792-12d6c6e0abe2", "value": "6144:sLV6Bta6dtJmakIM5B6fA+eXcTTacsRy3Cj+c:sLV6BtpmkguA+eXsaDCUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777520113, "uuid": "22a2273f-e06a-4173-9b18-92f8af0702a0", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777520113, "uuid": "87cf972e-742e-48e8-b914-7035816907e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520113, "uuid": "a51da7a8-5d97-417a-9354-020825bac5d6", "value": "xzx.uk.comnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b53e2c8-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777531687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531687, "uuid": "5425e1aa-b30c-413d-b7e7-f8a46b870a64", "comment": "Malware payload (ConnectWise)", "value": "081ccacac7d62ed25aa4fdb74bd3be78", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531687, "uuid": "fe320f7f-365e-43e1-8af7-2a711831c351", "comment": "Malware payload (ConnectWise)", "value": "270517d4c51cd2c9b62635c49b006a2d50e6ad66cd377d74be292c818b4f2b86", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531687, "uuid": "f37a06f8-1ff4-4a1a-bc39-a890621d1f69", "comment": "Malware payload (ConnectWise)", "value": "e52ad79b1de976068a110b4f57c7c821049afe0a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531687, "uuid": "c7e25770-2267-4ccb-a076-77c26316f5b6", "comment": "Malware payload (ConnectWise)", "value": "3f561cf254d4cbc691ff070a9bcb3f518599c6a69cfc55f72521d1ab173d61419d59ab91fa46c6deb43b0318f731ee27", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531687, "uuid": "3236e697-8909-4fec-908b-bc79b7419ae6", "value": "T185647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531687, "uuid": "e3c19027-ff27-4b54-97cd-642017c6937a", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531687, "uuid": "92c8250c-60fa-4922-a1e7-b0bc9ac3781e", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531687, "uuid": "1b43e9c5-5bed-499c-977f-056faa2ad964", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531687, "uuid": "2ef84152-8162-40b1-ae3e-3a2a4a1cfa7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531687, "uuid": "c97fc055-c0b0-4a33-905f-d312d712a979", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417dea78-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514812, "uuid": "8e903913-37e8-4bb8-9952-e811ffa9b4ca", "comment": "Malware payload (Mirai)", "value": "65d805780b11d822a0e44d65b3494a9f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514812, "uuid": "e1c96f11-00bf-4d14-acdc-cc8969004133", "comment": "Malware payload (Mirai)", "value": "28dcbcec7d8a7e3c3a80a93037514c5ba3e26c6cd70af9fc23bad400e6003019", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514812, "uuid": "8fae4161-ce03-480e-bd84-d421ca6414eb", "comment": "Malware payload (Mirai)", "value": "8976e373050bef40c2100502706baa62db029e22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514812, "uuid": "e7535916-5d2c-4c34-b52d-ff5d45e78bfa", "comment": "Malware payload (Mirai)", "value": "60af72888af809f0e662ccfedac617628efedc447afe09d6d40a1018aa6f0c2f143feff4e435c3fa992ce1543b1a04ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514812, "uuid": "fc738517-ae74-47a3-8eff-70854969b5e4", "value": "T111148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514812, "uuid": "d455d68b-046f-4f62-afa5-b1c3649f403d", "value": "3072:BcHZcggFy1tJmajThwnKBDMOzsjJjL1lCR9UKG:BcYFAJ9/hjzsdjyMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514812, "uuid": "e80639f3-8e3c-45b1-89ff-34ee438c91da", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514812, "uuid": "f4349925-ab0b-4ea3-98f1-1f229145a16b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514812, "uuid": "9b9b6fa4-b2d1-4246-b941-17bff7d0c611", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967addbd-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535571, "uuid": "69dd3337-00ab-4b18-ab72-3969c0a2559a", "comment": "Malware payload (XWorm)", "value": "091878e04b61f1e985305a31307d751e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535571, "uuid": "d7811b40-4aa6-4448-91d5-561bffeab5cf", "comment": "Malware payload (XWorm)", "value": "29d40e991433912fb848f71b4799c98d9394c4e0d4e21048bcd44a7763917f45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535571, "uuid": "bfe60e66-d64d-4fb1-9b00-4026d0fb13bc", "comment": "Malware payload (XWorm)", "value": "ad18de17129244be0272bae306d1d387a92d0dfe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535571, "uuid": "67783baa-e26f-4592-80ab-cfa764f5ff8e", "comment": "Malware payload (XWorm)", "value": "68c9cd2106b633676ffd4f34c21fb343e5a354cb7971dfd74ae2fefa9ec513ff5dac7959673b4aee663b0e77bb1c0e06", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535571, "uuid": "9b3f7c9c-20e3-49e9-8f9d-c695a5e5731d", "value": "T12D37236E4E2C1D1F892C26F4A1BE028E73B48D5E8952F1AA57F778BF0149B0940B3D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535571, "uuid": "b8e47911-135b-40e3-8f16-5c169a47280f", "value": "49152:Zm22YCBfm22YCBtm22YCBXm22YCBqm22YCBAm22YCBGm22YCB1m22YCBym22YCBB:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535571, "uuid": "df198304-c22d-4118-b252-c33679dc36f3", "value": 23164075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535571, "uuid": "8bbfe22a-3bd5-4c39-bfc1-6e3437538e1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535571, "uuid": "f5f11c76-27c5-4a39-a87b-1f0c2ba143ff", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98feba9a-44c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777574659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574659, "uuid": "22e5a7ce-ab48-40c7-ab55-d292d6ac6d42", "comment": "Malware payload (Mirai)", "value": "dbc0ad6661dece610ca702b489aeeab8", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574659, "uuid": "962bf755-256f-4c14-bd5d-6c0220c0928e", "comment": "Malware payload (Mirai)", "value": "2a978eb00b9a940e42a62827307967cefc1bd7f4eecc83163eb55cb95ed587fb", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574659, "uuid": "b083c253-dcdd-48ff-8b96-01d5c22b54b8", "comment": "Malware payload (Mirai)", "value": "fc8229ae2ac46ed678b9c47adad35512980aef11", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574659, "uuid": "1bd1ac8d-c25b-4173-a918-0281489fb666", "comment": "Malware payload (Mirai)", "value": "d950066fbc728019cd79a9b39ff7e208ed5940e68d206e3aeb3c8b18d76cd20e2c6236e8588d7011410ace4ed2a619f8", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574659, "uuid": "5778526f-3420-40f3-b04d-ae4e8e8dc00a", "value": "T106735C42B70C0947D2671EF03A3F27E6D3AEE59122F4EA48350EAB4592B1D3255C7EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574659, "uuid": "c6801586-c4dc-4fa5-90d2-94ef68624eb2", "value": "1536:TxmB2HCsOdLlcsVWpdn0uBGd9buF7u5YjW3IMJmtnquakkFryY8e1J2tm:gwHCBlcsVitnW3IJ3akbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574659, "uuid": "095cc5a4-dbb6-4911-9e91-c6a3cab614dd", "value": 79352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574659, "uuid": "66a455df-3e42-4714-85a0-692b2b8f3001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574659, "uuid": "59c0bfbc-d902-4e87-b1bd-35d6a2f22068", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7258e265-448b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777550113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550113, "uuid": "7b1e8f11-b85c-4827-84f0-3dc8d081f8b5", "comment": "Malware payload", "value": "f2dc878b02ad9fcaa6cb4092f2566553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550113, "uuid": "48f946ee-3d46-44d4-b386-896ae7442158", "comment": "Malware payload", "value": "2b78e4be5b2d241381363cc141602dfc945ae485d659fbce0acbe46308ed2669", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550113, "uuid": "5c1eb666-b382-4d96-9fd6-a0aa737faba1", "comment": "Malware payload", "value": "8bac25780d09f2ca4036da566b214ab9169bda49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550113, "uuid": "3d7c2128-5827-4a23-b0f9-e8c6393b1249", "comment": "Malware payload", "value": "50327511086939fe379a315cd9743946a6f024f76608182fbf090c616e4c945f36f298349dace9ad8e9eea36d2d27d73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550113, "uuid": "58b1b94a-6022-473f-a235-c95f7e9625db", "value": "T1CDF4C053F2A1EDCBC0564BBA042AE3308357E5921763F280F63AC3681E63659FE4D765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550113, "uuid": "9c57c87e-16c1-49a2-8976-3147117ac1bc", "value": "12288:ZIm+VX+xxAU/ql7xOhpUcXvOTHyQy+hpVt/xZW8pVjPm4HQQGXNr6GS:ZJ/ql7xHwvGIs/5PyQsNr6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550113, "uuid": "8d10ff72-05fa-49c7-9261-f58304e7e00c", "value": 759328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550113, "uuid": "9cb2f4d7-483c-4adb-ad62-ec71c4bd9e22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550113, "uuid": "5bf1441c-d44f-4db7-9e39-9a3559828cb3", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa070f1-4489-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777549456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549456, "uuid": "85806496-ddd6-4b3d-bb2d-2c23835a85d3", "comment": "Malware payload (Mirai)", "value": "748127fa1c1bce450d7b1b12d13aa92b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549456, "uuid": "011a7d27-586b-40b8-a7db-6beebc55630a", "comment": "Malware payload (Mirai)", "value": "2bf97f5bc19c900729b8828ae3c057c2e8a109e75c3474eca24bc2c671b85834", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549456, "uuid": "05aad7e5-f33f-4a19-a80e-1d654758b734", "comment": "Malware payload (Mirai)", "value": "ed5d2d22d2d5980ebf3000a77d2846fd52356c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549456, "uuid": "9ad3386e-afc7-41e9-a50c-b94bc3f2a91f", "comment": "Malware payload (Mirai)", "value": "b4247531809a25702bf93c4aef62ac3e69840154958c687b27a616da3b42aeecb896c1e36c025d6dacfa0bce1796ebfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549456, "uuid": "8c861c3d-9cba-420d-9cb8-270a92c706be", "value": "T10D73FB52BD428F13C6C321F7FB9E42587716676DD6FB3203EA25BF6023874DA092A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549456, "uuid": "80d55b4a-df23-4dde-9178-d64fba30f917", "value": "1536:bSJ1ck3Xx7I5Zo5POJWdZ6J+ZfQivyg4v7HniCmK:mJ1cknx7eo7/WGqNmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777549456, "uuid": "e5be9ca9-918e-4d99-867c-155d1ccfea5a", "value": 78536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777549456, "uuid": "e6c3dc2f-f88d-4b6a-9e3f-a8ed6c5e197f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549456, "uuid": "22a01aff-2237-4a44-bae1-ec765d654756", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794f4c5b-4482-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777546259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777546259, "uuid": "1c2ff34b-f92f-4567-abde-aa19bf107ce2", "comment": "Malware payload", "value": "a087bcf77d803d3ceca077e05f84a8b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777546259, "uuid": "78f7c8ec-f2d4-4ee4-8f8f-f13604e66130", "comment": "Malware payload", "value": "2cad0061f51e66ccd06b6505f096d6c352a6418d2f0e8389f5c8bdb93db7e575", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777546259, "uuid": "d483e815-30a0-4e4c-ae80-886b95143b0a", "comment": "Malware payload", "value": "9e285213683d2dcdcbe1e32a0a21b292d88421bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777546259, "uuid": "53595283-3674-49a0-b26a-f4b60f9d1e22", "comment": "Malware payload", "value": "36a31ad91cd7c3db3f4e49bb0b8d9a36189b560ac60868a18a2d59971686840f5ad5d101e0abea0b497fa71f98c8124a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777546259, "uuid": "7cf48f32-d402-445b-b7cc-d8377d6cf562", "value": "T17D668E03FCA155A9C1EAA2318A629252BB71BC885B3123D33F50F7782F76BD05E79744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777546259, "uuid": "b02a3f50-823b-4fca-a565-84f53a8187e4", "value": "98304:kaaLR1Ex4I6LeVq9Eom7a3OSVGdOr3nXNjAN6vi6Rj6u0AyQ:Iw6LeVFonGA3267dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777546259, "uuid": "57849672-a577-49f7-8b69-99f65d010bdc", "value": 6734401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777546259, "uuid": "2a4fa829-98ad-4088-844a-0f5a56154ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777546259, "uuid": "9671b12e-8e02-4118-85bb-4dba129093f0", "value": "2cad0061f51e66ccd06b6505f096d6c352a6418d2f0e8389f5c8bdb93db7e575.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0922a12c-4447-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777520731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520731, "uuid": "c4e90f1c-9412-43b4-b1a7-32c49ad93037", "comment": "Malware payload (ValleyRAT)", "value": "5f93c2f5ecb40c200199a55ff7f53df1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520731, "uuid": "e6b45b1a-80f1-4d04-8717-b52f8f470859", "comment": "Malware payload (ValleyRAT)", "value": "2d719453907952864e2ea1d8f294eb8c19a12b5bffbab84ba9eda8b069d72f05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520731, "uuid": "1fa33545-e161-47fd-96b9-f86a2361f26a", "comment": "Malware payload (ValleyRAT)", "value": "7f4ac9c2aef0c8bd1c011443cd2685e7dcc026fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520731, "uuid": "c1422158-5634-4201-9c1e-39e9d1075e1e", "comment": "Malware payload (ValleyRAT)", "value": "8d51f26593ad981230c4a90b9106726e218307f5642887ddf15576f65e35c3e218db29518749bd0e4fe170467aa90699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520731, "uuid": "c2b37c39-72a4-41ae-984c-129b62bdfe28", "value": "T1A2D37D4733A450F9D4A78279C9A25A06E7B374660735A7CF17A086BA2F137D0BD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520731, "uuid": "b884eb91-579b-48b8-9447-80327e39c05f", "value": "fb51ede541a9ad63bf23d302e319d2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520731, "uuid": "2a05f094-87bd-4976-a1da-c6b9d256bfb8", "value": "3072:lO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6ow:lO5n5d56TYZQnB+Dpekyyqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777520731, "uuid": "8d43c61e-29c5-4ade-8fd0-957a1e515170", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777520731, "uuid": "395ef5af-bcf6-4104-976d-0dfb500f6bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520731, "uuid": "5a47f58a-e651-4898-9e05-e8657996a755", "value": "2d719453907952864e2ea1d8f294eb8c19a12b5bffbab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fedf74c-44ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777570161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570161, "uuid": "4f8a825d-64ec-46ba-b2c2-bb5793f65847", "comment": "Malware payload (Mirai)", "value": "622e5afd9beb6990257c06317ab11387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570161, "uuid": "0800bdbc-5b97-4da3-ad5f-fa778c4e0666", "comment": "Malware payload (Mirai)", "value": "2e22a161d51bfbfe42342829e839f5d838cc29318e92f935499c7066c2529040", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570161, "uuid": "69ad79fc-48db-4613-8e4b-164ee0579e19", "comment": "Malware payload (Mirai)", "value": "86e48cb1aed754a0ef29a6659adc9d6d4ba27953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570161, "uuid": "e77d2689-7536-4cb5-8ea0-bfed182df450", "comment": "Malware payload (Mirai)", "value": "dc2a6937eac871c0df6133e1b3325428cf49e6b68302cfab82abe2a534d56f62f3076a9cb375a1e34e9faee6e7e22379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570161, "uuid": "04fea3ea-27cf-4c48-abac-da8b92d0ff47", "value": "T1E613E206D603A996FF904B37DD84D283EB87A77DC52BA1E68A11D520774491312FFB0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570161, "uuid": "7c1910ee-7be3-465f-be79-6ea3a72f8d01", "value": "768:6/Hb2ZaDNaP/ajkPWEOOD1GZN9wQNR4nLYCevqtABGjPxS9q3UELR:EgXafEOA1+NKnL2mABa1LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570161, "uuid": "6390c203-9c1e-4911-9fd0-01aa96ff5cff", "value": 42504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570161, "uuid": "73356f72-e507-455d-8f14-addde0ab51c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570161, "uuid": "745422b9-2332-44d2-941e-6f05f492aa82", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543c7b5d-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535460, "uuid": "62b04de3-4979-4539-b32e-748cb8558233", "comment": "Malware payload (XWorm)", "value": "868433bc944440198c6bc15bc4815a90", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535460, "uuid": "9db8da3f-d44f-4d69-bb2e-37105dba3040", "comment": "Malware payload (XWorm)", "value": "2e8dd3e824aa1dd2a5a72f6945592941a65e1a364a4bda51dc3ae471b163b8f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535460, "uuid": "41e6ff43-e3b9-483b-ac0a-6bc88d2cf4f0", "comment": "Malware payload (XWorm)", "value": "173fe014f57695723691e48e9be1ce2bd3e8f9b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535460, "uuid": "b66359da-b0d7-4f7b-9942-d42e2807f0e6", "comment": "Malware payload (XWorm)", "value": "21b7880b50caa38fdbd8bf5b679d4fb0a3ed956cd658f5a01a2222a46df666a125595373caa21198a6e35821069f5574", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535460, "uuid": "8eed1c18-e9b2-4d93-8e74-996a47b2a760", "value": "T120372302ED3BFC6146785999243B0F9BDDB98748C59239C0B516719FC97BD2208EA0FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535460, "uuid": "5c098bd8-9e7f-4fa3-b8ab-6778c0f5d393", "value": "49152:RIWNAH3IWNAHpIWNAHnIWNAH8IWNAH+IWNAH8IWNAHNIWNAH1IWNAHRIWNAHPIW/:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535460, "uuid": "20dd3daf-46cb-48f1-a403-746563c8f5b4", "value": 23164071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535460, "uuid": "65fec9ce-310b-42ea-aa8f-130683af666f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535460, "uuid": "c7139ba9-c22e-4c6f-88b4-04924c8fbcb3", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1b2f60-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535528, "uuid": "5ef4c552-2b2c-4e15-9dee-3b49a448a26b", "comment": "Malware payload (XWorm)", "value": "e13c69abae6d24a73095da94b4dc047e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535528, "uuid": "9cdec49a-fdbd-4b78-acbe-92d7939489a0", "comment": "Malware payload (XWorm)", "value": "303b466dde3d8ad4840e74dc3b3d0db4985d33587f71fbff71d39eb540f74dce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535528, "uuid": "26556aaf-f400-4a80-9fc4-daad4662db62", "comment": "Malware payload (XWorm)", "value": "c6fee9aa25f608765406e170a405fd7fd35581ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535528, "uuid": "e6a4da5b-79aa-48c0-8f2d-e7ad66ececf4", "comment": "Malware payload (XWorm)", "value": "61152bb3d8bfe87a06a9a55fcb4011416ae4d43dcbb59f3a3c3c1ce72b671934daa8bc20fd0ca671341b5367cc7e00d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535528, "uuid": "3e266ff4-54c5-487e-96f0-e034e4631513", "value": "T1DA37230F665A1CEF96C93479287B2D472660AF24449BBDA540ACF4FB401FDB9E037278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535528, "uuid": "57e500e8-343b-434d-b672-d14d85de000d", "value": "49152:YCy0qXkCy0qX8Cy0qXcCy0qXRCy0qXHCy0qXNCy0qXuCy0qXwCy0qXSCy0qX8Cyu:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535528, "uuid": "33593897-a4c0-4305-9950-cf0c5cd3f7a1", "value": 22903929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535528, "uuid": "1168d5ff-062f-479a-a602-8deb1a4227d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535528, "uuid": "63c735d6-f06d-4ea4-8bc3-da75cb469a81", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1e4656-44a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777559927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559927, "uuid": "0f473650-d358-45e1-bc77-0c5ee8802951", "comment": "Malware payload", "value": "495359a930fad4f1146e3b7ae5f88c57", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559927, "uuid": "98482b98-92e4-4d86-8c8a-304146e1fd49", "comment": "Malware payload", "value": "30fd5c4b03fbe53e85f1339d2414708a2ed32a22f86cb9d4d72dc5fe136a7783", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559927, "uuid": "3e21b4e8-1c87-4e06-a914-a8ca9e6835a5", "comment": "Malware payload", "value": "84f31818f3ae6e9032c2a87c49f453e2d8eef857", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559927, "uuid": "3643a287-c359-4bbb-9347-8b53c9365e38", "comment": "Malware payload", "value": "cb6375aa7dd8853bf677f70cea67aa5b87f8dab25d8b2986893b021541207dac59d4a191c14d341b36ebedd17b62a288", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777559927, "uuid": "f4136f51-99a1-4e7f-9f4b-d642133b5bfd", "value": "T1B2D25C57B901A331C5450B328A4BD7D94B6AEC1C9F63204335DB775D2E32AE12AF79E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777559927, "uuid": "7d53b829-21c9-4424-9ac5-9bcb2720d511", "value": "384:wwTDedrGLZT2UxjgSj6IroPRUauq4Tr9qBwGNivMey3M5JC0ioXnufNoVG+OwPgk:PGlE2LSdoZ7r4XaEEeWMbC3+cN/nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777559927, "uuid": "4e804469-3e79-4307-bcb7-c1b39c2605c0", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777559927, "uuid": "8ca33bc6-9c22-4082-a8f3-4762cf4abed0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777559927, "uuid": "f5c949c3-2ba3-46b4-98cf-2003d07da9b3", "value": "WinDiff.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bd01f2-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514288, "uuid": "eb89b661-7e9f-4224-8a2e-28f8d5fb793d", "comment": "Malware payload (Mirai)", "value": "a000c86a4518123d7598f1e9f582f7cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514288, "uuid": "9e5ccbaf-9ca2-4a49-8ff7-f9c3e4ee62c3", "comment": "Malware payload (Mirai)", "value": "32f6c9816342817eef777f4a0dfec001539089daca8761b3aa612885b7e4fcf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514288, "uuid": "7aea4333-a3ec-4cb3-b534-586cb35f438e", "comment": "Malware payload (Mirai)", "value": "0e58dbbefe99e9ded6d7754ba10d4b20596f2343", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514288, "uuid": "a7e12c1a-27f9-4f3a-a0b9-3547958b9d2c", "comment": "Malware payload (Mirai)", "value": "4c7cce5da704c65a061f9ed69628edc6f91177dfcbeed460cf5c55d3466617ec77fbec747c3170f1a0a8dbeb39c03f84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514288, "uuid": "9b1420f8-7ef8-42e3-8150-eb24749c8b6a", "value": "T1D214F946BD518F23C6C311FBFB9F429C372667A9D2EB3102D9257FA037864DA093A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514288, "uuid": "fdccbcf7-55c7-4fb8-9c8d-1a9136ff7e62", "value": "6144:Idu9QN9f7nCbU4WzqTBHNmSfuv5yJjcFL:Idu9QNZ7nCKqTBHNtNJjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514288, "uuid": "0f0da71a-082c-417f-9a21-2e6269686452", "value": 206300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514288, "uuid": "07563e7e-6a9b-4cd2-b2a1-103bfef76eb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514288, "uuid": "7d6a8cfb-d073-44cf-aa8e-67a019d9b640", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac787aa-4475-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777540812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777540812, "uuid": "88676409-3a62-42a5-8388-47527d4d5aef", "comment": "Malware payload (NanoCore)", "value": "8218c1ae627d999e0a8f10e4718d6f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777540812, "uuid": "36f1a8a5-e6e9-4e0a-89ba-028a0d958db5", "comment": "Malware payload (NanoCore)", "value": "33d0b7d476e3481886829c6f30d824d684c8e88ca8ec93e258c2de420f6ae324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777540812, "uuid": "76dff068-d39d-4603-b7dc-3310eadcdc03", "comment": "Malware payload (NanoCore)", "value": "2060ee4a3233abd68ca1db72425953eb3fc12c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777540812, "uuid": "6d020b19-661e-4b6f-9d0f-792846f147b2", "comment": "Malware payload (NanoCore)", "value": "f73d0bc21bad9abb9ac358284ed1b790cd6fab4a67629edac3f33e3a465a0365ab9787952dfdcea9223564c6750b4362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777540812, "uuid": "c48e2e37-dea1-4de7-9b3c-5e816325c915", "value": "T11114CF2527B88A3FE2DE85B9612251539379C2E398C3F3DE28D454B78F267E10A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777540812, "uuid": "42bfa207-18de-4a1d-a2c7-db0d8b54620f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777540812, "uuid": "97fe9091-a966-45e7-b36e-3045ee39e2cd", "value": "6144:MLV6Bta6dtJmakIM5Od4SJm9dsJz1ORH9K:MLV6Btpmk3dvzORHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777540812, "uuid": "d13532c9-d1ae-40d7-864c-a399d628d249", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777540812, "uuid": "5b996541-12f1-4994-ab51-74f3ac86b243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777540812, "uuid": "45437fd1-e170-467a-87e5-290e9d46c553", "value": "u888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06358be-4495-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777554619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554619, "uuid": "285c4b3e-4a45-4f45-96ae-e9fda498a2a9", "comment": "Malware payload (Phorpiex)", "value": "a0ca3e001cf42724179474d83d4b21c3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554619, "uuid": "00031466-c146-48b5-99c2-3e305d5e3b1b", "comment": "Malware payload (Phorpiex)", "value": "346e8f073c9ded62e1bdc9dfc6252c530e2994c42127d9dd73f12ef63fd93696", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554619, "uuid": "1bab6084-c01f-42f0-aa8f-2fd92f1aa8a6", "comment": "Malware payload (Phorpiex)", "value": "9cfe36cf9a7c5a78a4e8f66d6b564b81325313e1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554619, "uuid": "97e0b57c-6a30-4e0e-a219-f50766989896", "comment": "Malware payload (Phorpiex)", "value": "46aa46df137a086eeefc061c512d04eb4d385b28e1942e141e43187e3e6d1e47026e5d7e28624f3dc9d7472f597aebb7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554619, "uuid": "f2bcfe24-0a9b-491a-bf64-9a9ffdce1165", "value": "T1A7824A0FB8014226E1D120789663463BEA7DA4B5378064D7F7D48ADD4AACAD1F83B15F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554619, "uuid": "cf511e09-7a70-4d1f-a33e-a8e772d4d997", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554619, "uuid": "a7c4974b-b9f7-4651-9629-d616acdc4ba2", "value": "192:/yIAASCngTBvHVP3aueAb6JUrQQY+OL3LvleQtLQKUSfPzwSgcsLmJxTmv8U9ct9:/LIHVP3MUGPQY17v0YPF7av8U9cR+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777554619, "uuid": "f75ffdfd-3471-4a65-9cea-dd471979e76d", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777554619, "uuid": "1ecc8add-c4a7-4062-821e-e8dc0eab58a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554619, "uuid": "037e2b27-16d1-42ee-ac5e-cfd950d19230", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61501d7-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535302, "uuid": "c1ef47c0-53d5-42a7-89f5-25501e7e55d4", "comment": "Malware payload (XWorm)", "value": "539acc4525772ed8a57ab6f0b6e03738", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535302, "uuid": "128227c9-30c3-4865-9091-dead7685c161", "comment": "Malware payload (XWorm)", "value": "35ab513f426e0ae2e073c0f65e5eaefd508241c43ae8523a23fe3384b2054637", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535302, "uuid": "cf63552c-b7db-4410-8380-9c8a746ff3a5", "comment": "Malware payload (XWorm)", "value": "de2674bb24bea21df2163c3aa0c5a364ea66444b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535302, "uuid": "e39a5d79-6ed0-4165-aba4-e54ab61906d2", "comment": "Malware payload (XWorm)", "value": "03b9e99fc56b6609220581eac56ce69584c652fd19f739b72dfae5bca65de3c4c3822145f3eb8c31c40f266aff208f57", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535302, "uuid": "fb90844b-b47f-4f66-a1c6-318adae7aa24", "value": "T1B2372349EE2CCF3ACF2CA92D19F3570DAF884B5851CEB69946B76DF1E819800525F42C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535302, "uuid": "2d26257f-9458-45d4-b509-d84a9b31920b", "value": "49152:31mm1mk1mH1mL1mi1m01mo1md1mp1mu1mn1mW61Vx1mt1mm1mg1ms1m161V21mWA:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535302, "uuid": "532d5d53-8f99-452b-9ba2-a3f6e92dfd85", "value": 23944470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535302, "uuid": "881d60c8-656e-454d-853b-ba493c4696e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535302, "uuid": "9f9fde25-866e-4538-9842-fc1bfe7c85a1", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0815f1a1-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514286, "uuid": "a0b77100-065d-4432-b0b5-8f443f9be0f7", "comment": "Malware payload (Mirai)", "value": "9f512872b96791c1059a1b7e4dc6fc90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514286, "uuid": "9d4367bf-3dbd-43c1-a94a-5c2a0c9fc8f6", "comment": "Malware payload (Mirai)", "value": "35c4220b71143da2d5c586ed616da82620700d8e8bf9cbed5263b3d4b54656f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514286, "uuid": "2e683d80-207b-4415-a2a6-06a2ab17c873", "comment": "Malware payload (Mirai)", "value": "f48ba5d7ccbe907bfa71ad4d512e49d863fe28e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514286, "uuid": "3e2225cd-2c54-4b48-9241-88d132b27b5c", "comment": "Malware payload (Mirai)", "value": "6435138f24b1a9d17e45835dace21323cceb9e67fc4cbdb956e7358c035e577a0d2e0e9d01325b93b6c6fbff406b00b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514286, "uuid": "c15d068e-cad4-48f4-8db7-bfcd9a8ce08f", "value": "T1D014F64AB9919F11D5D235FEFA9F419833236BA8D3FA7102DD206F6033C699B0B76112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514286, "uuid": "bb359e97-f534-468a-aca9-ac99e9112115", "value": "6144:AkRmDBTWjYBPE2hofrka7fU3FjCwEAb//Xpl4jbAj:AkR6TwYtPhofrka7UFjCwEoHpl4jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514286, "uuid": "1ca0ea2d-c6e8-4b02-8293-cf5c77bf71f4", "value": 201340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514286, "uuid": "1e920db6-3f1d-47e6-a51f-912a2a21fdfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514286, "uuid": "026cc120-73d9-4ba6-a566-33c7dc9b5c59", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1dcbf7-44a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777561427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561427, "uuid": "c267c067-0613-4415-9106-a4a94a562ecb", "comment": "Malware payload", "value": "45f5c2c13e83162801db50ad0d5cb32d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561427, "uuid": "d0d36834-d6e6-40af-9ead-44708cc108c8", "comment": "Malware payload", "value": "375f05b54afa890723c220cdd8ecd839821a88a59a53f30f88fb05d1f3dd107e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561427, "uuid": "7be3fd88-c753-4968-aba7-f33063ac5bf3", "comment": "Malware payload", "value": "baf595adc6922880687272d1a4e2d3b6b77c8526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561427, "uuid": "c809ab01-5e67-4828-99e0-984fedad0271", "comment": "Malware payload", "value": "0e125b01a1d9c24ee18a877b768f5c46da09c9ade1d907cd2c1e123408067279fda7903821f963f5b1cf180b25df8d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561427, "uuid": "8154865c-aed6-44e9-94e1-a07f50f1cc75", "value": "T1E6F57CCBA2AD51D4D9B6D038C607464BD7B1BC25033793DB0265CB5E6F3B2A24E3A361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561427, "uuid": "6d7bed65-b9ed-49fe-bb95-572c4182560b", "value": "81d9acea906d89f2852ab7ce2ce4e855", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561427, "uuid": "2efaa4ed-7579-40c0-842f-0fbc9bb83d71", "value": "98304:SSaZXfphVskFTBnJO2R2Qrc5gYStBLeW+vrDzVczErW6Az:STZXfpYk/1R2Qrc5gYStBLeW+vrDzV7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777561427, "uuid": "9e066f44-e744-403c-bf95-1822642be95f", "value": 3478387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777561427, "uuid": "2d5f5568-c795-4221-b577-64164023dc77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561427, "uuid": "bb9bed42-c21e-4f81-9a39-9e0143fed251", "value": "\u5174\u8da3\u7231\u597d\u65c5\u884c-.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad03cf5-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538397, "uuid": "0c652096-03f9-4f63-a695-d7d3fca9b239", "comment": "Malware payload (XWorm)", "value": "49a27708d6932af09550f25606744e5c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538397, "uuid": "396f78e1-7d93-4c32-b7f4-b2d73bfdd3ab", "comment": "Malware payload (XWorm)", "value": "37f21514d855f02eba572f6459c1f639c38d787cd137dc2b4177d5fd29325ffc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538397, "uuid": "99e2a546-7a36-4ea5-b1a3-79799cab2e13", "comment": "Malware payload (XWorm)", "value": "6ad72002984d02a80695f815185f64cb129c66a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538397, "uuid": "0bcfa370-eae4-42b0-80d5-3644fd9eb1d0", "comment": "Malware payload (XWorm)", "value": "861b02316a9360e47b12937f88a646e4fa71bbd8ca7ce69d09b42144955e93d8c7a533f81a2db59582c4012093f73c01", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538397, "uuid": "fd77bca2-f47b-4458-be6d-3d04a7cd19f5", "value": "T17837235E1F182FFF406929EC283E1243BBD24E046406ABC657E1BD67DB8FA6070459DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538397, "uuid": "98fe1adb-db4d-4701-bc74-987f0207620b", "value": "49152:BKkKAKQK7KjKdKmKlK6KAKvKpLK9KxKiK6KS+KQKNKjKJKnKuKNKGKDKdKdKOKst:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538397, "uuid": "ce54f325-cdac-4983-9b4b-73d102dac978", "value": 23424203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538397, "uuid": "09b37b10-d9cc-4b2d-91c4-6a3554e71242", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538397, "uuid": "625ce1cc-576d-400f-949c-380a83131f7b", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839493a3-4494-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777554007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554007, "uuid": "2adf931e-08b0-48f9-b084-2ffdd3d8b2c1", "comment": "Malware payload (PhantomStealer)", "value": "c8821ed5d6b2cb2469abfc3cf83210ba", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554007, "uuid": "e72dadfc-2dde-49bc-aa02-c7e0539afed9", "comment": "Malware payload (PhantomStealer)", "value": "382233c398cbc35dcee845ee17046815f37588a382a8106bfb9b0252ea803961", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554007, "uuid": "03a6cb46-d948-4eb4-87e3-20b8be053dce", "comment": "Malware payload (PhantomStealer)", "value": "3fe37d385eae5054cd919c570ebda8086d54686a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554007, "uuid": "f50a960e-134a-4306-822b-a981574079a8", "comment": "Malware payload (PhantomStealer)", "value": "c19a9ec069d1eea9672a08a9c14b0e7b1d31d06691914b6a07d8ccd0579e9f3ea857c3688367beae7bf2244978d75ba4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554007, "uuid": "0f717d15-6ffe-4335-9d07-973e1e98b295", "value": "T13352CC7CC6E5BEC0876B22D434A9F7C2109FD7177EAA0B9CFACC55510B113A5AA7908C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554007, "uuid": "d8c98061-5dfc-4284-9141-d1dc3404a632", "value": "384:KWDurgUSbhFoiWf+m774FtJZDgbU6/7Rd/+KVHTFKx9YSONQpBpR:KFUJ4p74FZsUY7HNVHBW6K3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777554007, "uuid": "834af0b8-a1e7-4a6a-9c55-9f6fd8666c93", "value": 14157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777554007, "uuid": "a4762184-0525-40d2-82b9-e6d11881061e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554007, "uuid": "12c1cb40-0032-44d0-af21-c3bb5d1aff38", "value": "rJusti_2113938502290426175534.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1956f4ee-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777574015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574015, "uuid": "6bd1df3e-254a-4a4b-866f-ab72209accdf", "comment": "Malware payload", "value": "e3f5f2c3772b0b6b328841f20a4cc7f9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574015, "uuid": "e758fcaa-7b49-4c67-96ad-2c91cf8caf16", "comment": "Malware payload", "value": "3828df9585da73fd9e378568f062674a58501c8ffa731f669ea140306aae860d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574015, "uuid": "58ee1527-d991-4f79-b249-af478fa47082", "comment": "Malware payload", "value": "a20575314526328d807f15e9bc411d1d5adb4bed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574015, "uuid": "b545d3e4-5fd0-4a71-ad05-ebe0dc4bdfc0", "comment": "Malware payload", "value": "ea7b0e9d566519d4155cec0d6984c200823556c656289d1135da8d75cab2d096761cb6062b765e6482354f59c2997111", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574015, "uuid": "ee2c5244-15e5-42fc-844d-6e81d41b6360", "value": "T1EA219AECD41C1C2E5F2ECA17E628B258684650A6A7F417FDE048DB32A61B138B317308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574015, "uuid": "aef9196e-570f-4bc5-b9eb-7bc706b0dde2", "value": "24:EEApY9/Nx76w7TytyBGpOv0GyVKXcByyjy0yQtQq9WBp9Bo7Ty76zgqjiw0l1yuy:EEAyhP7z7TytySOv0GyVKXcByyjy0yQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574015, "uuid": "366819ab-1c2a-40f7-93a6-867a160d6c25", "value": 1260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574015, "uuid": "dd2da87b-5002-45c3-a0a7-eacb5afe1d16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574015, "uuid": "5feebf81-3617-41d5-80ee-59ed1cf44c08", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3460a7cc-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535406, "uuid": "397709c7-e086-4da0-a3ad-182fd7cb02d8", "comment": "Malware payload (XWorm)", "value": "3754753ec2f94361f4671629148ebdc3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535406, "uuid": "70558760-385a-4482-9afa-4fc35194c8dc", "comment": "Malware payload (XWorm)", "value": "385a6854ab4066219a96871af210eaaebc5334ee7a7a0b99db819cfde5d2842f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535406, "uuid": "5c646b6d-ae8d-40d8-a3b4-fbcd2321d4a2", "comment": "Malware payload (XWorm)", "value": "75357a1d1d963eba751c6dbf16e7900eea787e47", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535406, "uuid": "5bfa4c6e-0058-40d6-8252-1e555a94dfbb", "comment": "Malware payload (XWorm)", "value": "dba548ced42886c0a9add25fe62c23fb45036e1170107a0bbfc4053f449d2583c5d5e237db0fac2f0e079cf8d918c234", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535406, "uuid": "4d850a05-fc43-4bb2-a3b0-71d66f7a43d9", "value": "T1B83723AF5F1DF83D016A311A1FA90D473DD58F40800479EACA50AD0D56AEBAE21D7F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535406, "uuid": "a2dd44a4-b457-4ab0-a49b-93560c7867cc", "value": "49152:ed91d9bd9ad9id9Pd9pd9Dd9kd90d9Rd9Wd9jVd9bd9Jd9Wd9md9qCd9Od9Md9hk:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535406, "uuid": "5674d962-77ca-466a-9c7a-c503b5c8b528", "value": 22903935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535406, "uuid": "e59461c8-6846-462d-a3a0-576bc5d7815e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535406, "uuid": "88472996-59b8-4514-be1c-91e377136289", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbda9e2-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538534, "uuid": "8a887ba7-fa34-4fc7-8cdc-f3d0f010d986", "comment": "Malware payload (XWorm)", "value": "e711379b3376e352c8099c56b93ca285", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538534, "uuid": "2cd783b4-628c-40f7-b8df-38c7002c5e5b", "comment": "Malware payload (XWorm)", "value": "39236b02ab1bbf80c4c5b7d8c20365788da5467b2de87b6f57e83302ed80c2be", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538534, "uuid": "2d5cfe21-2833-4cf9-95b6-ea29c6b36fd8", "comment": "Malware payload (XWorm)", "value": "a681aa0dfea1ef18ceba4d74b6fc15643f3cccd7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538534, "uuid": "aeb1aaaa-bc46-4b4e-b2c9-1be1319fc5a1", "comment": "Malware payload (XWorm)", "value": "6d41dc95b860061ad0a9baa50688b358c7d8e6978b3923d00052a8f12ffca2fd6bc298eb199861941eaa9eac0385e64b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538534, "uuid": "925f2932-9edd-4f9b-b081-8f280daa4f0f", "value": "T11F3722075D6E0E2FD1A4610804EF1BBE65D8CC545998BCA7BFEB3C0E9B1D42FA60E059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538534, "uuid": "e176795b-fe3d-47b0-b059-89d03de47711", "value": "49152:4Qf3QfMQfBQf2QfwQfuQf6QfuQfTQfIQf0QfCGpQf8QfZQfdQflQftGuQfQQf+Q0:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538534, "uuid": "9c062824-581a-4cb6-90f7-b07d8b6420cc", "value": 22643801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538534, "uuid": "f7c47725-2380-498d-9126-6e0ece8c928b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538534, "uuid": "a6190491-12ca-4b5f-9cd0-61697dd98076", "value": "invoice-1645080830.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f3b078-44d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581202, "uuid": "e3cbb73b-d40e-4a17-86e4-a19997a3b905", "comment": "Malware payload", "value": "0ea4c0cf99d7eb5162c053de3dab159a", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581202, "uuid": "f58c295e-e7f4-45b6-835f-4892327a88a5", "comment": "Malware payload", "value": "39dc9381637bafb5aae0d0fb017645a5873239755289e1722f0f1352607ff7fd", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581202, "uuid": "7627709c-02aa-4f8c-98c9-30043092b29d", "comment": "Malware payload", "value": "6b9cb6487e2cc6718cd8a17750869ad83b7fe7f4", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581202, "uuid": "7d2ba274-d978-4015-bfdf-2995aed1ef3e", "comment": "Malware payload", "value": "1152fe71ece59c1c894f7e908e2893bbf8f52e02e5b2a8cead3b0cdad3807c44e237aa9e86ec0cf6b7438d44e278c67a", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581202, "uuid": "4d8be476-7f7a-4de2-ae4a-c20b8c58def4", "value": "T1DDA29E62D1335DBBEE698773417F12C09DA010D80654A629E325AA2BFC1CF19DC693B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581202, "uuid": "cf71d5f2-88a4-4ba9-9f5c-659d2a531251", "value": "384:7lIDYLnaaqganQMD7zggEi5ElkYzo4VqfqpZ5Dh8EFzjmKuuyylR85m:7lID4wQMnl5914VEqvf88jNuuyylRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581202, "uuid": "2efdbc1f-4c3f-49f5-aa7e-750613311a96", "value": 21811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581202, "uuid": "8a2a1abf-5e68-4f24-8d6f-b3dcfb63c7b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581202, "uuid": "85428239-ca45-415d-ad92-96b93247156d", "value": "ojamu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f30e98-44c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777572970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572970, "uuid": "1b7262dd-3298-47f2-a536-88944d8404d7", "comment": "Malware payload (Mirai)", "value": "c9bbf6fee34d693b0f912c45dab6cadf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572970, "uuid": "8b8816df-0d1f-4413-92d0-9f08b2d11b40", "comment": "Malware payload (Mirai)", "value": "3a8879c548266f52ef559d13aea1c49157eae818806ad1375801b056882bc226", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572970, "uuid": "1d50acbc-0711-4cb2-9ce6-0c296a90b890", "comment": "Malware payload (Mirai)", "value": "a88249d6f7f4b9eb378721cb5dafbeebc23bdd6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572970, "uuid": "5cc93640-5f18-40d3-b868-e78fef74f278", "comment": "Malware payload (Mirai)", "value": "6592773105f3ac230f53a82a1137ab51febdc6a8b590e8aaf067748b9233be434ce2c967fc22c7258752e10fe579c480", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572970, "uuid": "ae0f51c9-4c98-48b3-8570-62807a9ddafc", "value": "T127A3B75F6E319FBDF268873047F74B20A75963D623E1C685E29CD6001E6038E581FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572970, "uuid": "642ab3a2-a18d-4608-83a3-518d63892042", "value": "1536:Hj9cm7/FXwxRoNs0P/M7ILVxAeQMypK4e9X0qIgirjbHJ2B:neov/M7ILvRQzaI7jkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777572970, "uuid": "b1e8861c-af0e-420c-8967-c3ff2c8f9a0e", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777572970, "uuid": "80f6ecf3-f610-4d3c-a382-556703fcb1b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572970, "uuid": "4266927d-de51-4955-b503-4556c2e03ffe", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec345e4-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777574239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574239, "uuid": "a1386412-b65a-4492-83ee-eee702d96fcc", "comment": "Malware payload", "value": "11cb418839b8dae36e531f4411a50c9c", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574239, "uuid": "3160c0ce-8fc1-4578-a126-42e14892b813", "comment": "Malware payload", "value": "3bb877d3680785624e72536fb01d1229149bc5867fcd8ee05c5e320152f87e5a", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574239, "uuid": "2aa888e5-7792-445d-a84b-1c0feda9f6a5", "comment": "Malware payload", "value": "05fea367a1a4c8995586780f7223f51f27047c80", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574239, "uuid": "ba128ba2-9f45-4bc9-a7c7-2e9b8145add4", "comment": "Malware payload", "value": "d4749ca62fbc95eece1ea0755b36280833b817200f2d14189c1abbe8c632b2f52c27a684e05f790a9b46fd17b36b9092", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574239, "uuid": "8b8a2f99-dcfb-435d-a491-0ef577c9cb41", "value": "T196139E26A3015B78A3D147F5193796E45F983C6FA8FE140B32A87B002ED58453BB69F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574239, "uuid": "79c1f1de-ae2d-4ab9-86c4-37100f0c9e83", "value": "768:uIs54TCG52ix0yQKwf0xsPDHokH5mo6X068nUCRnDM7gW49y1yeeC8Rf+Le+qk0a:O4TUixntwflrxHMof9i8oTXByc5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574239, "uuid": "7d9eb5b6-01b3-4c43-b161-06fa89adfccf", "value": 42356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574239, "uuid": "ade5bfaf-389e-496a-8032-4a4d08029b26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574239, "uuid": "5e980268-beb1-4445-b699-5f89b72a8ebd", "value": "ofika.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e38a561-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538456, "uuid": "0b549d8e-e990-4e55-9ff0-198455dae610", "comment": "Malware payload (XWorm)", "value": "c5f75546fa95c42d77991e9cb5f34a55", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538456, "uuid": "aad46e5b-e0e5-4147-9861-0e67afb7476e", "comment": "Malware payload (XWorm)", "value": "3d117357268054b919fee4526d117e938c09ac0a1a31fcda67bec734d7a49778", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538456, "uuid": "dbec7f2f-aa97-470b-b49c-8047042ee7e5", "comment": "Malware payload (XWorm)", "value": "a92ff146d62f52c97a3e368f56f5ef6bee6332b7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538456, "uuid": "2a02294f-49c0-4a7a-ad2a-001430e5e078", "comment": "Malware payload (XWorm)", "value": "9a6e30305a35a8a425ce3428566d1d6890464815b06d0ab961f7e5bd5a514f2ee28fbb3e6247fa26de2f1ba31c1a15de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538456, "uuid": "185b45e1-4995-404b-8b35-616b11a9d630", "value": "T1A23713178BA29F24446812ACCDFF1F5E5AD8DF48D32EE99323DE64927A39F48101B54C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538456, "uuid": "55737f04-8c29-4cab-8f8e-0ea523e95766", "value": "49152:IoNyoN6oNboNLoNWoNooN8oNKoNdoNKoNAoN4sCdooNToNEoNuoNKoNnsCdroN0F:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538456, "uuid": "90ca71e7-917e-41d2-9a94-a12ac27438d1", "value": 23944464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538456, "uuid": "e03f060c-fd1c-4b66-8d99-1754f9462036", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538456, "uuid": "a3883151-01a1-407e-a2b3-7acf0cc4d112", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18218c67-445e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777530634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530634, "uuid": "b6d0b125-8797-460a-a234-c1479dc5c195", "comment": "Malware payload", "value": "771c79938ed055bfb1f88acbb317ec3d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530634, "uuid": "3e361991-75c9-4643-bbc7-b4513302f6d6", "comment": "Malware payload", "value": "3d7c91eb31333b78aa95fcb666444262d6be4ea602b6b5dda51b027d47a0ad39", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530634, "uuid": "ef5ac4ce-deb9-4225-bec8-9ce7dc85e037", "comment": "Malware payload", "value": "72cab8e810f143620f7ab2bc27cda1441d6434c6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530634, "uuid": "0b8ed356-60e2-48bd-aae8-0e6ab1167f05", "comment": "Malware payload", "value": "93c2f2b8ea40ea54f234acd3adf0bc797d7378928137929cb49e4bd9e2eaf95d31d161538ddac2cd45df521776add060", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530634, "uuid": "c506f623-89e5-48c6-95ba-e5791eebb3a1", "value": "T152A5475D6E8E5A494701212FCF0ABC4295E36A2A2245DCDD13FF84251C88E3D9EDEF78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530634, "uuid": "2ff08831-0f07-45d1-84ae-a904dd6d9cda", "value": "768:RBxiiiKKEwGaAe5+KV01FccJSK6g7bRK0c/4dirHQKiscOKaigXuogEKibCdK7G2:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777530634, "uuid": "56df455c-7a13-4166-92cf-19efd80856ae", "value": 2147624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777530634, "uuid": "4b73a018-c926-49c0-bbd0-8b2ad3c6fb86", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530634, "uuid": "e294273e-dfc7-4435-bf67-f9c75d7d6e8d", "value": "PO 20260430.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c02067-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514284, "uuid": "5f7d9f7e-476a-4aee-9a9a-38340ce94b6a", "comment": "Malware payload (Mirai)", "value": "c06c685946e724845c6a79a02044260b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514284, "uuid": "d394b4ec-252e-4355-8ec3-8582aeae09ed", "comment": "Malware payload (Mirai)", "value": "3dd3cf57e805fb0944ed491f5e0ea1327a46a81ff485f87aeeb9c8b230b40e0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514284, "uuid": "fe47a60c-e26b-4f6b-aa70-263a90c931ed", "comment": "Malware payload (Mirai)", "value": "5e95e25f969236b6c7100c144c37b1bfae3ef9bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514284, "uuid": "49e963ec-05e9-4093-958b-f43f32aa78fc", "comment": "Malware payload (Mirai)", "value": "e0416cac18acecb32ce1ab24eb55441ecf400d97669507f83493b7fa7645bce0cb98312e32211a0e91def243a0e82dae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514284, "uuid": "eaea0e1f-03d2-4730-91eb-9cddb1144a5c", "value": "T14D14E946BD518F23C6C311FAFB9F429C37266BA9D6EB3102DD147FA437864DA093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514284, "uuid": "3f6cc433-96ad-47e9-8e75-6be449a0ddc7", "value": "3072:PGf4zs7Lx/XBrU6mYA3eMQFbLoMOT8Hr9HoBdcrQCo+X58lQV5jC7nGduL:Pc48Bm3BKvoBTqr9HoHcFZ58lQjjHuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514284, "uuid": "2833b282-64de-48ef-bd5a-11d2a713de76", "value": 205404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514284, "uuid": "42576bbd-090a-43b1-99b9-763e1153e570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514284, "uuid": "e6a5b5e0-11de-4587-9573-0a4c53f54841", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9c9a03-44c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777575766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575766, "uuid": "82f9ef6c-4146-42f3-a359-2d84e70f4306", "comment": "Malware payload", "value": "cbcc8aa63f3fe8ad25aca55b41b0e1b9", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575766, "uuid": "691f1f2b-c469-4324-a822-a001583e30bf", "comment": "Malware payload", "value": "3e28634762f861836e6b4f217195b9be5877e6da89fb71820a494a762bd38751", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575766, "uuid": "5f1bb960-8ba9-4491-b43c-bd575c121a8e", "comment": "Malware payload", "value": "c06df089d731f238d031fd680efaa1ad9b1c5950", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575766, "uuid": "1da49e70-2786-4ca1-ace4-ff1f775f57f4", "comment": "Malware payload", "value": "b4876f2223cfb1fc84c677b05dc0f3193af77b26733466e681dad77ef502fa2fd15d1be5f4ec68ac2ad13fd5c45cb4f7", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575766, "uuid": "69e617d0-bf5c-4d46-9f28-016bbb48fa2a", "value": "T13713B013532CACE691A70833A46CD9C8AABC494B5DE4631EF71E559A2FCFC1A7DC40B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575766, "uuid": "07f68640-4a2a-4e6c-882a-2f38587e5e35", "value": "768:uIskzY7V5hjjS5b1ixCFFolPSzvEKbGgF6kZZidjTWWwnVOstGifIJxA2NzylWMQ:rE7fhfoMgolPSzXvWjy5/bI/VByc5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777575766, "uuid": "4d8afd24-cd0c-45d8-89e4-ae3d2cf12304", "value": 42472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777575766, "uuid": "2f35958c-41ee-4744-8677-f1d9cbefc2b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575766, "uuid": "1ab6e00e-fd0e-48b7-bb70-3fecc53fb4fa", "value": "igula(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51db7709-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565091, "uuid": "ab99d839-f89a-4b2e-bde3-a3a9d5f9c03e", "comment": "Malware payload (Mirai)", "value": "8551babdb7246245c4c284c1715633e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565091, "uuid": "c694bff2-83fa-4ea5-83f8-93a7b9ce745a", "comment": "Malware payload (Mirai)", "value": "3fab8e80f841ee072851afe76c547224564e5e3469e423fdad7d127d31b3fa2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565091, "uuid": "fb50df03-c21f-420a-b636-bf3481c53a6a", "comment": "Malware payload (Mirai)", "value": "e4553f96d7090857c7dd7bc5a85c2a2c227cb835", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565091, "uuid": "575a2038-4067-4a69-bb22-900c0ad131ed", "comment": "Malware payload (Mirai)", "value": "dba7f2cdc6f8d0d863444364958e94681766be5f580c54377c69a924913c041c85152a176d744d66cf72c3c286a5f49c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565091, "uuid": "f6663934-1c52-4b3e-ab9f-a4616928faa6", "value": "T1E094E149F64B3D42D9D7E535048AC681075EE4AB33F393492B47A4BB38693B34F29389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565091, "uuid": "0059b066-7606-40f2-aa03-694156977647", "value": "12288:G/H/ypxZaVtJc3ohj0J9U4CnYgp+4tz+:8yxZa630j0J6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565091, "uuid": "93b5c609-1f97-443a-9c46-7a6c7ac40bfa", "value": 443876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565091, "uuid": "5f688677-5fed-4e91-9992-a823a4d14721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565091, "uuid": "c10c2a64-162c-4180-b2e7-9b8454e6d502", "value": "armhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683e3170-4488-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777548808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548808, "uuid": "50e73128-59f0-4a19-bce2-535a4f91ffb0", "comment": "Malware payload (Vidar)", "value": "3ac24745bf9950c787827c86ec8e8529", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548808, "uuid": "7ae1c58a-418f-4085-b539-4701002c3e08", "comment": "Malware payload (Vidar)", "value": "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548808, "uuid": "809202a2-6975-4bcb-ac3b-bd1ada44b0a5", "comment": "Malware payload (Vidar)", "value": "81f5ea627c74dae4715a582fb7a582e2727c9c99", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548808, "uuid": "b4a3e5dc-2d35-4992-954c-f5ac0e1dff7d", "comment": "Malware payload (Vidar)", "value": "fcd9caa1ed2ea5236743125caa2dc7548bf57c445c1947d5bb49472e13f8479a2b54b5633c714d6447f8ca0769bae82b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548808, "uuid": "042176a6-da5c-42d5-9d3a-6ecc53e6a4a0", "value": "T1F42649857D860CF8C0A87634846937872BE878290B7463D71A9464B63E3F7C79CF4B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548808, "uuid": "b338e72b-244d-4fc1-b00e-85672ff03483", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548808, "uuid": "ece5e332-b820-494f-af12-f3c185232543", "value": "24576:OcEPlvYNJP8cuwJpHJDzRrgqaoK8YJ6OFbzTzz15P6kvNwTOYDXJTQyuVZ3rtPkj:OcEdvY3P8cuw9DzO0S2qYDXJkX3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777548808, "uuid": "afecfa5a-ef5e-4141-b3da-cae0f51d26d3", "value": 4631760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777548808, "uuid": "75722b00-f564-432b-91b1-e3ab883acb54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548808, "uuid": "a1f66bd4-a6a5-46f7-9ec6-3c90a783a6c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce158ed8-44d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581191, "uuid": "4b07dd8a-8a34-46d7-8744-142318eff101", "comment": "Malware payload", "value": "0160e3215290ee07b39455b5c26c52b2", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581191, "uuid": "25274690-aa46-44d1-abc3-1188861edb8e", "comment": "Malware payload", "value": "41b853656a53c6a20af3783d96538a04ef80cdc02a9fb3d4ec5760ca2de29452", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581191, "uuid": "44fd82d5-692a-485e-8455-ff8bca43e6f8", "comment": "Malware payload", "value": "3c48f0a04199f66fd38e61beac9275a5dacf012f", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581191, "uuid": "4d0128ca-f018-4946-9c2a-93faff3ec212", "comment": "Malware payload", "value": "52d5ecd887ca95483ba48d8c2e270599e8cbbc0e0bbaf2019c4bf362824bae2bcf0408fd44864d104b34c747e8792fc2", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581191, "uuid": "f1cd10c8-dcb9-4ff6-83b9-5f673852e6f7", "value": "T18E03BF433B05DB374BD5567A844B2602570C58FEC8B82D8C833AA22D3D9C9A55AFB1FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581191, "uuid": "c1880aa1-7f26-4b86-9557-501f6a506929", "value": "768:a2ZhQwyTFBBnnT1dbFXkW1n7OHoRetYJi9Uo1wnnPgHRk0r:aBBRLBdF0P2KKi9Uo1wnQWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581191, "uuid": "14ee7529-9f7c-4136-9adf-b712cf0bb86f", "value": 40791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581191, "uuid": "3de7b47c-ea8b-4232-9894-90ae3a209d7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581191, "uuid": "390e32cb-2c51-4e4a-aad4-736d4f2a475e", "value": "igula(2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ebdf2c-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514878, "uuid": "ed5e28be-8f7e-406c-b479-a842974bc58e", "comment": "Malware payload (Mirai)", "value": "b35f2516bfd042590a924761c96573cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514878, "uuid": "468dc754-e5fe-47d1-ad6d-449d08950647", "comment": "Malware payload (Mirai)", "value": "4396dcd67c308baa59c16cfbf8590459b09fff5f4efad250c9c966eba7632090", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514878, "uuid": "17ebe77d-d2aa-4638-ba26-42f53946dc27", "comment": "Malware payload (Mirai)", "value": "51649b60654fbe625d80e3b64bd5b637c2211770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514878, "uuid": "9da4662b-cc90-4bb9-90b3-927012873cf5", "comment": "Malware payload (Mirai)", "value": "f2a182a932258f122609a473ef37f1fca2d6b181723b8ccddb69b5e5ebd3a9ca651d3901530a836d3db4f34ceec1c311", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514878, "uuid": "59f79455-6211-4c10-b257-7edef83e5a5c", "value": "T1EEC35B82E6A2D0F0E68701B40557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514878, "uuid": "79fe200c-d329-4f8a-9103-b794c6177a16", "value": "3072:36tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNio7w:VoRNjmj1VGc3rRioc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514878, "uuid": "ef2cedd6-159b-4c7d-8a21-b26141d4fdd5", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514878, "uuid": "a8f544f5-7dab-4b06-a96e-a39a7a1563d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514878, "uuid": "bbd75660-a6ab-4e47-a8de-dda36c4d0d93", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b333fb-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536967, "uuid": "49ff66d1-b889-4281-9d2e-118d51da2efb", "comment": "Malware payload (XWorm)", "value": "fce05b5d94bda283a2cad0a76ab132a5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536967, "uuid": "05ffcc4a-81b5-4689-9eb3-09dff6e7800f", "comment": "Malware payload (XWorm)", "value": "43c450d9faa752a3e872fe0f0cb86b9ba15f8ba6054792941c09ee02b27953fa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536967, "uuid": "323c96d8-845b-41b6-b292-f4103d429c7e", "comment": "Malware payload (XWorm)", "value": "aedd363f35f36c1019037782e42e03834b828c5d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536967, "uuid": "b85c3139-63ad-497d-a1d0-deb529c35536", "comment": "Malware payload (XWorm)", "value": "6b01591ac1214cb71a2bfc76efdaf75d8b2d60607aeb9e6ff379a644dcc676918874ee8c570d1b8b808487503a89ecc6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536967, "uuid": "4e7fab79-cf42-45c2-a509-2e43b6e3346a", "value": "T1CC3723374F6CAB7E4FB577CC294A3D5E108ADC8C721208A03BF12AEA5A5CF5451DA64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536967, "uuid": "22974856-f533-44cd-80f4-b504210a311f", "value": "49152:jU9hU9dU9sU99U9jU9ZU93U9qU9eU9tU9IU9vnE+U9yU9vU95U9NU9lnErU9YU9H:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536967, "uuid": "86311c96-d4fe-466a-9f88-b822066ae224", "value": 23164086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536967, "uuid": "d98a67c7-13b1-4bbb-a5df-43cb824088a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536967, "uuid": "c6ae1268-2b00-40c4-bbb7-2de7b7d241c1", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997b24ee-4484-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777547172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777547172, "uuid": "b97f5582-c431-408b-a48e-691f547a9726", "comment": "Malware payload", "value": "31058a1532825c127a87078f9217eea4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777547172, "uuid": "9e40942b-8ed2-4b2f-87c2-b8b509d90193", "comment": "Malware payload", "value": "4456ebec7a0f473c793ab30842436d310e811e6d931ab65e24e5bd3c60bdf896", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777547172, "uuid": "86d348a3-417b-4925-8a30-4d0f6c12f4fd", "comment": "Malware payload", "value": "92f39a104b2a62cd71e15b7c44efba6e00be4bfb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777547172, "uuid": "67b3de5f-eaf7-437f-ab28-3825837c6a4f", "comment": "Malware payload", "value": "f7b532204da72238105c81a25095aa93039e8af23f9dc54db7092f4d17652554910b99fcaa94611b12415500b46ef43a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777547172, "uuid": "9bf8b4e9-f4c4-488f-8263-457a0f5d2134", "value": "T182663367E2A31F89E87BB4F68083C3D3783D64BC852F665705A9E7628513B733B85250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777547172, "uuid": "4a7cfbb3-67b8-44bd-b4d9-f3e1609564b1", "value": "196608:zOYTZzJ+HwmgN2EGVnsva8QVwgvykZnpGq+9+sUz:SYTdJ+HwmW2Ery8QieHZnpGeXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777547172, "uuid": "1bdf031a-73b2-40ff-8cdd-cd679d7ba6f8", "value": 6670607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777547172, "uuid": "645c59c5-dc20-42c8-86ea-c8942ce99ce8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777547172, "uuid": "f9b91eb7-10ef-4efa-ac32-9ee598fb70f9", "value": "Autoruns_v14.11.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9291d6-44c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777575742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575742, "uuid": "cf57992b-10d6-4fbd-b833-377f03c36aa4", "comment": "Malware payload", "value": "40bd8e2787df0e6a1a50864cf782031f", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575742, "uuid": "e052b6e8-ef98-4635-b61b-8c8975451fff", "comment": "Malware payload", "value": "4481f0ac077aebb51fc0bf19ac669e77b79329fdfd046065ebfc2320c3045884", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575742, "uuid": "cb2d1430-91cf-47b8-bd1b-38d6b2e8ada5", "comment": "Malware payload", "value": "e2a6865e2e243bdedba95bbac4cb7d17f3d2f12e", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575742, "uuid": "8f61031c-bf23-49ad-ae80-dfd1fb8f4642", "comment": "Malware payload", "value": "fe6573ef6f396640ef3f2c70aa680d1fd340eb165ef9262e1c16a4f3da5c9e8422dcf231aa0113d2a1775d2d641c4dc6", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575742, "uuid": "f9b5138e-9887-4a4a-a938-ec0298b95cc9", "value": "T1EC03BEADAF761B33A5F2390EAD650E046635113AD6C0F908B30E7DB26B97C21501BCAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575742, "uuid": "9c66f126-8e38-4725-8cf9-24c7602e41ac", "value": "768:vVZJSZ/sJnZJAe5TS8FlNC03oolfX0Af7qgEhFQEDCWbVqsdTpWD3:vY/slZJAe5OODk+qgoFzhTA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777575742, "uuid": "2a16e3a3-3929-4c83-97ad-98430eeaa48a", "value": 40395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777575742, "uuid": "5d983a90-15d5-47c1-88e1-5dad26aafb2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575742, "uuid": "e83d1f98-4d69-4865-bd26-64d738151546", "value": "atofi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c942183-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535581, "uuid": "fed34225-9700-434b-a9f5-dcf9a295cbb9", "comment": "Malware payload (XWorm)", "value": "8134c0e6b536b102c6dcc631eb1da7d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535581, "uuid": "d3f0bb7c-f8e1-4a83-a3ee-7eabc5b19d06", "comment": "Malware payload (XWorm)", "value": "449f20084809de06f06837ccbce75a58c82dc8ad4b9ccaab5f1ab058a420d9d2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535581, "uuid": "c963b2c2-786b-4f00-bbec-068029e0d5cb", "comment": "Malware payload (XWorm)", "value": "781a5963b4f65466ff00df1a78871aebcaaca73a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535581, "uuid": "8b0a795f-99a3-4beb-95a4-887fa70b2bcd", "comment": "Malware payload (XWorm)", "value": "d99fec2511a305b8bcb594ff9ce7fcb5e5535f1a0292aa49abdb5d5a1fb95b968958d5cab37112896821524b62ffdda6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535581, "uuid": "8cd8d8d6-f5d9-4af4-bb08-f8bed15c7903", "value": "T1243723051FFF8EA8D674AB79307D2D0F067C0182C05D9B27D3F17C1A89595881BFA6AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535581, "uuid": "bbec36a4-1fc8-4cf3-99de-52ab699a0942", "value": "49152:HoNoVofo9o6o4opoMoFo/oyozriLzRRojoWoOoWo9riLzRSoso5oZoPo/oIoGoBM:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535581, "uuid": "9029d27b-c957-4427-9e13-2f0e6b481265", "value": 22643810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535581, "uuid": "ea9adaa7-0b65-4f05-8f0c-8ef516ae32b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535581, "uuid": "175af548-294c-44f3-b126-2fc847bab05e", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1549abb7-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777531488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531488, "uuid": "05eb8cd3-051e-4d48-b507-df6e50cf41e6", "comment": "Malware payload (Mirai)", "value": "48de364797efa7806e07e217444b8787", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531488, "uuid": "3128caef-3d5f-4694-93ce-0cd9bd9a140d", "comment": "Malware payload (Mirai)", "value": "44fa1f30f656912854cfb22c62acc21eb7f3703fb8b82d8f8b7f733ec33dcdd4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531488, "uuid": "be0784fc-aba6-4eba-8a2b-e046c4c2cca6", "comment": "Malware payload (Mirai)", "value": "d5a48272f2766db5a949ecb17a384f99de99c1bb", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531488, "uuid": "d9a2dd9c-dfcd-458e-b3d5-60abf4c1be89", "comment": "Malware payload (Mirai)", "value": "c3a9a45ff4d3d7f0624704fc3146b28f237669f4211bc2932f70049e9af98804e383fcdb3c0d21b396f80dcdd246d0ff", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531488, "uuid": "a09fe2d2-82e3-404c-994e-a22cfc5848e3", "value": "T1B7E49E58BA8E3D42E3DBE338DF49C3A1632F75E5D36391623D01421CD5D3AA9CBA1912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531488, "uuid": "2e441df7-a214-443b-829c-3c57f9b277e1", "value": "12288:Fvk5QPv9wr8k0ou3jq2zGrBCwPsMz78CAXUg5oONlT:FiPrru2BC+xzw1ZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531488, "uuid": "e4fb2918-2516-4070-a05c-d00f44bb1398", "value": 684720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531488, "uuid": "e121238a-24ec-4ab2-b368-72b2b3329908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531488, "uuid": "0da12c70-475a-4c3e-a5f4-eb6e41e3bc3b", "value": "agent-arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a446000-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565105, "uuid": "575732f7-f30c-40b2-beaa-76a800d4ecec", "comment": "Malware payload (Mirai)", "value": "c0221ce81b69a93710b481d73a72dfe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565105, "uuid": "f7a6c692-64a9-437e-a793-2b5d039f30b0", "comment": "Malware payload (Mirai)", "value": "464efe979cdb6b387bf7cc85b08ad05381e8f25ea9df3e6f3369b1b969c6a968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565105, "uuid": "af487b2d-7619-42df-9935-d0dcd6e99a05", "comment": "Malware payload (Mirai)", "value": "756c85afd495d52fbdf308b0deedbb5c345125b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565105, "uuid": "d18cacef-33d8-4b39-b9bc-a271008d266c", "comment": "Malware payload (Mirai)", "value": "e32aef3d47f7eefca5c993e2a3e8ece50481ccf30198960b6d8136df5793711a53eef2979307fd703713e512d736e01b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565105, "uuid": "6a8724ae-fce1-4009-943a-f4d522bfc1cc", "value": "T14425AE11BBF2052AE280933586A2D750B613DB9668D5030BCF618EEBEF571750F85CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565105, "uuid": "503ba63e-bee0-429a-8bc2-36daaedeb97e", "value": "12288:mAu75hPWGAOxh86/Yu+AAqq8DPy6KNrraYn30wUQAbdpw5nZ95Z6:mFFhOhOj/xpqSdKN53H8Jet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565105, "uuid": "9f12822f-8b04-4cc2-b4e6-1b7b258201fc", "value": 1057224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565105, "uuid": "6ca11dd9-0e0e-4844-b16c-2d38b3fbd82b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565105, "uuid": "bde0da70-34e4-4229-b06f-34ef1874d314", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f2ffc3-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538447, "uuid": "53ecb60f-70ff-497b-8c1f-9c46a7760372", "comment": "Malware payload (XWorm)", "value": "2df6703a0c076af554bbd7e225786362", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538447, "uuid": "6cdf1f87-9257-4aa2-9d43-fb0317e69051", "comment": "Malware payload (XWorm)", "value": "47405158a08efc562b2fb9d54f133b5cfcd7fbacd1b710df75f00c7c6070fc4b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538447, "uuid": "ef704c94-aa93-4134-b3cc-044bd3b045c9", "comment": "Malware payload (XWorm)", "value": "df128df37b6df880f69e0f4a0ff13fb645ff0514", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538447, "uuid": "7d5afff0-e37b-43f4-b31d-3c841e4a25be", "comment": "Malware payload (XWorm)", "value": "e4937b697013af1c83fcc04315aff1b400c8015131c9000a33ee1bf6ea0be4f9b6a8c6248020af1d038d4369816762e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538447, "uuid": "9e59c2d6-faa6-4570-bff5-592315424ec6", "value": "T17E37230ABF6A0EEE15CD156C60E60B0703F00F45D19CBBB1776FECDD4AA4A26D4A916C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538447, "uuid": "dd9c6576-8e66-4cd3-81f1-46f14c416ac7", "value": "49152:CpJ6pJqpJ/pJ3pJzpJcpJRpJQpJkpJwpJGpJmpJbpJR:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538447, "uuid": "34962084-df44-4c4e-b062-10325282aa14", "value": 23164067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538447, "uuid": "7ab94904-d9ff-4bf7-a7a4-4fa21ab1c2b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538447, "uuid": "3e76198b-2f67-4742-bd68-8493869de83c", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1925e5-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777574018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574018, "uuid": "b1bf6e49-978f-4352-a0eb-142c2e20ff32", "comment": "Malware payload (Mirai)", "value": "6e5b32a226d3d4d798542bccb6d70159", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574018, "uuid": "92895be2-4909-4249-ac55-e923f602a903", "comment": "Malware payload (Mirai)", "value": "47f0f9e0905328163d8832b6d1a60538fda1f900dd96a21d1547efdb365c73cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574018, "uuid": "d433a5f4-2de5-449c-bee9-8cd56456d074", "comment": "Malware payload (Mirai)", "value": "b4388587904ac483d122261b4513cedd03b9e7a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574018, "uuid": "b2462d75-7f1d-4edd-b60d-cdaa38ca05ef", "comment": "Malware payload (Mirai)", "value": "c95afea5d46db9bad67e1afdbfff127a5bcc648250cf16ee36dc4015d881702b63ecc099306e0c30ef4f06f080346b10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574018, "uuid": "5a9178a2-24d7-4ebd-b4c7-dccfccc63f34", "value": "T1CAA3C71E6E319FBDF678873047B35B30979923D623E1D685E29CD6001E6038E581FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574018, "uuid": "cf668c2c-aded-4041-ac1e-3d136cc59deb", "value": "1536:GWsXWPdTdW5iZSR9eErmdFT4ZisLW9pWes58W+Ma4MYJrr:hxWHR93md9eiyL+t4xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574018, "uuid": "8f10834a-cdcc-4a40-937f-c5cca1e3b0cd", "value": 101392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574018, "uuid": "87bb9447-6904-474d-b86e-c9b016d5c13c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574018, "uuid": "d452a8cf-8139-4ab0-b62b-1e449c071dda", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4c4e27-446d-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777537082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537082, "uuid": "426f2189-516c-4148-b252-1cabc31fe8b7", "comment": "Malware payload (XWorm)", "value": "942f8876a66e305db9921356431419a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537082, "uuid": "d861b6b1-d314-4929-9b55-d28df65c5f16", "comment": "Malware payload (XWorm)", "value": "4879213c1da83f97e7fb9d1c05dd20933a65010577d6d6c389d286f54cd6cdeb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537082, "uuid": "4e8ca264-cc0d-43b6-88fe-c3a26b150b57", "comment": "Malware payload (XWorm)", "value": "69c8b201dfa2a9e91f26ad150ee7c452bbe678dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537082, "uuid": "2ef158d2-79d3-41dd-ae0b-af21c23fcc2e", "comment": "Malware payload (XWorm)", "value": "f6ba0dea992d86f48ff8d30b7e0f17c7cea8adb5e663e8912edc6859933ff7b2d8bcbec22fbe49c21c96033e54777086", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537082, "uuid": "43e9010f-9c07-47ef-8e2e-495283c1d6b9", "value": "T1CF3723810A22993B1BBC6FE6743C160F6D464F22001160FD3DA9A9AD815FF38599DBFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537082, "uuid": "7703c897-b7d6-4389-9484-79960be2037e", "value": "49152:jVxkNVxkyVxkmVxkqVxkMVxkPVxkQVxk5VxkPVxkrVxkZVxklVxkCVxkT:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777537082, "uuid": "cc38fa75-eacf-4513-9f6f-7cd11b6e6f37", "value": 23944477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777537082, "uuid": "ab536c07-61ad-4b3b-94ee-e3450d1e51b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537082, "uuid": "11e0176c-0b8c-4d46-9793-1cd3b9881bc2", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fe6fa2-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514818, "uuid": "925c02cb-3833-4777-b8d2-c0a65efe8981", "comment": "Malware payload (Mirai)", "value": "5461683cb34a0eaff0c705786616d592", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514818, "uuid": "b43f92b9-ca43-40c1-a919-02463099b5a1", "comment": "Malware payload (Mirai)", "value": "4899e3b74387abd6fb99c7d74944d9508c8e1a585e8910743a936a3747951712", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514818, "uuid": "b06e44e4-3d06-41fe-aafd-fb18e2ba671c", "comment": "Malware payload (Mirai)", "value": "170d7557789f085e8a41c088816e94212917a2a0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514818, "uuid": "32262570-1fac-46bc-ab9d-26fd350dc4f6", "comment": "Malware payload (Mirai)", "value": "91f29e9f7edecac5c9e3925da301e8ecc65c0288dd31fcffd9bb5adf0cd6df097502c3294eae3bdd4ecb358449f69674", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514818, "uuid": "66a42c18-4785-434b-84fb-b95259125cb4", "value": "T194D3C021E4006DD1EC2129F578BA96BC0350EE700BDE1586EFFDE95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514818, "uuid": "f7b8899a-3506-419f-9952-aaa9f778573b", "value": "3072:PHiBTNkAgcly+hoVpE6AKUjq+8biA7JBd/xQ:PCdny+hovsmzbisJfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514818, "uuid": "cb089a3c-60fd-43c7-b19d-3bf71c4bcc43", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514818, "uuid": "6203ff43-6904-4282-ae95-971cd206652c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514818, "uuid": "0b21c91d-11e5-4d74-bf42-571d289f6ae2", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b221e8-4483-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777546733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777546733, "uuid": "fed0f5d3-9850-46e9-afff-42afd4ef4231", "comment": "Malware payload (Smoke Loader)", "value": "2c3b4d790d854d69142c026834b60a40", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777546733, "uuid": "696aecc8-a003-468e-89f2-b8e8ace0ec68", "comment": "Malware payload (Smoke Loader)", "value": "491ec3fe1a9da7e11a85ff1353e3526fa4e78e40c04e2ebb18b4be3803fff60a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777546733, "uuid": "aca0fdea-d7ea-497a-bcc1-ecdef41c06f5", "comment": "Malware payload (Smoke Loader)", "value": "3edbcc7a2245abbe28ebebed0d1d5c9f5f580247", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777546733, "uuid": "f8cbd43c-c1dc-4f9d-b0a2-361cd24e2922", "comment": "Malware payload (Smoke Loader)", "value": "6331705679f5a1b0f3d5ed65024f6f7c3c407a83776da9465aa7dc81b1d897ec404eacca1dcb50f902e12071d455048a", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777546733, "uuid": "5984bdaf-3601-4e3b-959b-1d1f23af4917", "value": "T11D7633D513F94659F2F76EB89831172289B73CA3BF31C55E0693818E24A2DC1CA36B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777546733, "uuid": "adb454ee-e9f1-4d10-a6d5-0847b5ae0b26", "value": "196608:v3hVfCWriMwZjlXpJxiqJe+f8YUcFCn5zVWnk:vxVfCr5ltiaebYUwCn5zok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777546733, "uuid": "4ff8da47-fe20-4b91-8b74-d4346aab1b39", "value": 7695360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777546733, "uuid": "f955a442-3291-4d30-a621-05a38e8d0cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777546733, "uuid": "39625ca4-b299-4de5-9ed4-c25b200825e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56634006-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565098, "uuid": "cb753355-31ed-47e2-bdd8-c5e4813e73b5", "comment": "Malware payload (Mirai)", "value": "9d499ab4bed86ee8360621223e3969d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565098, "uuid": "b856b3b3-a551-4ba0-a680-733ec8be090f", "comment": "Malware payload (Mirai)", "value": "49b1ea659712f690c0eaa4e666afed2da9ff7f2af0d9ed0130909ea35778eb21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565098, "uuid": "ec9463b9-c842-44e9-9287-dfdf5a7231d7", "comment": "Malware payload (Mirai)", "value": "116505d92cc11f10c67534201092cab119130650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565098, "uuid": "6229f626-1bee-4358-9085-2c26cc7d5c0e", "comment": "Malware payload (Mirai)", "value": "2e24a084f762b687a5c6de57f7b3a7fd133a4e55d14a649a9ca0ab93130581646fab65a404bf0cfa9e4a1975ec7d3ec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565098, "uuid": "251b7ff0-c16a-4101-a3c0-f25a01c6d347", "value": "T1A0F47C46EF850FEBC4AFCD30452E834705ED999706C1A63861FC8D8CBA9D6A94FD3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565098, "uuid": "0a460926-ae4b-4e61-a3e2-2ba722e9d5b9", "value": "12288:p1b1gSF8F0DZp5D7M0Gkvz/eV+44KAjrJQMbj4YmlqCb5XjHUW5MNjVRnxJLKQFK:SvW4RTuhj0D5sfk3o6PdPIDX+ggq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565098, "uuid": "ca764ca0-9ab6-4e1b-8a5c-ad518f95df50", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565098, "uuid": "48b6de82-a57d-4f52-8ef7-2b65f89094d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565098, "uuid": "517e5866-b84e-46dc-ae61-dcd02b2ae987", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb664eb-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777574266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574266, "uuid": "d6fd4b1c-e32c-48db-aeff-2d995e7bc071", "comment": "Malware payload (AgentTesla)", "value": "acc03c3314c77136e405d9ba2b265c0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574266, "uuid": "ce119835-6c4c-415f-8005-ce9244a79879", "comment": "Malware payload (AgentTesla)", "value": "4a2b467d823861199497178aa9c39088b91bcb3fcb3c164238ffa039fdc0a1a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574266, "uuid": "49c75206-5682-4508-ae88-3501ff562af4", "comment": "Malware payload (AgentTesla)", "value": "25d2a0a828a22dbc0810cf9affe67ee4bab53da6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574266, "uuid": "9cf02de8-26a9-4259-ae92-ce389f8472c5", "comment": "Malware payload (AgentTesla)", "value": "a6c367e9faf4f9abd6c17377027cbb9793918db45989ca1ef56b32e1111d3bb0a5fa29bff09903ae5addc2d994ce1e84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574266, "uuid": "089120e3-a73b-4827-9985-99a3d54f2fe6", "value": "T1A5351265338ADE02D5C21BB80CB0C77917B84E8CD614E3478EF9BCDBB1B9B9129542D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574266, "uuid": "8ea3cc7a-0c6a-4933-a85d-537110878a20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574266, "uuid": "21e8e438-cebc-4876-9af7-33531c266982", "value": "24576:tgrfgy17EZhy4c3AHc1UQyb714m4SxH2j5WS22mz:tgr4ytay4zHc1a1JxWlWS2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574266, "uuid": "e8f4f124-7a3d-443a-8f25-cc2b56d970e5", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574266, "uuid": "faf08e34-4140-48a7-8fba-3e6ec8d84396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574266, "uuid": "839fcb44-c976-44fc-8111-3ef3d405a14b", "value": "Nota de credito A12345-045_20260403_pdf.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a02c93-44ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777564589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564589, "uuid": "5661caa6-c575-4366-952d-142d168a338e", "comment": "Malware payload", "value": "1702c5a88c93d9e495bb7b2c54894875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564589, "uuid": "653c4aff-0973-48bb-9465-d7968871f75e", "comment": "Malware payload", "value": "4af9a96fbf6c751a7e2ceb297ec708e13136a0b076dad0f9ba335c68c8e8f33e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564589, "uuid": "0fbbbab7-5a54-4912-8d99-06a6197e472c", "comment": "Malware payload", "value": "c774dd32e46b6144183c0a3d1fb960a66330ad62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564589, "uuid": "74f6df00-6bd6-491f-92a8-765582d1a9fd", "comment": "Malware payload", "value": "ac3f4136584669746faa7c6e60322941ccad8ac0dacaa9957e0f682b3c1e774631c21f2edd1db7ecc33f24f0ea8e3035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564589, "uuid": "a18d72cb-0d81-4134-a2da-4f4a05767f9f", "value": "T14924D0B363D44024E26FC1BAAF5B5489DA7BB4B65394B11721242F303EA2BF27DD4358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564589, "uuid": "ad326c02-9f85-4a6e-a42e-fb76ff027464", "value": "af0aa22d6e3fdb07674c20f98cbb90ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564589, "uuid": "95ceb553-182b-4f04-bf6e-ba7525858286", "value": "6144:tkZfBIUfxdJjyDeHJ7pfqufxdJjyDeHJ7pfqhI+s6lQhv:vUfXJjyYpHfXJjyYpv+kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777564589, "uuid": "2a4b01a5-aa94-449b-aa8b-c370c4f38bcf", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777564589, "uuid": "7557ffa0-3e21-49d7-8845-79610bc66eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564589, "uuid": "d57a52e8-25de-422c-af5e-95f5b6aa21ae", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u8fdd\u7eaa\u4eba\u5458\u540d\u5355\u4fe1\u606fpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4add93c9-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535444, "uuid": "fb10c87d-6985-41af-8c38-2f0efb4375ae", "comment": "Malware payload (XWorm)", "value": "9860e56d96b4b092bb3f7cf9683e0381", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535444, "uuid": "eb369787-5d59-4e1b-b8ab-87d8d6cc9322", "comment": "Malware payload (XWorm)", "value": "4b5a1ad05c1fab3a388e344e121d1f9aeb85f5f9dd38f0f5fc4b35bdd8e97736", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535444, "uuid": "4f45fe6a-2899-4270-ab5b-ad9f9e8ce1b8", "comment": "Malware payload (XWorm)", "value": "f16524a44a7262677a37e2ea406f5c8213ffd3c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535444, "uuid": "f5b946c0-d0ae-4a80-ad85-e8d38964bcb0", "comment": "Malware payload (XWorm)", "value": "c094fdc12ac2251d6f4b1a92067f6b2884de49eba1ab9142809dad83f9cc1afb976378153da849e69b8b8ec9f88febc8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535444, "uuid": "4a1d1fbd-55a5-45db-b371-7e5c8d55035a", "value": "T1573723268D2AACF4C2DDA18C056C0D4B02E6CF74B4197CA7A759F6F35F5E13A03A512E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535444, "uuid": "887b6f45-c9c9-4144-ae71-b636a903b042", "value": "49152:zahawaKaja1aTaCaXaQaQadaquyxaFaIa6aOaLuygaRata/a6aYawaWaEaNa6aEH:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535444, "uuid": "96abb4b9-3047-4d63-9e1d-db18e2cc4ed8", "value": 23684347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535444, "uuid": "18ba2a7e-9b2a-47ac-a131-4a9c62db911f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535444, "uuid": "21db49c1-1ee4-4399-b146-6dcca6053a92", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fced64-44d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581442, "uuid": "81cbe573-ad94-4dd1-b360-8d65833ba474", "comment": "Malware payload", "value": "ae5309326872f2ada71e2cd563007445", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581442, "uuid": "96afbf09-3b06-47ab-95a5-55dffae82477", "comment": "Malware payload", "value": "4bbc209209e72af3f64436a80fcabb70c3043b0d3ba9cf63d2109c62db387eac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581442, "uuid": "0e4a7765-fa70-4659-aae6-e2d0bebe859d", "comment": "Malware payload", "value": "69afc5e89559e98698f2c62378037643812b6eee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581442, "uuid": "f553e0c6-c566-4404-b357-7b83d1c93911", "comment": "Malware payload", "value": "d5478464a7850ea68a9d551f8a6d335bb3307d35f1d32fbabd3d8fc940d15b37cfcd66c3ebbf51429bdee8d81eac4f9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581442, "uuid": "c671cc0d-ee5c-47e7-be2a-8c00cd28aa06", "value": "T1D2632B99F180DB61C5D016F9B44E52CC33379BBC81C97282DE207B743EAA5EA4E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581442, "uuid": "3b537f4a-46f9-4f27-836d-238fe7bc4bfc", "value": "1536:DltSXtUwW9o1tZGqiB9YdVCxdw+MGDOvsz2BafqoDCs7+M:DlTwW9o1XGtjY+kzBvriJDCDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581442, "uuid": "d2c04c92-7fc1-4d17-b6be-a38e06242e5d", "value": 71004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581442, "uuid": "bab699d9-2bbe-42e5-8cb2-fc918622adf3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581442, "uuid": "887323a3-b31e-4d09-9694-2bfa7aca00ad", "value": "dcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b3c0f6-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535430, "uuid": "7866375f-c8d8-4771-ae5e-dc62e6a139f4", "comment": "Malware payload (XWorm)", "value": "f4bb1b29eb9326e85cc3c21116761c52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535430, "uuid": "3fe07071-62d6-4d7a-b2e3-7d62110f4939", "comment": "Malware payload (XWorm)", "value": "4bc83c919b5773fe62575f53a9c7f977aa73e898858a54abb3e339ea299cc9ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535430, "uuid": "e6b7d870-6f10-468b-a3fc-2d73db1a7328", "comment": "Malware payload (XWorm)", "value": "8e71f5e49a7a5b5d7d26eb6eb6d72203db7b5026", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535430, "uuid": "cf7d7b08-bd28-43c1-850b-8b7f765e8c55", "comment": "Malware payload (XWorm)", "value": "782cbe79a4e27c65d9a7a6173df591a55abb767a5aea3586ae9ca060d5758843bfb1c34936114d274fff21ba9e6823a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535430, "uuid": "d6e42540-4b68-46f6-ae78-1b425ae9ff03", "value": "T18D371247143DBC7F0C7C05BC587D2FBF69514F096A2862E883917CD98A46FA202AE5F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535430, "uuid": "2008dde4-4cd5-41e4-8124-35ed6b21aeb4", "value": "49152:bbObBbVbtb+bIbBbub7b/bEb3w+f3zb8b7brbrbZw+f3KbPb5bub4bJbBbBbybv3:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535430, "uuid": "38877050-2f9a-42c8-b890-490cfe9c6b59", "value": 23684342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535430, "uuid": "0be67c52-82f4-4e04-b03b-545281d1e34c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535430, "uuid": "77773c00-fe05-4993-8bbe-a3881191ccff", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4a4436-448d-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777550910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550910, "uuid": "53c49a90-20ef-43ee-bd10-c201a608cf0a", "comment": "Malware payload (Prometei)", "value": "67a6027f34f8a6af1134ed7a53e60af5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550910, "uuid": "1ba1f604-e61c-4825-a3fe-748fd0806258", "comment": "Malware payload (Prometei)", "value": "4cdeb4b178845109b4f421c0293533a0e26de9b10349971e4cf088723c4ae72c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550910, "uuid": "25974d0a-8990-4899-881b-0b1a85309ae0", "comment": "Malware payload (Prometei)", "value": "3cb6c81c47874e908db914e9b777cee656347a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550910, "uuid": "c05cc6fb-c7c4-4ee9-b153-85bbfa4cf2d7", "comment": "Malware payload (Prometei)", "value": "1fc32fa2852ba9e52c80c67e5a4acc0760a37f4755c619e83f1210ef28127eac18041328acf92206bbafd2a755091ed4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550910, "uuid": "1f35b52a-4b18-4e7a-b9a8-154655844d19", "value": "T169A423B4F9229E9F6DD76DB91B24C31DE181C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550910, "uuid": "ed3dfd6c-9998-4a57-b160-41124da8b5e0", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsda:Fs6pyCC/Ya2hpi6T6N4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550910, "uuid": "cc0033c5-3977-4b49-a2f0-bdf033b86a6c", "value": 449085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550910, "uuid": "648c03db-f7cb-43a0-b1d3-41d9f2f5f0c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550910, "uuid": "740aa6ec-a393-4e6b-a308-fbf9f16a5ff9", "value": "4cdeb4b178845109b4f421c0293533a0e26de9b10349971e4cf088723c4ae72c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c895fb-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538391, "uuid": "230667df-cba4-4038-8c3b-a67ebf53fa5e", "comment": "Malware payload (XWorm)", "value": "2029b4b52a47c2ada924537bbf9c8e33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538391, "uuid": "73474502-8bd2-48ea-b55b-89be6e560fea", "comment": "Malware payload (XWorm)", "value": "4d69cdf147806770e348951d3a7068cb97cc1da5b6f50eae2f20b5eeb1eadc60", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538391, "uuid": "75aa8467-064f-4dc2-bdca-09ca67495c60", "comment": "Malware payload (XWorm)", "value": "17386543b3441da6fc43eb8494198cd9f581944b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538391, "uuid": "beba11b5-4f22-4c37-b120-4b486e783de7", "comment": "Malware payload (XWorm)", "value": "fa90e0740c6f6d3b6ef8f4d6135e67a92118eeaf7677349b8be2f075bb11a12b9ad4ee2a2b1aa38ec3272ade1cc78998", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538391, "uuid": "0ca41ff0-b065-4a7b-8936-4a3c5de3614a", "value": "T1133722450B3D0EBF86182F695DA77EC87C930D045916FFD4A590DCCA9E76A8CA8388F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538391, "uuid": "73d9f004-645c-4259-919e-0ec8bd79a938", "value": "49152:JfLqMLDfLqMLUfLqMLMfLqMLXfLqML5fLqMLXfLqML5fLqMLRfLqMLWfLqMLXfL2:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538391, "uuid": "9e19d6a8-c925-45cd-8638-4cd08f03c6e3", "value": 23424204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538391, "uuid": "c69c6729-8b60-431b-a235-ef42fad03988", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538391, "uuid": "e8a6c01b-9c46-493f-a036-c4c32b0949dc", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cce224-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538356, "uuid": "e5c6cfb3-cb81-4504-b5cb-c8d6275b369e", "comment": "Malware payload (XWorm)", "value": "2b4356e56ae07b6e7082d7747ea64127", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538356, "uuid": "9d76449c-8943-47bf-bc88-c47a0a3e8ef6", "comment": "Malware payload (XWorm)", "value": "4d7432884370719d873c2624dd702f1f57d9d1b70af25f1a3cbd2983a3447a95", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538356, "uuid": "42cecddb-dd55-494f-8429-7f0d051faff5", "comment": "Malware payload (XWorm)", "value": "c0113472cb721188401731064d50ca2eb79e37f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538356, "uuid": "834b8955-ab5d-46a3-9f6b-3b0d8dbd8dfd", "comment": "Malware payload (XWorm)", "value": "5acb4ed252063ed68984ceb8e69f2be054ba0a537cbac9b0f4ee7ea3b6faf94c257d266443ed7cc5ec222a4ca8155c06", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538356, "uuid": "5cd29dd2-35f0-49bc-bbcf-21d9303a93d6", "value": "T19337232194B8FFFDCA792B245973CA3D5850CF5C85209479BEDE3882948FB2E12571E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538356, "uuid": "95d30531-e92a-4960-a735-f681072dfad9", "value": "49152:tRvC0RvChRvC6RvC9RvCjRvCVRvCKRvCSRvCLRvCVRvChRvCDRvCURvCu:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538356, "uuid": "6daa35bd-9e46-481d-abc6-51d878ca3471", "value": 24204587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538356, "uuid": "83bf1685-47db-41f6-a802-bedda709ef2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538356, "uuid": "1a3682b2-43d6-466f-81f7-2b241e09f20b", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57244043-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565100, "uuid": "b1cc6fe7-a1ba-4dbf-9f2a-57132255d66d", "comment": "Malware payload (Mirai)", "value": "35e30b7967765129e20e0f92e5f7e3e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565100, "uuid": "08662e7d-8152-461d-a6f5-73a422987f58", "comment": "Malware payload (Mirai)", "value": "4da8da3461d72fbba08598a8038fda1761fd931d296d087fefb2205215da9e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565100, "uuid": "12477d85-0e25-4de4-b4b7-5653e09d346e", "comment": "Malware payload (Mirai)", "value": "7ab0ea16ed4c8586b166083ac392905153a64843", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565100, "uuid": "5ebd3674-2b7c-4065-b461-106ad4aa4916", "comment": "Malware payload (Mirai)", "value": "756e8ab7345f2224130150bacf863c2d8e54038cd59844f44430ea29f018939feab6e410ec14b681df4d42f6fe260d54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565100, "uuid": "41686857-591e-4027-8a34-f2a73ef0d8cf", "value": "T132F46C6377218F64E365D67005F387119E9521A30EF290C6A2BCD2207E6066D6E6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565100, "uuid": "03606859-80e8-477f-9562-b7a6c18aa4c9", "value": "12288:upEPKmln4Dzrs61rwSWnWv48nGNmzzuf0eXbtGgp9kMToBid3:4wKm569Z48nG0uFXbt6eoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565100, "uuid": "1b6bf228-ac76-406c-aab5-01b723309354", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565100, "uuid": "29ae012f-8fef-46f9-a77b-c7d073f1da4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565100, "uuid": "bc2adf3e-6cad-43d3-90c9-fe879d7de65f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a5549d-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535511, "uuid": "1e4a2687-7c18-475e-b2c8-6b50939c478a", "comment": "Malware payload (XWorm)", "value": "71125670decc536052e47076785c698d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535511, "uuid": "bea89e14-12e4-4492-a360-822761ef49d9", "comment": "Malware payload (XWorm)", "value": "4e277b73c4a2b3630632d42d201fa8e2d4c43c46bfb9f016de2713315d3ee6ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535511, "uuid": "badefcd7-446d-4cbe-8447-bfe29e27373a", "comment": "Malware payload (XWorm)", "value": "3698aedec43b789c736680dba583d44a7904afd9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535511, "uuid": "5790077f-b847-444c-bffc-8bfdbc549daf", "comment": "Malware payload (XWorm)", "value": "71303937b9ebc73cdade1fe5cd022ceb84180d536fcaf686029fa7cb1ebaa5f1463281826a993b50aa41ef584dde199f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535511, "uuid": "3ba71861-ab77-4a4c-83cf-f2a68b6b3c4e", "value": "T113372215DA268C49CFBC059B58B70F1A1DE9BE44C889EB92BBE1641FC5CFE69401F270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535511, "uuid": "9168ea97-499a-4fce-8d49-122feeaf1292", "value": "49152:UavaDa/a0acaiaoaaahauagajcUVajagagaYajcUYauaZaladaMajaaaEalaiaqc:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535511, "uuid": "c9ff2206-3d12-4af3-9a89-5b805ade555f", "value": 22643812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535511, "uuid": "8cb353a5-4d8f-481a-8550-e01af08d993f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535511, "uuid": "48e80f2d-223d-4443-b82d-9648dc697f81", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ceecad-44c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777573763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573763, "uuid": "806bd79f-2407-4d76-ad7d-371be02716a2", "comment": "Malware payload (Mirai)", "value": "014adfb295eb097e26a24e5319c30654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573763, "uuid": "c3c3a444-0db1-42c4-9655-e989815497a5", "comment": "Malware payload (Mirai)", "value": "4ea6bbcaacc99e24b0529a72fd35c1e5be258e5bc4eb281b2ec61e5f2f2d4992", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573763, "uuid": "ff07edb0-6e09-44a5-b614-ea8840c7b260", "comment": "Malware payload (Mirai)", "value": "0f5c2df808e76e9cb6924e120402415a1b891491", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573763, "uuid": "cdf5fe4e-5221-4df3-8488-e4dcf6790250", "comment": "Malware payload (Mirai)", "value": "956bba3bc8625fd6555ddab1110cc2d00defe22cfc76ab331ece8a41298db853b4610cacdd32e991d735b0b1c725aedf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573763, "uuid": "06a8d7be-5825-421a-85a4-08cb5c2ef44e", "value": "T1BBA3E90AEF510EFBD82FCD3746AD0B0634CC554722A83B7A7674C928F65A54B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573763, "uuid": "4d7faeae-4b15-412a-8bd9-4de678fb8846", "value": "1536:jkJFHOZE3alItu/ryxrXpCNaZoR/cGxUVpVNoPJ8bbKucu7VmJv1:04rqX0aHX8O97Vi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777573763, "uuid": "6bddfbb7-d0ff-4e02-b4af-c51ece8e6eb6", "value": 101392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777573763, "uuid": "d1bbf15a-1b29-4cae-a8d5-d396c530609b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573763, "uuid": "c8b42dc0-af27-49ee-b1a7-81f985ef879d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cf311f-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514279, "uuid": "5dc01efa-00de-4757-b611-d7352192cff8", "comment": "Malware payload (Mirai)", "value": "785796a2f38065959fb7bddb5586426c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514279, "uuid": "c6cd9a0f-d336-4185-b271-b73365128553", "comment": "Malware payload (Mirai)", "value": "4f58f1b7f32926a296e205849ef00e75302120fe809c0e09d3e20b48d9fa40a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514279, "uuid": "08296a45-0a3a-432f-828b-d2b9aea01e29", "comment": "Malware payload (Mirai)", "value": "28929cfd64e72c33407f8a8679fc3dc3f0f95728", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514279, "uuid": "97a404eb-5097-4ab2-b751-6147046e39b8", "comment": "Malware payload (Mirai)", "value": "3d233c2bcb0086b2f1b5f2f43e026ef2bc98a9bf261387a7e3e78413de56d2c83f7bf5a656ec4e22a3052fa2a43aba26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514279, "uuid": "63f8b25a-2ad4-440a-9918-f41d2ebaa182", "value": "T1D37408113B47EC6FFD6903740AF68A7477D865B229A1858AE3AEBF4D0F350D14D08AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514279, "uuid": "e67737b2-d343-47cb-a1ed-0b87a7be2f9e", "value": "3072:L9Q3f3exHuX3MIBv4OtDbf3YmMqQgfkCIW8aA56ZRIaA854hHMfp6ao1ayVptHya:bHuX3MjOtbtw68apWMKVpKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514279, "uuid": "4a55dce7-b785-42e6-94a4-faf1af122937", "value": 342136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514279, "uuid": "660f6ac8-e4cd-47f6-b258-4c4570698b8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514279, "uuid": "a7b9edaf-7438-4abf-8f71-f8761b235305", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c562ac5-44ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777570182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570182, "uuid": "76b18ef8-91e3-47ee-8cf5-838aaeae2744", "comment": "Malware payload (Mirai)", "value": "3518b647855ebbc15cfd233b0319274a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570182, "uuid": "679feaba-eb8b-4ac4-85f7-7b77d497c90d", "comment": "Malware payload (Mirai)", "value": "4fe5056753fb7e2d81aa7891e91092edefc2edd051deec61aabab3c3aeec5d4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570182, "uuid": "4695717b-562f-4935-9c13-3bc714b3c5c4", "comment": "Malware payload (Mirai)", "value": "756551769d7a769e037096d65fab9739689a1bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570182, "uuid": "e9e2e8ef-a359-4c3b-9e69-89bd362fadab", "comment": "Malware payload (Mirai)", "value": "64727e115cec4032650a4f0920ccec34774d15d23eb6b7d391499df7ec4c75aed9d452862be6d4cb31da328d249d99d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570182, "uuid": "32379adc-7d02-44a8-a415-6dd0d3a0812e", "value": "T12F831856F9829B01C6C115BAFE1E528D33130B7CE3EE73169E24AF24678756B0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570182, "uuid": "c7fe4898-23ed-48b9-bdba-ae3b96fa317c", "value": "1536:jwnCtWbcLPytiQmAavHvuPEwg2MYiK+zXDyNfH+Pc7/lJY5vhYWpZ:TUtiQmAa/G4bDyNfH+PcRJYHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570182, "uuid": "0c1d6796-52a4-46eb-b377-045ea8b181b2", "value": 87520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570182, "uuid": "c3f4feff-fccc-42b2-80b1-da34b97ef8b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570182, "uuid": "48d0fd82-e117-498b-b4ee-e8b9509a2128", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f80d7c-4479-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777542254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777542254, "uuid": "b6da5539-a314-4387-aeb6-205dfbdc2b94", "comment": "Malware payload (AgentTesla)", "value": "bd852bd8a0b15a529c9a2772ded4e5cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777542254, "uuid": "572a878a-a523-4b66-9486-9f3901f70f2e", "comment": "Malware payload (AgentTesla)", "value": "51733c13babc03c16e73f60b3ec3dea216f533956998f1f25bfc838124b47b63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777542254, "uuid": "3f743302-94e4-4b35-b0dd-ae8f8a504029", "comment": "Malware payload (AgentTesla)", "value": "121b6810260616b62693660b5d774649c00ded78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777542254, "uuid": "99782c87-afd1-4b9d-a451-4e716d8234d0", "comment": "Malware payload (AgentTesla)", "value": "16aa7fde69ab6077114f92ccb1cee5aa3c025de536fd828474c3808cb6f50e4e6eb3589b053d2aacdf49ce3b8503618a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777542254, "uuid": "02969b77-cde8-47ad-a68a-ca456e27ae68", "value": "T161744A60D92402774F87AB9DBCB50761CAADD319863705B4F6D98B0D910ACECF3BD226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777542254, "uuid": "d2c78fbc-7e88-4254-bb1b-da1fdc1cf113", "value": "6144:shhVMHQ08HKDjrsHU2VHe2QPQkZzLqH7xaax7H/ELH8QSkeq3U6q6XKsIrKMtTZq:ehVMHV8AsHP/FEE7xhx72cQSkf3c6XKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777542254, "uuid": "0a0b7d5d-f132-481e-be62-fb83fd4b5a32", "value": 366324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777542254, "uuid": "cc71dccd-4acb-4af9-b219-06047ad73e42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777542254, "uuid": "f163dea9-1dcb-4e92-9529-acf20e0a9ef7", "value": "IMG20260430-00692.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d212f10e-44ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777593223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593223, "uuid": "a66292bc-34c0-4026-988a-05fa1361da07", "comment": "Malware payload", "value": "e7ee82c96ae08c25bd9424bb3ec6e593", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593223, "uuid": "372f8776-1f45-4d99-bcc4-f230c4729751", "comment": "Malware payload", "value": "52f07fd44617b333a68014d6cf5306207a0688d8e5c653adc63249badbf8e7b0", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593223, "uuid": "a0eaa8a3-ff56-4ed6-9e71-dc9d55b35e5f", "comment": "Malware payload", "value": "a5af3e6cf5589c5f1fc04bd79bd2e322fb6923f1", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593223, "uuid": "3125ff7f-025f-4a7a-9256-2c0a88d54d4d", "comment": "Malware payload", "value": "05899970c8b7c696e622be11bf5bc9935786c80b411744ed3237cace648189a95367d9242f1bd19439daef41b756e4cd", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593223, "uuid": "e93d1604-a78e-4f86-b39f-e6ed1df7355b", "value": "T16B343A03E19545F8D85AC27D836A9623E671BC494770F6DF47D84B222E23BD0BB2DB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593223, "uuid": "4fddd3ca-86c6-4c14-b786-979701e6cc81", "value": "b831aa37f772944395d882fdbb5a825b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593223, "uuid": "f6490e9b-bbf3-4e5e-b038-01d0d9471436", "value": "6144:ypX97KpbIc1n26Za5Ewe/MPBV3/Ibizm7sN+pu:yv7UbIc1ndZa5leC/Ibiy7GY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777593223, "uuid": "8e6bc422-8a3d-422b-85c7-e45830f1f6cb", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777593223, "uuid": "2eef4341-a82f-4012-98da-f2781bedad17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593223, "uuid": "638e3bcf-9921-4794-88ae-f12650f6efdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed6b474-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514271, "uuid": "199cc6c2-495f-42f1-91af-08c0d09de9d0", "comment": "Malware payload (Mirai)", "value": "e2c16b2b4652e86f38427fd947bf4c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514271, "uuid": "2636f02f-3f10-4ac1-a4d8-04165b69473c", "comment": "Malware payload (Mirai)", "value": "53ce494336ade6fb34f1fef2a7099cf981a6b52351353c9b9f41f15d2c5c10ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514271, "uuid": "665ea842-dcbb-4435-9ed8-ded382936b66", "comment": "Malware payload (Mirai)", "value": "8416fab77d7c76ee0e11f2a6ba000fd72b6bb955", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514271, "uuid": "0175f8e9-3102-472b-82c8-895976178e14", "comment": "Malware payload (Mirai)", "value": "9722d9c30c23e5644015348640b8c78701f38b58b37f3d17c2590b0eb6b6b4e21f12375d9acf45b874e25d47110a8b11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514271, "uuid": "414de48e-8748-4269-ac5a-42b7bf5a53c7", "value": "T138E31945FC459B16CAC662BBFF4E428D772B1768D2EE31039D256F24378B86A0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514271, "uuid": "b5776701-0d27-4185-a35b-df81ee0427bf", "value": "3072:w3hkSSpPBPjmM3axFvGl0j5RIof4RgUlPVI8wJLUG5QTk:qkSSpPxmM3asQf5f4mUlNIrdUGuTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514271, "uuid": "0e492b8a-d2be-455b-9f68-ee3fee420254", "value": 151128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514271, "uuid": "f00af557-5ee4-4334-83e4-29e5bc8ba589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514271, "uuid": "54de6780-3495-473f-b434-5cf519e8e2ba", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47c95c0-448c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777550653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550653, "uuid": "befa3466-2f5c-4674-a60f-ba127e5b7fe3", "comment": "Malware payload (Mirai)", "value": "56cbb782f3dc0cb5f8e8dd286cd30a36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550653, "uuid": "298d7fdf-a791-40e8-bfa9-e94bac8eb6f6", "comment": "Malware payload (Mirai)", "value": "53d40ea810c6a21f9518af827cf9ce803df40dfca6f85f5686b0fe285d11033d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550653, "uuid": "fc3c1a2a-bac4-47e0-ac23-b646b4d062af", "comment": "Malware payload (Mirai)", "value": "48489cff18c1c3b08e74fa796808be0a2f429846", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550653, "uuid": "0b011c2d-7191-4e8b-8048-d1a971d3367d", "comment": "Malware payload (Mirai)", "value": "d4c05a7b63950c5a4781e6606fec34b0ec48c3a1e626d547e39e43e3adfa4437b684192cac9e78cc78c700759a732782", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550653, "uuid": "acd24c4a-9df7-4e67-97e8-b395d497f533", "value": "T1F0B3B51A7E21DFBBF169827047F38B30569976D62AE18585F25CE7081E302CE681F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550653, "uuid": "fafe82b6-2a5b-4c84-8759-471fd7ce6eaf", "value": "1536:yhB78ofTbNyyf0IIewQNupshuwOHni2ver9f:W8ofPcyM5pWudEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550653, "uuid": "44e3f263-c0ab-4c56-ac4a-86926c26d478", "value": 112620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550653, "uuid": "f122b149-754e-4887-b618-4073f2ec0249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550653, "uuid": "210fd31d-0fa4-41ef-a8a9-a280766e1be2", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b67e3b4-442e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777510024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777510024, "uuid": "8a68628a-8860-4d32-94c4-e2eae36b94cc", "comment": "Malware payload", "value": "a911f4449d5b4f85836b41e20782d6a8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777510024, "uuid": "b3bd7730-53e3-4d27-ba61-c2db744cc1b4", "comment": "Malware payload", "value": "547fe8413d63c24bfa7fc22ae22206105388e7306db389bcbba5e1296043f1bb", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777510024, "uuid": "8d493bfe-421f-4afb-97c4-1c8d9043b512", "comment": "Malware payload", "value": "596a0ab59ba652a643e2bed54f31b241b5467ef6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777510024, "uuid": "448f5161-1feb-4a46-8083-914b26bf3560", "comment": "Malware payload", "value": "154341694d8d7b0e99177074fd4e68e3a072c2a11bff290065c715e11b84d16b0bdea986983d523c0d5c06b899bc2e8f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777510024, "uuid": "81884209-68eb-4053-b020-e2e1dc8bbd8b", "value": "T1E831E1141BA10324EAF78B36E8FA7312A5217D17EB219F4F12D4429844B0521E466F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777510024, "uuid": "044253e4-e045-49f5-82dd-15c0782b2718", "value": "24:8lmpdmGjMDvSwjKUaWU3AcPWkp+/CWAptSejFLHau4wZ5r4I0WK6c/6Cab7Oa7m:80meKpUQoTd4w3UIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777510024, "uuid": "a83893c4-853e-4083-8709-1164836d9825", "value": 1839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777510024, "uuid": "a3a5d119-7a7a-4c46-87f8-5f776def8c7b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777510024, "uuid": "351bf454-f29d-4f87-84b0-a9b37b4b1a7d", "value": "IMG-291597034.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f195093-445e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777530700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530700, "uuid": "11808311-23f8-400b-b581-ea31a9214cf9", "comment": "Malware payload", "value": "cb76ea090edd179cd267bce8b61bbac3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530700, "uuid": "9531f9a0-b0d0-4708-a48f-5f45654c0c9a", "comment": "Malware payload", "value": "56f20eb55157542bea57a48de7469515d7525721014d78efa1126b1c8e10e843", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530700, "uuid": "c1430ca7-cad1-43ea-a50c-536133e9dda4", "comment": "Malware payload", "value": "02a6941b5b9abce662bef0a1fbf001fd9aa57cbc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530700, "uuid": "966446de-8c44-4641-9f4f-410e4e36cea8", "comment": "Malware payload", "value": "966f3884b9cdb2407ae16687b9eb6fa7225c5d60475991cdf382402d102a417b46002e3e701be2fd9782908bee41e4b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530700, "uuid": "5f94c3d7-925e-45ab-93e3-94480463dbce", "value": "T1CA940038AAFA1019B1B3DF54BEF47492D86FBB632B0E985D1081034E4632D45EDA573E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530700, "uuid": "916fd6f9-9d41-4a4a-92b4-3138e0c35fa5", "value": "12288:HG/ozsxZxLbeuFER80DHX6pMZsDn2BvLg6IB:73K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777530700, "uuid": "c8670008-540f-4bbe-9368-8e30688567b5", "value": 441964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777530700, "uuid": "ab456f31-00f0-43e2-ab83-8b3931c1d204", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530700, "uuid": "00e782e4-0af1-4899-b0e2-9159d63d87fa", "value": "Purchase order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457d842d-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535435, "uuid": "b51674c4-4a61-423f-881c-5b535bc008ac", "comment": "Malware payload (XWorm)", "value": "29a69a13eb33c08afd76662b1bc49d16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535435, "uuid": "1e54f5d2-6ee4-4da5-8a1f-b980968045cc", "comment": "Malware payload (XWorm)", "value": "57158279225d0bb1ded6bc01e44574be9b88881848d5cc83e1bfafc839b9e5f2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535435, "uuid": "6184e480-2dda-4f8a-b8bb-807be54dd43c", "comment": "Malware payload (XWorm)", "value": "243e303c16fe94daf5ca4ed7902c8ea99b841748", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535435, "uuid": "528518b1-4702-486d-86e1-9d31eb243c42", "comment": "Malware payload (XWorm)", "value": "3aeb77c7a329fdb01b0f35397e8de3ec2c4849ac0f78703293e19ae6d89a4a222461616477954a139a2c5f4773b4b622", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535435, "uuid": "a9f0ed55-5d19-4638-8d90-8f86c454512c", "value": "T18137238AE068CE8ED2FC156E957D0E4F539859020011E72F07E3E96E964EEB537270DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535435, "uuid": "d731b05c-8b60-4728-9681-720f1e691733", "value": "49152:c5cicTpn5cicTpW5cicTp95cicTp55cicTpu5cicTps5cicTp75cicTpr5cicTpt:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535435, "uuid": "3462b98e-7a7a-4977-b3be-94d4f38262ec", "value": 23944473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535435, "uuid": "a03aa0ea-ea54-49a7-b9d1-d67478efda80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535435, "uuid": "cbc4194a-1cdd-460b-a752-b0e66cb65231", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4ff9fc-44ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777564840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564840, "uuid": "43b0b506-e33b-48b1-a4c5-101dd0d59a39", "comment": "Malware payload", "value": "697fb4d4e828815dc2841225b33511ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564840, "uuid": "b4b50e41-6912-42b9-9562-fb025eb28fbd", "comment": "Malware payload", "value": "578bd0c6f467141c34e4cfa0f60319349c4bdd456c87649b2d64bf658e510ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564840, "uuid": "099317c4-b1e8-4984-86ba-8a19a08e56da", "comment": "Malware payload", "value": "2aa5a2d39053e58f426b75eb6703475256866f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564840, "uuid": "e2128394-5761-408a-97d7-e5dbb8fa7c68", "comment": "Malware payload", "value": "2251a55da550304cdc85108aea13fd62c4027d10cbb1027e60d0893ebd372065dae20e32c1e7c8b0d35d71b78c2bb002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564840, "uuid": "4bf148bb-2130-4868-adec-07faa9367a7d", "value": "T16B77AE49B1A51198D06BC074896B9607FBB13C1903789BFB52D18AF92F37BD07D3AB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564840, "uuid": "abf6e203-7329-4a4b-98f9-66e5c393a08a", "value": "8c5f1f9389a235433c006d720d2bab8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564840, "uuid": "1ded32f7-0ffc-4c24-bd49-ca1811af243a", "value": "393216:jmEYNYXEL5qEkdPijFJQGc3hJlSLiAUp9JWte/d55+eh00l2i8Ayh5j6:KQB3fQuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777564840, "uuid": "9e07ba4e-5a57-4f9b-9711-5369e47fa1b2", "value": 33799169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777564840, "uuid": "6d17169c-4864-4da5-b05a-1b8a47b72c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564840, "uuid": "ea5da9f6-7f62-43cd-bff5-b28ada85cc32", "value": "\u6587\u672c\u6587\u6863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dbff81-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538361, "uuid": "18714d6a-4470-411b-b087-d3f6c5749bf3", "comment": "Malware payload (XWorm)", "value": "be1d9b81aa7a47eee0dd83b2e4284386", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538361, "uuid": "d17030f0-3fca-4dc3-9762-47a800b5e25e", "comment": "Malware payload (XWorm)", "value": "587cf6720165dcc34ee875e16003210a79d38c67ffe06124dd18532b93bf609c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538361, "uuid": "6066809a-4525-4cbc-983d-ac522cfb9fdd", "comment": "Malware payload (XWorm)", "value": "0190a27478b748240e41ab688b00e9c38464f882", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538361, "uuid": "b1a7cc9f-9a94-4e62-b0f4-eccc5cb7fbb2", "comment": "Malware payload (XWorm)", "value": "18d1303b52d411093d2a534dab75a5a329b1c3aa0cfee8fe376e472eb40fa08e4b765ba15d525e908466298cadf8eeb4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538361, "uuid": "1e39449a-3e48-42ec-96c1-0de485f9ff19", "value": "T1EC37230919DE4F3E41AA726A50AE3FE70FE49E5D0426F46C32F76D3871CE672420E691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538361, "uuid": "60837ddc-28a9-4b00-984b-ee4ad90438fb", "value": "49152:FEiHKEiHpEiHwEiHWEiHZEiHzEiH2EiHWEiHWEiHMEiHwEiHmSj2fEiHwEiHZEi/:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538361, "uuid": "3ce54fed-adfa-4583-b38a-4d8d78272e63", "value": 23164076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538361, "uuid": "d3ab0158-11e4-4c03-82e5-f79ac83694f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538361, "uuid": "28dc2097-641e-419c-9ba5-1695837411be", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6112bdc7-44a6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777561680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561680, "uuid": "00a6e398-fc07-4e44-a8f3-9188ada39722", "comment": "Malware payload (AsyncRAT)", "value": "8fc181879714772b46c598044dd14a7d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561680, "uuid": "1b3a202d-d311-48f5-b020-ae2cc5eaa417", "comment": "Malware payload (AsyncRAT)", "value": "5931a2cd7ae5b25d1b623db3fc557d4e837cc21aef639773192bb9f05fa687d1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561680, "uuid": "a2a4c74c-3089-42e7-8b37-32d3c3760683", "comment": "Malware payload (AsyncRAT)", "value": "e882a09df6a1e92030cfbf89393e7cca1ea38c1d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777561680, "uuid": "5dbdfa1f-1daf-4d07-aacc-21333a3dcb87", "comment": "Malware payload (AsyncRAT)", "value": "45fa9a1a84a0ae221f72e0441229d0e7b2ef5a44163e4353ff5764d7f5b0d7093116b409c50ae73ace46c6357ad880c9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561680, "uuid": "7b66a339-74d9-4195-955f-e484f99dac37", "value": "T1F6738D187BE1412AE4FFABB40CE53222D735F7639803C66F24D9059F2A27A89CD416F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561680, "uuid": "8c1ad276-2e8a-4a83-bdf5-072100af49a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561680, "uuid": "03a748d4-d170-4bf8-807a-d83e880577de", "value": "1536:GjdS2M8l3XBkZObjhTQ83mS6+K1O7U1D:GjFx3XBFbjtQN1O7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777561680, "uuid": "30f3e106-c9ec-404c-9706-b0da0380994a", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777561680, "uuid": "6fb811b1-0e4c-47d8-8c55-011e4488d599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777561680, "uuid": "c0a3e38b-dcc4-4539-ba3e-a28e033999cf", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396b9871-44bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777570633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570633, "uuid": "e88c3a9e-3450-4fd9-b696-662a357d4e8c", "comment": "Malware payload", "value": "0c7a825ebc3df603e091e5b0ed97958d", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570633, "uuid": "01d973e3-904b-437f-86ba-33eac6784687", "comment": "Malware payload", "value": "5947ef13154feabb23f39ce29e68e68ad607347e1650f9b8b9fb10163f1e4fa4", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570633, "uuid": "ea93629d-c361-4b0c-a762-076df50a8fba", "comment": "Malware payload", "value": "26e035adbbbfde0eb6c20d5993fbd81af786e481", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570633, "uuid": "d3e91486-4356-4a2b-afb3-8bbfb0d4a910", "comment": "Malware payload", "value": "e5c50f28ddb6ec1d77c5a811fed4c23d67751fc3c262ca31df4fbed9b83e0f061acb490545775e537604087d5af1a2c1", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570633, "uuid": "0ee613f2-cac3-4f16-9f85-01f5ef6bcbf5", "value": "T1D8B27EA7C3D9E2B101F35E569821D9D8DB3CFAF75DCE558E9302A2223E51A28EC52470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570633, "uuid": "26cae14a-6a3d-4798-af82-0b8431b62f7a", "value": "384:uIsgqpdgh+ETRpch2fKA0rMIAgZjDzag6zcJ2IMSgi+p2NGFclWM1c5hrtHRk:uIsgqpdknTvClAIZjfag6YrMSyp2NGyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570633, "uuid": "56343589-f8da-4388-966a-03a320caa9a2", "value": 23384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570633, "uuid": "9caac1eb-8bf9-4665-aa8c-bb1267d68dc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570633, "uuid": "3d7d052c-4deb-4efb-acf0-321d03c67813", "value": "evugu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e5a32f-44a4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777560917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560917, "uuid": "95f8f20c-af25-4136-a98b-23f7669e0b2e", "comment": "Malware payload (AgentTesla)", "value": "23d84b0d6338ae1ec16898dea6192aff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560917, "uuid": "9f8d3312-1d66-43ce-8cef-318f9da59e5b", "comment": "Malware payload (AgentTesla)", "value": "59830d1c568bd43c1c582b36981bc0ef423116c144c33fad51e1e66bb0cb368a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560917, "uuid": "4874d5e0-d2bb-4135-b25a-a8315066e8af", "comment": "Malware payload (AgentTesla)", "value": "2ca5c96e8264b8731b632cc0c2d84d2a2fa442b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560917, "uuid": "ce4f3ae9-4912-4ced-843f-00fefcbed93e", "comment": "Malware payload (AgentTesla)", "value": "2de41d39a4a52e7b4a01c011da03689b6951cf6bf8eb499788c7835c2e373c9a75f68c6a1aa1b7900e9dd1c39a2012a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560917, "uuid": "7430e9cb-44dc-49de-8de2-28855f629435", "value": "T144E3022771D9845E04F04D05A7297A2EBB59CAEB5389F3C9128ED1ED000CD2FD6A7BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560917, "uuid": "0da2976a-0883-4606-929e-d28b8acedb00", "value": "3072:PR06F5mK1BzwpG8gj50/Pu7axWZgOiqez3VYCtK0Mfy:NUK1NwM8g50C5Flez37x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777560917, "uuid": "71c82364-e7e5-4f9d-85b7-7928d745f1d3", "value": 150189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777560917, "uuid": "1433dcf5-de12-40a8-86fa-5d5f86210cbe", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560917, "uuid": "7a294bbf-7511-44e5-8d8e-3b0db56723a0", "value": "Quotation. RFQ # 28042026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da45c6a5-4493-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777553723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553723, "uuid": "60d80049-ec00-4483-b6d4-483629d2eeb2", "comment": "Malware payload (Phorpiex)", "value": "d46878effa57ee0ebdec21a7d9fe0ee0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553723, "uuid": "af4ef8f8-ded8-456d-b99e-be3847652b92", "comment": "Malware payload (Phorpiex)", "value": "59940d25d8eec9d295418098597c95999cfac29428f4deb72ee91a7853dba072", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553723, "uuid": "e1c06d3c-8e8f-4a41-a6de-6af18276d4b6", "comment": "Malware payload (Phorpiex)", "value": "3c5bf35654ac835e64be3fa4013912190cee5d9d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553723, "uuid": "e973ae7b-91cf-4900-bdb0-0cb9ee638220", "comment": "Malware payload (Phorpiex)", "value": "689eda1de3a7c3e6e1bfaeae064ab8c53a1e27de820b352245a0e1a6c5faf068338db6daa074e553e1a9447f41d56ad2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553723, "uuid": "213cb24a-3ef3-43c9-9b7a-75f5ef7b82a0", "value": "T14C2209197E4A4332D3A089F454798347953D6533E783E3EBF373969E4A963448840EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553723, "uuid": "acf6d6d7-e121-4eaa-93ff-5095b3826a70", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553723, "uuid": "f85def10-f56a-4ffb-9eea-76df2b9a4b32", "value": "96:g4dVomYz/J4hnxCBzB2dyqFHDL1x+ZQ/71pTowWG15PFJxGE9mZ2FFhxC7tCEmoe:gmoVOcBzB+Fx+e/RB5PFJxTEZmFhSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777553723, "uuid": "dd4c3133-ad2b-4e89-9b95-b537bdb78da3", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777553723, "uuid": "67a5598e-0dd9-4026-a2e4-807e5c83a4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553723, "uuid": "f43a703a-f4ec-4ab1-a211-ff117172ebe6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03218f81-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514278, "uuid": "c3b66284-f9e2-4c1d-a377-7aa96f1d6051", "comment": "Malware payload (Mirai)", "value": "318dd8108c3d553b99116a1a4c8ff74e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514278, "uuid": "9f7423ff-789b-42e0-89c8-34aba2002660", "comment": "Malware payload (Mirai)", "value": "59ec7afaa88a4d41d09d9ee400bbee8d4227be755c3f72c5a37d009f10d90541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514278, "uuid": "62c8747f-c71d-4552-ba1b-d76463101d8d", "comment": "Malware payload (Mirai)", "value": "dea221d4b5a48dbb2c423bf686f42fe0d70562a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514278, "uuid": "db319786-b087-4946-bc49-f3a97bee0146", "comment": "Malware payload (Mirai)", "value": "b6d17bbf07bdec0ff4c764a480a4a6fe30fc7bf06a1f53680cca2b2d6cd3875bd92d501bb540fdbbe5d9bbd35b17d5a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514278, "uuid": "853f654a-19d4-48ee-8702-8bb3b134f58e", "value": "T1C324F947B991CF12C1C111FEFE5E418D37136FB8D2EA72029D246FA477868EA0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514278, "uuid": "e9c96ebd-40a0-4536-9f63-03b4c089fd51", "value": "6144:0lo84GbDpMuI7glVJvqa3k/ZifHeSVI0PfjCy/:0t4eMuIUlbqa3x/eS+03jC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514278, "uuid": "5ac8e094-6811-4433-a88a-8e2a2d4cb164", "value": 221948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514278, "uuid": "2939c44e-078e-43fb-a994-0bb590bfd02d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514278, "uuid": "2cda1c18-2679-44a1-afdf-a96aa6d32835", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8926bf4b-4499-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777556164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777556164, "uuid": "c32511c6-ae9a-4f4f-aa8b-0f2d9cf12a2b", "comment": "Malware payload", "value": "aeebe957e56fa21a1df4d4deb7680e05", "object_relation": "md5", "Tag": [ { "name": "m4-sedafil-com", "colour": "#97860A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777556164, "uuid": "3ff61ed5-76e0-4b00-a4b1-063875f42dc9", "comment": "Malware payload", "value": "5a056f1dca0e51a6b797f3a6a6d01f35448de94c490643c2e2c429b348f667e7", "object_relation": "sha256", "Tag": [ { "name": "m4-sedafil-com", "colour": "#97860A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777556164, "uuid": "f88fd54a-5a70-4621-adfb-a2bcc94a396e", "comment": "Malware payload", "value": "fa9cf7bea38714fd9637c76938c7385efacf67f1", "object_relation": "sha1", "Tag": [ { "name": "m4-sedafil-com", "colour": "#97860A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777556164, "uuid": "c2501175-d7b5-4212-8c2e-026e46f9683e", "comment": "Malware payload", "value": "1e4b35c1b1db6ab5aa16c99f517df84b022953f8998ddffaef4ba1a83e3304a93a084735d1a025c965ea247dd96e5836", "object_relation": "sha3-384", "Tag": [ { "name": "m4-sedafil-com", "colour": "#97860A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777556164, "uuid": "c4787324-8b48-48b8-ba69-608e489c8f8a", "value": "T153516DA31195D549EF6F96BD1985D504F0B07DA80CB6344230B007724C1C0EA8FDCD2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777556164, "uuid": "cef1257d-0273-4a70-97be-858bae88eb5c", "value": "48:92gXC3TNHhYSg+Ugl7/nHDv7FrqeBhX+mCNVXP9giSSWk3q4o7JeWG+TEXD6/mfa:dS3TN/g+Jp/nz8vmC7lgl2W1vQ+jT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777556164, "uuid": "ef7361fc-e9bf-411c-a7ed-9dfde18ef8ab", "value": 3164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777556164, "uuid": "4722dfe7-fae6-4843-bb21-3d52e05b4ac8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777556164, "uuid": "52628b65-29fc-447c-8e0c-b013469fa7eb", "value": "585513465259688342.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8142742-44d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581181, "uuid": "ced2daba-3d99-45c5-9bbd-dec02a759d8c", "comment": "Malware payload", "value": "be4871a7072adb5337cb746970444885", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581181, "uuid": "bfb8cebf-dc26-4fbe-ad75-76e9d1595356", "comment": "Malware payload", "value": "5a3293b2caf76c077a896bbc2587e5f96915c0ab5865b9d0a4f6b5430b2d812a", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581181, "uuid": "27b9b4e0-e2bd-4a10-ba37-e8dc2bc85966", "comment": "Malware payload", "value": "c1351a38d7c6560bfa3ec64dcfc975bbd7720887", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581181, "uuid": "5686f9b3-c232-44b2-b9f1-8c6c4ffa14ad", "comment": "Malware payload", "value": "13416fde6610b1e3281b35d6f86cb8314ab1c66fe428909404229460c88e8d4212e3c2749ebdc3d07695544e2ea98c20", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581181, "uuid": "83ba2e56-7e36-4940-9fba-aabaa52ff9ef", "value": "T1C0039E736206FFB89F990633E1C805AE503819981DE8DE2CC7D69D30429ED699E1F6F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581181, "uuid": "1e9650c2-e4b2-44ac-b682-570a8cd2f946", "value": "768:AXxSptegsqZkK7+6HXoZnkkIowJXQqgzVnbhxmEvUxeVvkeKoBdddva/ZFmxVSx:A3wjR3otkswJXhgx1kEkqnddva/ZFmxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581181, "uuid": "c228b868-5b29-4009-aa26-18572d3f6cea", "value": 41091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581181, "uuid": "ded8743f-89fe-4cc0-b0ac-44966bf025f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581181, "uuid": "36688b38-86f7-4936-86d3-361264e50b42", "value": "efeza.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c0f609-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538529, "uuid": "c149cc6a-098d-4141-9d3d-65ce4b58d7fe", "comment": "Malware payload (XWorm)", "value": "7438edf4423721e7c3b1f76b00d6b7c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538529, "uuid": "521d8bef-d615-4dc9-b7e5-e4f4bb741bda", "comment": "Malware payload (XWorm)", "value": "5a6fcf06e1d473a4471418441069867b658bfc37b386f1723f4f41d025ea416e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538529, "uuid": "47255223-2062-4e91-ae4e-5254e27cad97", "comment": "Malware payload (XWorm)", "value": "6e16075ef23ca66290caf93c929fd9a1b3efdad9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538529, "uuid": "53afda73-5835-4a58-9797-2fe525c6abbd", "comment": "Malware payload (XWorm)", "value": "c5bdf22610f1169c7b55d1defe154e7a215c37ebd0cff2988065c13d2800ba2fb70d1298d82c52f045f496caa2a32e0a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538529, "uuid": "6e9f458e-4e7c-4e88-97f0-968b544676f3", "value": "T19D372365456F497E24D994BE16FA0FAF73BA0C83634598FF30F5A878261DE10222E0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538529, "uuid": "bcaecea4-11af-4b9c-926f-49a28a0cbad3", "value": "49152:oZ3Rua8CZ3Rua8lZ3Rua8tZ3Rua88Z3Rua86Z3Rua8QZ3Rua8FZ3Rua8YZ3Rua8I:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538529, "uuid": "43a7ba78-fea9-4bef-b9a0-37dff103e9be", "value": 23164077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538529, "uuid": "10fe9052-a749-4055-9b2b-82f81c1a806d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538529, "uuid": "cd60154c-caa3-48cb-b4ab-4ac50a41f920", "value": "invoice-1645080830.pdf (55).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88ed29b-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535279, "uuid": "62cccad8-4878-4fe5-beb7-5332877bc402", "comment": "Malware payload (XWorm)", "value": "23577bff1b6d47984cee4684acd6b281", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535279, "uuid": "be598e69-5735-44b1-81fb-d3e4336ac94e", "comment": "Malware payload (XWorm)", "value": "5ae2da63fcaf002c7f2a29b6d0f0ae10a9fba7f1d702667918d8d313875573f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535279, "uuid": "827f6251-dd91-4de0-9dd8-b24ce97b798e", "comment": "Malware payload (XWorm)", "value": "de9985057cc5d5acdbd4089f642aed06ecb38a66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535279, "uuid": "35583b3c-e4ab-4970-b25a-586961d3cfe2", "comment": "Malware payload (XWorm)", "value": "2ba6c5a1d76c2ce684b17cd079ed9eb8e1000658a8ce2ddcda04c626dfeb0ed75cd4aaf6c1e4d00f2a02fbbe89912058", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535279, "uuid": "64141de0-6e97-446d-9d93-acc12c444f99", "value": "T103372335DF1F5DEA48ADB50820FE594383BD8E0409D4868EB7ED304A0ADC339BAA75D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535279, "uuid": "ccfc35b8-205d-4ce6-bbad-e17c2ad8d5b8", "value": "49152:xO1tBxPO1tBxEO1tBxoO1tBxaO1tBx1O1tBxnO1tBxfO1tBxZO1tBxGO1tBxJO14:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535279, "uuid": "d8dc0b20-7662-4512-9601-e542fe10f42a", "value": 22903938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535279, "uuid": "220b81cb-ee7d-4256-9e94-436aa2f04b66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535279, "uuid": "76579fa7-c3b2-4f77-9087-97ef95d37ef2", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee1c9c5-44a4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777560979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560979, "uuid": "57d39b37-9614-45e5-8aa4-02af6d058899", "comment": "Malware payload (AgentTesla)", "value": "4ca38cfd6b61751f7e7575689cad9665", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560979, "uuid": "4b177151-bb8e-46ed-85fe-6ba87613f5da", "comment": "Malware payload (AgentTesla)", "value": "5c42ae22ed7aede2cac460e89d55cc99c73e1a8d6b9cccdc8151c236715d22af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560979, "uuid": "309f4152-5005-4f2c-918b-9b9534c23281", "comment": "Malware payload (AgentTesla)", "value": "00639e20c0ac8af8152ef380f93eb91a89ab8c20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560979, "uuid": "49e80aad-c029-438c-a4d7-bb6fe2027c58", "comment": "Malware payload (AgentTesla)", "value": "3d6afeda27d69f5f168b6e6887adf455756a40bffc8750bafdec26172b4e4c9227e5d20e623b32d555ba28a2661ba399", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560979, "uuid": "974e0fe2-2c07-4c80-bdaf-b69736c5589b", "value": "T13265020159C43FA8CFAE5719A0FE165EE3A10ACE34555D8EEB33BD46BFA760091071B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560979, "uuid": "154c2884-3231-49b0-8036-78b196b8b124", "value": "24576:FDygRp+yktKtIhzqNPVelbcXVgUFjfRyQJmWqq61my:5QpyPl62j7lK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777560979, "uuid": "7a5c72cb-02a3-4d33-ab56-e507810b1541", "value": 1482960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777560979, "uuid": "e1e8770c-fdac-44fb-867e-9a8dde5056aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560979, "uuid": "88999f2c-38ea-401e-86ca-20f5717d1f40", "value": "Bank slip.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42493fcd-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514814, "uuid": "70a06a88-5d90-4329-b97d-65422aae1378", "comment": "Malware payload (Mirai)", "value": "36bb2bc0b3bc9185fef7ce8b9aad3cc8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514814, "uuid": "760617c1-e9eb-437a-a456-601b40f07452", "comment": "Malware payload (Mirai)", "value": "5cbf9e3247217621a43293c10dff51b055dd2f3ddd371010d3be8364ce91978c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514814, "uuid": "f255b14d-0573-4737-80fd-f22122f19813", "comment": "Malware payload (Mirai)", "value": "71f981f7c6116943e058255393f408a08581c4b3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514814, "uuid": "5419ac2a-7e4d-41cf-937d-ea9e71ed14d6", "comment": "Malware payload (Mirai)", "value": "7c91ccbd2f6a3883bf63449236896fc49d781164625ac488d9967f49897a699f1e320d79fccd89ae3db6cbf82865025c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514814, "uuid": "33448514-d1d7-436f-9a46-b8f64baa31b5", "value": "T15604392F258192F0F6411B746BCFD3976C390BBF41A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514814, "uuid": "79df356d-d6d8-4b25-9d41-f8682658454c", "value": "3072:7mflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wMUX9:7IJ5k1DVA2nDXNgEJi5a9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514814, "uuid": "b0fa3e30-e270-4c20-8770-72466c4f2291", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514814, "uuid": "2e9e4e6e-7ad7-4bd9-a439-14ed17038e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514814, "uuid": "79678a3a-9d92-4670-a869-614799c83fb4", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c0cbba-4452-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777525636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777525636, "uuid": "3695910f-7985-4ee8-962e-9577cc9a669e", "comment": "Malware payload", "value": "ec6ea512aef4425512c56c2dc2359a06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777525636, "uuid": "82f31b90-f99e-427c-bddc-e12058d5f929", "comment": "Malware payload", "value": "5cd8b8a42efb28dd0cc89c41486d3720292014a5588b3d4a52416f22b511336a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777525636, "uuid": "62c2bc50-41ea-4e14-b5fe-3de22e6ff2f7", "comment": "Malware payload", "value": "3eb54422061e16e99966a3a610f29750514389c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777525636, "uuid": "d81be411-5972-4674-9a69-d40c1a33072b", "comment": "Malware payload", "value": "1eb2f105ac55e31e17c86858abb4daff3c5abae901da6cbef73f16688e1861d145776c5574e52bfbc177824e195adf4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777525636, "uuid": "f76c1729-a2af-4478-b65b-3e6553be1542", "value": "T11867CF7792067CE9E9B94DB4841015816D687C874B78A3C7BAC8B1F666FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777525636, "uuid": "421fedea-14b0-41cf-bd8b-845ec785d5c0", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQO:cqYUQuVDt0TZEAot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777525636, "uuid": "0ba02c79-0a38-4039-b445-9e0ea0402805", "value": 29949952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777525636, "uuid": "93cbab41-3e7a-4ed6-8134-f562f406069f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777525636, "uuid": "1ff3d170-4d56-4c3f-9d92-e3ca30ba6b4c", "value": "5cd8b8a42efb28dd0cc89c41486d3720292014a5588b3d4a52416f22b511336a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0511911-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535265, "uuid": "d2969bf3-3385-495e-8d3b-15ddd1638550", "comment": "Malware payload (XWorm)", "value": "d524d93430e6b733ead49b6927e2d0a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535265, "uuid": "6a5320e6-447d-4164-af06-fee06ed15ec7", "comment": "Malware payload (XWorm)", "value": "5ddfe5a0eb16f18a5a1cd0765aa7a8c9018161276f603f36752fdc76da0b6bac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535265, "uuid": "8d232ae7-956e-436a-beb2-0b526788f338", "comment": "Malware payload (XWorm)", "value": "730e13e1f34560591e5ea5f88230f66bf8054c1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535265, "uuid": "413be088-5c3b-4942-9594-2b15c6b979d3", "comment": "Malware payload (XWorm)", "value": "5dc4253d9f2041694cc60e639530fa122227235b65644843b2ca7f00cc958a1154b09b20cb6ac4707ec609ec053e99dc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535265, "uuid": "d48eef78-097d-463f-99a7-b062d00c1447", "value": "T164372383EE5E09654BBD32B1542F1D0F97BD5E898014BE936326EEDFD42EB7A204811C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535265, "uuid": "49710fff-321a-4f92-be9d-6200b026e13a", "value": "49152:YNJUBzaFYNJUBzaFANJUBzaFONJUBzaFmNJUBzaFrNJUBzaF1NJUBzaF4NJUBzaa:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535265, "uuid": "c9adabd6-69e6-4fb6-a958-3aa210005e5a", "value": 23164064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535265, "uuid": "572e3cfc-fe3c-4258-a625-d8da4a7e1c0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535265, "uuid": "4b2f24ac-44fc-4a10-b5d9-40da875e6872", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3879ada0-44c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777573638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573638, "uuid": "1ad963ff-06c4-41f7-8f2d-09d78f32680f", "comment": "Malware payload (Gafgyt)", "value": "020156948947410c6dae407adc75a184", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573638, "uuid": "87f2917d-e1d2-4d0a-a663-1478f87780fc", "comment": "Malware payload (Gafgyt)", "value": "5f88e407fdd788588d7a50bdeaebcbc2e2f3dc24a0c692b8c77e35ec1178b273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573638, "uuid": "349b8f80-8317-410b-9e1c-f4d254fc1f42", "comment": "Malware payload (Gafgyt)", "value": "e4df6b2cf4a02acae16222ee85e7153fb66f6469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573638, "uuid": "c39f44a6-7670-4926-9cef-36ce833072b9", "comment": "Malware payload (Gafgyt)", "value": "8cfd9890489d18206d6bddcd426ab6d100b3d10394f133b3361b3a5ce8a1987f9db95fe3424e28f3d5cdd009ac0b60f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573638, "uuid": "0f6d3b22-051d-49a0-a939-6863fd91464a", "value": "T1E1155A233B11CF64E315C23009F3CAA46AE525A21AF25499B27CD31C7E6162D6D5FEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573638, "uuid": "310e7249-aa83-4f29-884a-358abccc5bbd", "value": "12288:MJmfB4fjWdCI293U+vlGUPrrdmgtPb80lHS/ZJSWVM37L718prlTNZkmsN:rJ4fjWdCIR+fPdmoPHS/PZVM37LMJNZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777573638, "uuid": "bb6ae53e-b8c9-49d5-804f-00ec53d8d8d8", "value": 893960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777573638, "uuid": "8cad6eac-4d29-4bb1-ba36-30a244137df5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573638, "uuid": "585c5869-efc1-4e7a-97eb-4a01aa81630c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98531d47-448d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777551036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551036, "uuid": "a2ad249e-d355-4033-ab56-e45523cd8f4a", "comment": "Malware payload", "value": "13090bd5f236e4ad144b91d8b5cf3cfe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551036, "uuid": "c123974d-3e88-4938-a423-87404f2e5f3a", "comment": "Malware payload", "value": "5fc9f03724886a2853e50e43064718b149d1e7e14270c02783777ff1b2ae9b99", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551036, "uuid": "d4dcd5b6-3319-451c-9c47-ac4e7aaa3978", "comment": "Malware payload", "value": "f1a50ef39451c6778fdca4476f27a4959b67be96", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551036, "uuid": "1ac3423f-e1ad-4776-85c8-81131977e674", "comment": "Malware payload", "value": "1043237cd3ca2c3d75eccce78db1fa2860cf5f7c395aa0e30f10e507ff190a9f528ccc9033aa882b5279a818dc4cd20d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551036, "uuid": "cc733f83-87f9-4597-9fe3-09c89b4fc743", "value": "T126543B3029FA521DB1B3AF99AFE875D68D6FFB732B12545D1090034A0B23A41DDD273A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551036, "uuid": "83aa13eb-63e2-4ff3-ac14-d1e5c90e7e83", "value": "6144:fftBznvRabCzIDKXUd39TazlUBE0Fvq6V//eM1:rznZuC8DTN5azlyE0FvqA//eM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551036, "uuid": "3e90e278-f7b8-4406-bbae-8de01d5314ed", "value": 303602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551036, "uuid": "1d5bc04e-6039-4d99-b099-a371c7741749", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551036, "uuid": "c0b59b15-3660-4e75-bbfd-62f82e4f9a85", "value": "Sales Order & Invoice Confrimation PR 10007897590 - 0023-26-EL-Q.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5444019-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535596, "uuid": "64a8713d-f6a0-4d45-aa7f-bef14be235e7", "comment": "Malware payload (XWorm)", "value": "ca6c9574ebd6678af53b72f8fa6e5100", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535596, "uuid": "5bce3d66-4e86-4b47-a668-2b13f030f283", "comment": "Malware payload (XWorm)", "value": "5fd2b2392daad759a2a63b3fc5e3e7f429e7c90ce682fef906ae3127c6b4f64f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535596, "uuid": "ba0ec2cf-4a68-42a9-9415-ebbffe8ea1aa", "comment": "Malware payload (XWorm)", "value": "18fd7a8ed39d17cfcddfd6398f0a7f8fba982be0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535596, "uuid": "4077b55f-85f2-4780-82e5-d2dc88a455b0", "comment": "Malware payload (XWorm)", "value": "754dae129e3db9bd6f040dae75db20f4e82f18293ad89d45c4b23448dbe77fade166495848e9dd040a038fd958d6d5bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535596, "uuid": "583b6324-f9c4-4811-9b9c-2d0e95a8b89c", "value": "T15A372305E92F5BEFCE2C4DB250D78C9F1BD4DC0806C2DA95A4C1B8DBEA4EC11326699D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535596, "uuid": "1735aea3-e388-4341-8f87-cf6659390549", "value": "49152:P64Uh64UH64UM64Ur64UJ64UH64UO64Uo64Uq64UM64Uq64U/bSU64UT64Uk64Uq:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535596, "uuid": "91909baa-8b49-414f-8bec-0808d0612ab2", "value": 22903927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535596, "uuid": "80a14f67-660d-4b03-acc3-1b83ca3671c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535596, "uuid": "a6116a4b-c7a3-430c-8d9d-6a6f23ee8859", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d4ccbd-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777574231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574231, "uuid": "d90885c4-170e-4da8-b615-31fc607db150", "comment": "Malware payload", "value": "18508618690040348e28d5d5115ea849", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574231, "uuid": "7872d6b6-fbdb-4c9d-b384-e71e7b5dff01", "comment": "Malware payload", "value": "5fd45d6483c408eae95225b000021eb475fd7dabfb394c5b7e266e6898f2ac6c", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574231, "uuid": "9cd47eff-123e-4210-a61c-0b90926dc4de", "comment": "Malware payload", "value": "5d55e92b9fa89ced982bd25ea3c20f048d04374e", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574231, "uuid": "49eb26ac-e1a8-45ff-aa0d-6e099c5ecb49", "comment": "Malware payload", "value": "402082b29c626d5893e3678f8238f6f10c17385d33f3fed688b24e72cd6f02b1dbaeaa98f19811117bff691d98f04279", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574231, "uuid": "b39c01dc-a92b-460a-a110-6ea5592db62a", "value": "T1E5A26C4B8B035A9427E256D23C2E10D4B6A48CDB98D08ECFF35279563C5EE21EDB44B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574231, "uuid": "68d6e652-684a-40f4-bcc2-afa5ec426aa5", "value": "384:uIsRWSyALsMWjWJ/ocMb3Plox52oItmvcEvsZDzNl6EE/c6zv4wG5mS14XcOZ+jL:uIsR5yQsMWuONoxM7DzNlTUc0vjxdZoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574231, "uuid": "03963a1f-c39a-4d78-9620-1acd8e6d80e9", "value": 23324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574231, "uuid": "3e95a0a7-ade7-4946-abe6-1f35c8699d2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574231, "uuid": "a1eeb7ea-e217-4141-bc62-5a0ad5b7fad2", "value": "isasa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cd57c3-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514823, "uuid": "78db86d0-4576-4eff-84d6-3bc284ce76df", "comment": "Malware payload (Mirai)", "value": "a36fccce9d024050809b9cbf984e64a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514823, "uuid": "7a90f909-fb1c-4ae4-990e-cdf93f3daf3f", "comment": "Malware payload (Mirai)", "value": "60c5a0f9bec272dec051bbb0c5dfd9eb2b10ef4f54494dbea486c55ad5cbf63d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514823, "uuid": "6905607b-9daa-40f1-9097-b32dfb8ea863", "comment": "Malware payload (Mirai)", "value": "f5718cea3211717f3d782bbffa700493e318e51f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514823, "uuid": "634e281d-89c8-49b7-ba0d-5fb733884f39", "comment": "Malware payload (Mirai)", "value": "748f989c78b76ddd368d9c8155c9f4e87d4dcf7ce119328db3032979f2ba47ad381f1e92c3dc15090f6a67763d053872", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514823, "uuid": "a6dcff63-7396-4fc6-bdac-936cda9f6bd1", "value": "T1C031A7DE2304A7309109494DB7DCB5702E05E9C12AD98B0C968C08FA5FCED0CEAE1F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514823, "uuid": "02ba474e-5dff-4bd1-a081-aca4481a9521", "value": "12:3d4vvd7RmRFZRcvdq5RcIvdmiAovdJEfEa7EIEHvdUnvdDXAwEvduMHvdOGvdcPb:MUJr5ibiVEfE2E5SXbXU0fMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514823, "uuid": "f50c6f3e-f36f-455e-ac18-452d7dafb8d4", "value": 1849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514823, "uuid": "1b524df6-a0d3-44e5-882a-2c21a536d86b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514823, "uuid": "d696ffa4-a8a5-4587-8d87-bd189f21fc1c", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccddb90-4494-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777554023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554023, "uuid": "a408b9dd-649c-4731-875c-9df2558c8ea7", "comment": "Malware payload", "value": "2435ae249a447a17abd6ff2dace1ddf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554023, "uuid": "2f6920b8-b1d2-4529-a334-d1ec03d7ff07", "comment": "Malware payload", "value": "61c8de3128ca4893324f3327d8ca941e089dcc42eb0d2e6ef98616f5402234d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554023, "uuid": "a8c04490-0027-4d34-91a6-6f5f88093191", "comment": "Malware payload", "value": "cb8c7179f7bfc6a4ac028a305205f55e8df38cf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554023, "uuid": "f1f843f9-ef4e-4c1e-a41e-b07dfb2075b4", "comment": "Malware payload", "value": "14bc403ef2007ba157621229c64f3fb285c0f434eed735708c14c1fa300dc17d60548ccd63bd93045d8e076a5cf494e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554023, "uuid": "add878df-199b-4870-8bb2-72be39713c09", "value": "T197C7333BF19A993FD12597717AB39160553BB910A4028C4692ECF8C8CF791B11E3F68B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554023, "uuid": "39961c79-63ce-486d-92f1-0caa66aca8a4", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554023, "uuid": "af60cfc0-eb37-40c6-881f-8b287742e00b", "value": "1572864:6ZT5vQnGbS5OtUIYjFbUTtp3+ngP5VsVkRLT:6ZTVLZuFbQlPjs+RLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777554023, "uuid": "ffe1cc4c-7500-4775-93dd-e039474bc42c", "value": 56579089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777554023, "uuid": "4c245532-c657-4ad2-8fb7-ea6dc7c1b5e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554023, "uuid": "323866c3-6b95-4602-ba38-204d44519c36", "value": "a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1258c1e8-44ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777564125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564125, "uuid": "6dc7bfda-7cb7-4ec1-97ea-0e89c3efc4cd", "comment": "Malware payload", "value": "75605b0a5f446f7293ef20ed5cf88ee3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564125, "uuid": "a1a1aca3-3770-4b65-b970-329f32edcff6", "comment": "Malware payload", "value": "62d1a311c07e932fc72386be886528b95181dcf3e720d0b9773ecccdd2bd2ebf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564125, "uuid": "60edcfe3-05da-4f53-8fc7-4829757ca4ab", "comment": "Malware payload", "value": "20d94d5e3ae9ddb39a858da27fc059e4a344a2f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564125, "uuid": "19a592b9-79cc-494c-a5bf-840bdf8fc449", "comment": "Malware payload", "value": "4efb71dd3bb8cf77c75334e54f9e457261fc7fdd99248fd5c0de5ae140c0694cf7b84d3c77c7b107b1880a73d4115465", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564125, "uuid": "6b6dfed1-4d69-481e-9243-fd1bbfb614c8", "value": "T10994FF38AAFA4019B1B3DF54BEF47496D86FBB633A0E985C1081034E4633D45EDA563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564125, "uuid": "34850334-f964-458e-af65-8cb02128bd1c", "value": "12288:dNQ79yOjqDG7fULFDahFMr2ZtSo2FkhV1hmlz:Shq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777564125, "uuid": "e8f7e1c4-3b70-40ef-8e52-17fc9225a1b8", "value": 440920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777564125, "uuid": "a0b2d336-dc8e-4c05-be16-66f64b826ea7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564125, "uuid": "62701e84-ae1d-4e6f-b9c5-d4ad90e2e79e", "value": "RFQ AR2625700.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6d74c4-44bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777570588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570588, "uuid": "91ec9b92-f5e5-4979-90ba-461dd66552c1", "comment": "Malware payload", "value": "49287192bf0f840dbb28032ad0fbb048", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570588, "uuid": "52f1818f-610f-4a49-be8a-24781d5d5854", "comment": "Malware payload", "value": "6308c221dcacfce086af9c3a4f910050750027939322d81ff63e57a7bb78b937", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570588, "uuid": "5cc9d94e-087d-4063-80ee-7b0b1a66d32e", "comment": "Malware payload", "value": "42779a1e7d86e96aa54e3718e6b88ef31c10ee9e", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570588, "uuid": "4aedae33-ed9e-4f61-9707-7556276fcda4", "comment": "Malware payload", "value": "8eda42129768b8987b058d244e9cb36047d501f54073b58988d281b46aafa65201d964c8f979869bcdae1ad33b47eef5", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570588, "uuid": "8dadf44b-3430-4b2c-b789-b57908082902", "value": "T114139F0BC32115A1DBFA6BB2A8394454BEA6CC6EEDC4090E575CF6193B8ED5EE5240F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570588, "uuid": "169a9520-e492-4889-845f-6de10d2dd49a", "value": "768:uIsHB5YNSfEwixh+epIUbzmyiYLxBDSZQbmgxAVA9nK9mbQ2/b+uVPe2qEc2NpyS:EB+rw8hMUb1LxBDSZkmgr9FbfVW2qEnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570588, "uuid": "06aca1cd-5b87-459b-8e4c-1a78ea8f5b19", "value": 42332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570588, "uuid": "7f2947a6-b38d-4765-bef2-204f1b6d46b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570588, "uuid": "cf56a6fa-733f-45ef-907b-beb45b7b8320", "value": "amehu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677936ab-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514876, "uuid": "c6664fe0-03f1-4fe1-bfad-79b7bc49683d", "comment": "Malware payload (Mirai)", "value": "74733e34123aceeb334113736c543419", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514876, "uuid": "44fa8dc0-a32e-4834-83a6-961c92cd63d4", "comment": "Malware payload (Mirai)", "value": "63990e20a22b8ed8faf451a9e1f6226231e6a31833bf7eb87003253521cfb126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514876, "uuid": "d9db62d0-2d70-44d3-8788-aacbae94be53", "comment": "Malware payload (Mirai)", "value": "3c2b64f0997b937f6113d9984c33a1ce1311e2bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514876, "uuid": "b5b3fa64-119e-4430-bd0c-fc14aa6c3a81", "comment": "Malware payload (Mirai)", "value": "51ce2cd220610c657e873c1e279071e92cdd4a20bdf488619a2cba8e79e3d9b192c629a98240602fe3c6bf9d8b0fd73b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514876, "uuid": "19dd65cc-fde2-42e7-bc06-9763bc25c056", "value": "T1F9148E68FE8E78D2D2C7E37DAD4A0FA230277D749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514876, "uuid": "e7b24309-fb65-4ae2-8419-6e6a4303fb32", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7dU8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514876, "uuid": "e7e954f1-aa6b-4eaf-8e39-8e8b16873662", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514876, "uuid": "19b2925c-a920-4f78-b5e4-763f66166dca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514876, "uuid": "b25b7036-14cf-43eb-81e6-eb62af59ae52", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e7f810-44c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777573345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573345, "uuid": "d447700a-1569-4bf2-af55-0691e7b1868a", "comment": "Malware payload", "value": "0455d481e007cc7195db018bfacb3d60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573345, "uuid": "fa744ca4-3402-4d41-9824-c2122334db7c", "comment": "Malware payload", "value": "64dca2b14a65d4f097644a6aac2ce48a8ce8a83f38dc88554bb7ededdc3197f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573345, "uuid": "53470b59-bcb7-4084-a6c2-a7b7608e360d", "comment": "Malware payload", "value": "eeef8364ee90a944763edef77834f4fae9743ac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573345, "uuid": "65581bac-4fda-4a98-abaf-91c699dad830", "comment": "Malware payload", "value": "81a600ed5d2cd3a65a683748bbbe816d7c5dfb9306d522f7333eedd939f7792e3faa8debe0806c014e399d02e449ee71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573345, "uuid": "f2ae3103-c334-4964-a8af-c5fb679b7daf", "value": "T19F631995FD419B12C6D166B7FF5E838C772B4368E2FA32039E255F20378B95A0E2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573345, "uuid": "b1b46277-1c49-47b2-ada6-0b6ef66aa917", "value": "1536:s/DVOQ8jzG9Mx6OYcCFzuKLTA4R6mFx+MJm:s//8jSMdUaKQ4lFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777573345, "uuid": "4c6f0855-e2b4-4c37-bac1-8c5b94377f82", "value": 71420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777573345, "uuid": "2e7afa8b-1206-4a83-8ccf-53dcbbc36b20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573345, "uuid": "828d7417-005c-4f0e-a3d5-3c6fc4fe8be5", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac07df9-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535632, "uuid": "b40d07e6-bc82-4dab-a2da-ef6c44c4b921", "comment": "Malware payload (XWorm)", "value": "47056f8fec7384954702f47d937c1fe0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535632, "uuid": "a2b3d1d9-1d92-405f-b634-0fed9395d68e", "comment": "Malware payload (XWorm)", "value": "65383ed423a68ef8dce254763f9519e67f39f26dbcb7d0b9321a0d4611abe2bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535632, "uuid": "bdd90856-ed1e-409b-9f2c-652c57480a3b", "comment": "Malware payload (XWorm)", "value": "71a551056fd0ab470c97f2049e35151a15a59ebe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535632, "uuid": "4e48f785-6f09-417f-8f05-1112a6179d7d", "comment": "Malware payload (XWorm)", "value": "7a18b0c77086eb859e3aaf8a06ca92c6e13120e21375fd419eb7f8722373b49def7d5bf874a18007ba22f810862b8ace", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535632, "uuid": "de192d18-ec06-4fbe-8761-119eb554f317", "value": "T1A43723889EF0CCEC4028632A867F16190D7C5F1C94D2A7D7B9E6794FC8BED57404A2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535632, "uuid": "381f3e91-66fa-49a0-a19b-097d1ac7a812", "value": "49152:DnKZZ8dknKZZ8dWnKZZ8d6nKZZ8dTnKZZ8dZnKZZ8djnKZZ8denKZZ8dsnKZZ8dk:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535632, "uuid": "b9b132d4-fae2-44c8-bdf0-141e058ca298", "value": 22643806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535632, "uuid": "063874ac-fc6e-4c50-ac6b-f10eb52b6570", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535632, "uuid": "e90c6ed5-4c26-4240-a538-4d45c9dacaa4", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e36a78-448c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777550367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550367, "uuid": "d06ab543-28c6-479e-8b7d-c770eb03b681", "comment": "Malware payload (Gafgyt)", "value": "d57842367dd9bca2d301df97859ced05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550367, "uuid": "d3a29e76-a14e-44cc-a9f5-d3f5a91eac75", "comment": "Malware payload (Gafgyt)", "value": "65e1b8ee7a39364384f3616828988ae9c11ada264ac80b57ae9bffcab9f109a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550367, "uuid": "868a1039-63aa-4343-aef5-2f05345f207c", "comment": "Malware payload (Gafgyt)", "value": "303fa36aedc8fcf3a189ef44725861c66404f47d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550367, "uuid": "c2ea5870-f72a-4e80-983b-f8617acd577d", "comment": "Malware payload (Gafgyt)", "value": "eafc96ca436eb986aba767bb3d0b56ded86383959008eaf8734b4d27a28c1c054f8ef31b751ea5631a5df2f31bb370cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550367, "uuid": "fbe0d094-34e1-4b99-a0ae-e1c430fa6d48", "value": "T109157C5BFE5E3C07D2E7E23EAB8AC3B1522B7590D21351677982032C95C6ADCCFA1641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550367, "uuid": "f5a471b5-30ba-4d8b-9c6d-f7084b5dfe1b", "value": "24576:5g49kkuvlPtffyHaUn/YH0/jrtHV5HS88:5fka6U5rtHV5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550367, "uuid": "2241f593-6d6c-4b0b-96e8-09ac6e0b0fea", "value": 940592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550367, "uuid": "15a1b59e-4cbe-4133-a472-c075ca7000a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550367, "uuid": "a8baf191-c05e-4b21-acb6-d598694615b3", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569f4521-4484-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777547060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777547060, "uuid": "39526b4a-a0b6-4533-a373-2b9aa86fc8e4", "comment": "Malware payload (WeedHack)", "value": "e809193a62d9422ce9d1e08be689e931", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777547060, "uuid": "eb076707-6479-439b-a246-cea404aa0add", "comment": "Malware payload (WeedHack)", "value": "6701f98ec3fb5d8fbeee6db619eac73b83aaf687f3a8b8aa33eef9f7eb95d331", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777547060, "uuid": "3252bc6e-48f6-49ff-b7b6-09d37d46aa96", "comment": "Malware payload (WeedHack)", "value": "db49e9a369f2a4cdcc9ff76bcec34b0c1e8600f3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777547060, "uuid": "de54aa8c-6b0f-437f-9430-a858071edb25", "comment": "Malware payload (WeedHack)", "value": "990fb4dfce7cd829ec5f3e9b82590cf23f6b27d75ca85cfccf1f23b8c9883e344de9b0a25f534394c11dfb12556d963a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777547060, "uuid": "6a2a912f-1b81-4bc4-ab8b-10d1fdba7354", "value": "T137E61227BEC6C829D96754F351C28263A42A43DDE80BD03F46E059C99DB1D8A1353FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777547060, "uuid": "7407a377-7922-4639-8bca-d93b918dea5a", "value": "393216:w0OJv8r+ShnpUd/3Otcn+Cf7VE4Icp3CwMn67xv3/XBP52jDcp:2pypUdJn+Cf7ft3PYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777547060, "uuid": "e5eb3754-4037-4971-a515-96e831834273", "value": 15230837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777547060, "uuid": "b4c28df1-85d4-4f5d-9041-4d9f0d7064b4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777547060, "uuid": "a5b87c72-2e80-43a0-aac5-b6cf062f9f4e", "value": "explorer.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438e8aa2-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538438, "uuid": "a41e19bf-d5cb-4d05-98f4-069424977035", "comment": "Malware payload (XWorm)", "value": "55939e137b0a0824dddb4acf136cad71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538438, "uuid": "a8e0aa7a-c767-46c6-88ee-b54974e1c064", "comment": "Malware payload (XWorm)", "value": "68a8e4c345a863eab8d83ca9d597a919af23bedefcc9d00dcb2ffecc42bc2d5f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538438, "uuid": "2363d604-185f-486e-b255-8853c930fc7e", "comment": "Malware payload (XWorm)", "value": "3f44280a201beb43c9f73f5486f18f4b78fd2eaa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538438, "uuid": "d2f5e04e-db89-410c-b422-a1aee5ada94c", "comment": "Malware payload (XWorm)", "value": "db42ca5126d678a702bf16559ed215fa1002d97196b46456a8b2694e05d7b0f8ec27b4be95d6f678ba17e229a7c1b075", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538438, "uuid": "f80fc188-f996-42ec-800f-3ace55dbd393", "value": "T1A23712D28D4F9D2E42545A8A00960F2FB7E40D0214767FFEA2D5684AF6ECE7E806F15C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538438, "uuid": "7cfe7733-514a-434b-939b-cc8651c77e84", "value": "49152:jakaBa9abaqaMa7aVa7aZaLaxy/iIvva7aXaoaIaCy/iIvqalazaxaGaIa9aGaVc:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538438, "uuid": "d1e6c68f-ef51-4642-831d-d44beea20645", "value": 22903962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538438, "uuid": "0f91863e-1976-451f-9b09-f2e1567e22a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538438, "uuid": "5f1d2726-9aa9-42e6-bc2f-d4a2ae01ad32", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1722dcb8-445c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777529774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529774, "uuid": "d34f04a8-86a2-4b00-aed0-fefbb912147b", "comment": "Malware payload", "value": "ab34fae646037a7f55fbbfb4c6439279", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529774, "uuid": "817661f5-5ea6-4aa3-9a54-224e42a2c20c", "comment": "Malware payload", "value": "69d855031664a035bad330090cb8b1279d866106e7ff2c1ac05541ae00cf2b0c", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529774, "uuid": "01c7a452-2d40-46ca-8861-238a09dc5e84", "comment": "Malware payload", "value": "30ff06a3de2c04ae03bf8ea1430ea485d2fb0a95", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529774, "uuid": "2c7531da-1d44-410f-ab73-7d53c2e70254", "comment": "Malware payload", "value": "e86300830964ed26740ca8e9c143f9b864c487fd469805593fe595455334f9df97b2764bbf44a969c3854b30505e5d6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777529774, "uuid": "d223399c-1cc4-4c32-8e6a-778752fa0513", "value": "T1CC82E8264A15AFF4066F33926E5F3C5B2A11032269B1380CBC8FD45D3B6DB11DFA09D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777529774, "uuid": "a1e9917f-823f-44f7-93b3-b262765c1894", "value": "384:KTvrD/CNMUuO5BrOy6G4++8whmezcaYmqs8Tq3QpbcY7dEFlWe7gY:KDr7CNMMVZ3vimEETDbcY7MWdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777529774, "uuid": "23d60bee-4d87-4eed-97a8-796c8a3fe029", "value": 17777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777529774, "uuid": "59d2b0cf-d9dd-41c2-ba69-5d0f5196f3fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777529774, "uuid": "1b8164e0-8446-4d70-aa94-f59849564f42", "value": "INVOICE-3452334.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3751e73d-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535411, "uuid": "5cf680d1-6576-448e-a0e2-3640ce1bf8b2", "comment": "Malware payload (XWorm)", "value": "7cb0b990885ff022012b83245d760f5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535411, "uuid": "053daac0-5878-4e25-9ba6-e5c62beef090", "comment": "Malware payload (XWorm)", "value": "6a58056713410a9765b4565edc65d56a164ecf40bd9002fa799cea8d6709c566", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535411, "uuid": "0d570074-a35d-4133-bb35-bee6a2809464", "comment": "Malware payload (XWorm)", "value": "d0ab1b8fb238713cc985130e77387136b341421f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535411, "uuid": "320cb486-7fa9-4b6c-ac3a-191faa4d3a02", "comment": "Malware payload (XWorm)", "value": "98c214235bced43382e8e58e2698cae480de58f2c3d00f1505b6d2a545eed4ff6c5b042c6eceb6f13dc090c322b0da7b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535411, "uuid": "aee13bad-61f3-4903-841e-c20982874b53", "value": "T141372344FBEAC4FE4D833358502E03D60ED7CAD9423C62A556BA5CA16D0F761F2CA47A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535411, "uuid": "0c9ff576-5b8d-4af1-835b-60237b2d9f5c", "value": "49152:Ru1e2u1eiu1eRu1eAu1e6u1eYu1esu1eku1evu1e2u1eau1ecS6eZu1eTu1exu1K:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535411, "uuid": "7c1b9a53-a75e-4358-a7fa-d94dd7473c6b", "value": 23164074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535411, "uuid": "339000c1-30f5-4c89-a86c-0b02dac00647", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535411, "uuid": "4e716691-acbe-4f6b-bed1-5ba2b16084bb", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce38bb6-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538427, "uuid": "51b06d50-b484-451b-84c4-318ab7f4c2ec", "comment": "Malware payload (XWorm)", "value": "b7d4c6289dec4e11c447c8327128e798", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538427, "uuid": "487ba284-c5b4-4e63-9ef7-baf7e1067efb", "comment": "Malware payload (XWorm)", "value": "6a8e589c2368fbd7a40d55391c8a57e6a09be10726db5b328c45e2e2ff7cbe99", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538427, "uuid": "d204685f-2333-431b-9192-8330ad02a19f", "comment": "Malware payload (XWorm)", "value": "f72c9b8ba08ca94900b51382c01b011d91920e47", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538427, "uuid": "25c5a7ab-1324-40eb-a5e8-837345586f1e", "comment": "Malware payload (XWorm)", "value": "e1ce6e4b6ab64124e52a5f7f48b2d09b2f0bfd2800bb94b2eb04b8dd8802f52c42ea4726501b6acd412acc10c33b0e86", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538427, "uuid": "09ab621f-66fd-4f89-8691-ce7ad4e18437", "value": "T18E372352063DEEEAA7B83BDD806E864F45BDCC650F0D10D1A665383C997AE0DB3D2274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538427, "uuid": "89f9e0a8-bd18-4565-a5c1-801c15a57cd4", "value": "49152:DECBHmECBHRECBHwECBHQECBHtECBHjECBH5ECBHeECBH+ECBHDECBHsECBHHduu:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538427, "uuid": "4f54a25e-c07d-4207-9cfd-f3cccbf8ae6a", "value": 23424185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538427, "uuid": "d8e5806c-769c-4965-a9dd-19675ad49812", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538427, "uuid": "c4042d2c-84e9-43f6-8ea3-8ec1f3d42c0e", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40e737d-448f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777551914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551914, "uuid": "133cc8e1-580d-422c-8bcd-e9d3e7dce821", "comment": "Malware payload (ValleyRAT)", "value": "358adb25d4cb110f929d3138a0fd93eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551914, "uuid": "aa898fb3-25b9-4ba7-a6d7-9c634bb4b213", "comment": "Malware payload (ValleyRAT)", "value": "6ab7037ebecbaa76fed39ccc87ad64e5be59e53e60a6d7781dfdd0d5766ba606", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551914, "uuid": "3aba9a06-5b77-4c45-877e-991678ee29fd", "comment": "Malware payload (ValleyRAT)", "value": "f33c8957efbc9ff06fdcc4c98b51a8d1f815acb8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551914, "uuid": "fe66fdf9-785d-4c35-98d0-9b369d86f4a3", "comment": "Malware payload (ValleyRAT)", "value": "0ef847fee14d893f130fb22ada28228a181b49fb193eec38bb3466cdfed459865cc91b3f772ca5c0e454461bfef1f58a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551914, "uuid": "9b775717-54c3-471d-85a2-db23adbf940f", "value": "T1D3C36B11B9A1C036E6AE0C388C258A659F3F7C91CFE0ADDB77540DEA4E346D09F35A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551914, "uuid": "c2c28687-e273-463a-9c97-c407043abc39", "value": "975de3981bfd206f77fdb9cbdfe805ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551914, "uuid": "37c59b33-7b5d-4aaf-b01e-952339da3fd9", "value": "3072:5VLecyOamhI3e6ixvJZZhzv+JNSVS1wssQTNej1E:zLecAmUetvT3T20G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551914, "uuid": "e3da8a7f-b070-4be2-b309-f77798e767af", "value": 125896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551914, "uuid": "b1b164a0-00b9-4fe7-b51f-9f996d2f6eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551914, "uuid": "60d51014-d4cf-4735-a373-2fc7e269fdf2", "value": "358ADB25D4CB110F929D3138A0FD93EB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac53717f-4488-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777548922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548922, "uuid": "d06dc440-c9ce-4595-937c-bf770c61c825", "comment": "Malware payload (AsyncRAT)", "value": "fc5812708ced9391212d97f1d046f33b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548922, "uuid": "23d4a1f5-634f-4476-b346-cddad8305269", "comment": "Malware payload (AsyncRAT)", "value": "6af148f064f847b0a4f94cc361a801a69a7d2822859b7da570085e8e901b46ae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548922, "uuid": "3afa6c32-a558-404e-904a-e5e4c0c6fa40", "comment": "Malware payload (AsyncRAT)", "value": "87c5b821b6de3d7295cfd3a0f87b5fd40d04925f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548922, "uuid": "0c69e96d-cf45-4f0d-a6b6-4277ed04a771", "comment": "Malware payload (AsyncRAT)", "value": "3cc93fce7695d5b6d0b724c0be2f2d4a69f0d79bfde9a66c6f8634dda44bc302ad2035fd9207ad21a2e36a6a68da877a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548922, "uuid": "c797714c-a42c-4c58-be79-f50da2abf8d9", "value": "T1AE332C043BE9C12BF2BF4F789DF22145867AF1632603D55E2CC4429B5613FC29A526FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548922, "uuid": "b8e2b3a4-905f-4407-99f8-fb7b04b91af5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548922, "uuid": "3e590254-d24c-4c0b-9cfe-281fedb7312d", "value": "1536:guPAxTJKHq2/JgZ5wxFmAzb5qLUYNzJrgd8x:guP8TJUq2OZ5wxFhzb5A5Nz1gOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777548922, "uuid": "2ac0027a-f529-4283-9c76-eabbfb3adb05", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777548922, "uuid": "64c92a49-4d30-4896-9bee-d445754e5b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548922, "uuid": "e5ce0bac-4c7f-41b9-8796-a86960a8aa7c", "value": "\u043c\u043e\u043b\u043e\u0442\u0430\u0440\u043c\u0437.\u0440\u0444.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edd88cd-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535504, "uuid": "8cd84b89-7984-48d0-a7af-247948da2c7a", "comment": "Malware payload (XWorm)", "value": "f6d3219c6bcfea8b203a5c80aed35742", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535504, "uuid": "dff6e1e5-dbc5-45e5-bec5-1ff9a7e318b3", "comment": "Malware payload (XWorm)", "value": "6ba1df87820a285139c62a843973be235fbdbe27f4194d80b5c43e1de40a81c8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535504, "uuid": "fa7c4e60-f21f-4d8b-a319-3ae6633c8118", "comment": "Malware payload (XWorm)", "value": "7daa9e8c4b3f7c784dcf09eae8643f4896899c4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535504, "uuid": "4249c313-7ceb-47ed-8aa7-70a75dd9f376", "comment": "Malware payload (XWorm)", "value": "a1fc527dec0402623c1bb86ca33edb38af5e8d546316691e1b074391d704a9b0d2c9f122c9ac652864957da3de2d9b74", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535504, "uuid": "7ab21d91-1849-46cf-8902-396c5eca72a1", "value": "T1A73723134F20577BFD8CD189212E011F2BE2A946D961EDCEFD61BC487BAEDA6005E532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535504, "uuid": "251b6657-4df0-4bee-8519-bdee597417fc", "value": "49152:iwjRwjwwjdwjWwjOwjIwj0wjOwjTwj+wjcwj9wj4wjewjPwjDwjdwjwwjSwjKwj8:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535504, "uuid": "2baac3cf-3436-45d8-b85b-50421f066a69", "value": 23944470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535504, "uuid": "54dc1a3a-f7bb-4d7e-bf56-59fb42304ccf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535504, "uuid": "8a4821cf-3d08-4f82-97dc-f99e3565a1c0", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc78fc0-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777514809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514809, "uuid": "cb8cb84f-6b6b-421b-852c-e49c932d35d5", "comment": "Malware payload (ConnectWise)", "value": "93de447ff958dba6087e3ae0d56562ad", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514809, "uuid": "ee112b65-5c93-4f34-9c53-c354c281b149", "comment": "Malware payload (ConnectWise)", "value": "6baebee5ee583fded284128aec36f4e9bd41481d7c839c33aa6e4227b8a22499", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514809, "uuid": "9bd6ae07-1c4f-4734-b504-e00c63acda35", "comment": "Malware payload (ConnectWise)", "value": "4e4b3fbaeba75062499660ab4bd3899224ae5339", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514809, "uuid": "170ed1eb-7914-4887-9ad9-ba528c442bd8", "comment": "Malware payload (ConnectWise)", "value": "1778f7d41f161a721fc3bff1d7a6ab957741461b99a180a547718dbdc8780bd2fa0dd77c8e444a4843a43dd705a0ef5a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514809, "uuid": "95625f5e-2072-494c-9451-f753c5f16925", "value": "T1F3647C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514809, "uuid": "8ddd3cd6-016c-4f2b-8f32-0bf4505879a8", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514809, "uuid": "5436b7df-9375-42da-95dc-f0bd568e8b7c", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji95:B1iw7gryNkSV1hy1Z1u2JLu95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514809, "uuid": "632452dc-2002-4058-a51c-331eb6778a0f", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514809, "uuid": "972d6271-8ab0-4a97-b2ab-910ec24c00f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514809, "uuid": "b1e358aa-9ec3-4092-8f91-9f2bdc62003d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679bcb51-44ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777564268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564268, "uuid": "ad51a3c8-22be-4fb0-8772-e381c9a67e74", "comment": "Malware payload", "value": "5bf75048f153ad48dbbc3fcd72bb26e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564268, "uuid": "1e284f39-f684-44d9-95d7-6ff551af81df", "comment": "Malware payload", "value": "6cb258fd31a8baa0774eb94248550e5ff8f2b7123f121330856ca1b5769e7e48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564268, "uuid": "c7f3e01b-c13e-4507-97c3-28a649ba323d", "comment": "Malware payload", "value": "0a94cc47f6a85188954433ccf71b4ee6c30a51a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564268, "uuid": "f3747ea1-1e9e-406d-8fdf-7df317459e37", "comment": "Malware payload", "value": "555a718f2fb7f5a83b3cc844b8fc89537da5c16d5fc0d7166511f70ba01cb031717a32046832b08c5b395ca397661ae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564268, "uuid": "44f85bb7-0581-48aa-86a0-9a2de29c3457", "value": "T139C5BF0F765C85EACCC55A7301E82C5217D2BFF21ADC9CD533C63AAAB276083A8B5157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564268, "uuid": "6d50030b-a1fb-4744-83fd-c47972ec99b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564268, "uuid": "afc8128d-fcfd-43e4-b083-15ee03ac9782", "value": "49152:PKLqzUdPdU9I5ZDWBMPfSIen7di/VGahSYBzqwBQ43kXEUSLd2pM4:kb/KADyMPPen7di/VGahVzQ43GxM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777564268, "uuid": "2c1e2661-5106-4eff-86c4-f3a884ecff4f", "value": 2663512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777564268, "uuid": "5f9178f2-a2c9-46c2-81f2-5134c03fe564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564268, "uuid": "437dc5dd-c35c-40b0-a9c5-3cb0eddc444f", "value": "DiscordFix.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ae773e-4460-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777531509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531509, "uuid": "0e6fa19c-f35c-445a-b79b-88ffec0ebfec", "comment": "Malware payload", "value": "c7bafa35e2bf79ee7d85027868303195", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531509, "uuid": "a6d74a1d-2e7e-474d-8816-8c8c967dea67", "comment": "Malware payload", "value": "6da1be1ccad72d655dc34ac0a2afba8430aee3993de7891941037d68c05acea2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531509, "uuid": "62f6abda-4d20-4b32-b8d3-fb20f41d0a4a", "comment": "Malware payload", "value": "77a45460315ebcd31411009d1e094f4c1570689c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531509, "uuid": "79c1b4be-9c54-4895-98f0-95627abd51b9", "comment": "Malware payload", "value": "37ffddb1ae2e176a3e36cff6c2ccab18f5e66dd9a4e6900a14c3cb5e9b81165dfcbb43766c5ea75276ae6290ff770f74", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531509, "uuid": "cf39f108-b32e-4264-bfe2-3e8a28a7e3c1", "value": "T11803F81BF2909C7DC4C4DB31CB9FC6229230B094A632152F3F44677A3D96B754A7EA26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531509, "uuid": "4a1a2982-b0ee-406e-bffd-b53d0256909e", "value": "768:RQV1lLD7zrjbTLD7zrjbpBLDuGe2Om+WuGe2Om+WuGe2Om+WuGe2Om+WZhJR5BpC:mXVWOdm0CUzsuOSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531509, "uuid": "d3d5c49e-4395-4984-a43d-d8f40cb7983b", "value": 39056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531509, "uuid": "87b83ddd-5316-4739-9739-7fdf8437adde", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531509, "uuid": "53c5ed78-407b-4057-8540-65acb450efcf", "value": "agent-x64-test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab19dbb5-44ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777593158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593158, "uuid": "a5c7457f-7b43-4abf-9cac-0991161b1e16", "comment": "Malware payload", "value": "36ade3d5e6a692e72bc8a1665c3ef557", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593158, "uuid": "337b1fb5-3383-4ed5-a4ae-12d98ba1bc0e", "comment": "Malware payload", "value": "6e55b212f06eda7e0993d1302332e20453df87c66987acc3be3206ec9e9ffa6f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593158, "uuid": "b99a2bb6-3c94-43bf-9d5d-d40b141b3e43", "comment": "Malware payload", "value": "238c20e6d37d36537d14509eaf193076a5f6f14c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777593158, "uuid": "2e93dcd9-4010-40b7-bfb8-9f0d0fbd3db5", "comment": "Malware payload", "value": "1e4ede233b939848b7d1432708554e397944ff1690af143ad0cda883807d5c2bfc50980e7edf3df6803233a93b0ad055", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593158, "uuid": "c2cb1ac5-71ec-424b-be13-b815daf75c6a", "value": "T15E4104FAF4A28E30336DC5BD7589654CA7568A6F492A2E74F043743C27BC3247074695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593158, "uuid": "3c9f532d-3aef-420a-ad2a-1b72f2a78c1f", "value": "48:vkwvpihneZZn1oBydXrWfHWetonmzEvJGU6ljiPq2MTCki:vkwYheZZK8rWf2mzIj6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777593158, "uuid": "dbdff04a-c7d9-4941-b588-b640d13cbc57", "value": 2085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777593158, "uuid": "ca77e865-4e5c-42da-8d57-1ae4791b6638", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777593158, "uuid": "b9f7e07f-c824-4d23-a55a-63ed23d6b2b3", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73970f2f-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777574167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574167, "uuid": "3d685c70-e3a2-4d73-a32b-1627f02c2b78", "comment": "Malware payload (Mirai)", "value": "8dd88ab9dbb30078a2ffe6ca247679d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574167, "uuid": "e68899cb-7208-46e0-ac35-5d3c728f932e", "comment": "Malware payload (Mirai)", "value": "6e566cd027552388605bfb45d3762c8a8f9f8d09b28ffa63ce36563943863d4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574167, "uuid": "eb2e233d-d63d-4584-9e5f-085c7abf8507", "comment": "Malware payload (Mirai)", "value": "236b3a7bff3bbed01183856a8723ebfe5572296b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574167, "uuid": "d4979cdd-0e3b-4c3f-9ece-f2df8e02da28", "comment": "Malware payload (Mirai)", "value": "563ba553278cc5a0794a801c099fb7fd0959e604f22b2623fbbe669182e4f8a7f9724af5e4333ed1ec2bb2d5f381c9be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574167, "uuid": "aef9ed95-8c3e-4a68-baff-580c09fa0e6b", "value": "T17A538C8BEB43D8B5E86301B5417BB3268676E9355036DB03DB58AD31ED23602DB1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574167, "uuid": "3776a8b8-4cde-4174-b998-9928d1be686b", "value": "1536:rVYv7GPzdeso7JTewplKJ5YBUIMMF8JjxggLFbj:ro7GP2iuIA2I6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574167, "uuid": "9ba7f849-ec75-4991-b7e1-460ed4180a50", "value": 62984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574167, "uuid": "f163a293-f19f-47b6-98ba-f6e664ffe2ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574167, "uuid": "26f7dc93-d0df-4131-9be8-60436ae2c39f", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e9a1d3-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535469, "uuid": "b3f8e9b6-5e2f-4f8c-9a07-9d9667d5c920", "comment": "Malware payload (XWorm)", "value": "3dd3b78bbf7bdd56d8e3d6f1fdc5dc12", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535469, "uuid": "ea468674-0511-4adc-860a-819b30546de2", "comment": "Malware payload (XWorm)", "value": "6f1be37ca4928e56672d3661159b4ed35f578be1f60606c4eda3df0a96933b9d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535469, "uuid": "51360270-22e9-480b-a69c-c29bd53cb619", "comment": "Malware payload (XWorm)", "value": "5943b600a1cdbe7606d6f1830544bcf143467ae1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535469, "uuid": "3e817e46-bbe7-4429-91e4-d9ff1b6cf019", "comment": "Malware payload (XWorm)", "value": "85573d676d4c8bb61a528b0fbbc0edec66a92c5fcb98f423a92c7a329e10015415b3fc5bf086ec1a2bd92d7fc47de9ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535469, "uuid": "0dbc9cf0-042c-4d1e-b509-6c4fc5bccccb", "value": "T1D237231E0D9E2F3A1CAF525CBD7B1E4F55698C014110B9EFA9A7BCFC911EE04A05B24E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535469, "uuid": "3aa2fa73-1d0e-4855-be05-1ea2a7bf83b9", "value": "49152:Hbe7Fbe7xbe7Rbe7Xbe74be7Sbe75be7fbe7fbe7fbe7pbe7e+Hibe7nbe7Jbe7B:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535469, "uuid": "f583fd20-77fc-4498-9c47-8e8618729cd4", "value": 24204600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535469, "uuid": "070c0fa8-7b03-4d19-8ad0-4786a9579a25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535469, "uuid": "450180d0-8c20-4e54-a21b-f0ccd41bfdbe", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156941ad-44c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777572720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572720, "uuid": "83fcb238-3792-42f8-bd1e-9e7810451815", "comment": "Malware payload (Gafgyt)", "value": "c424ad7d1c65b5240f2b4a775f7c762b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572720, "uuid": "951be7d2-7c66-4051-b976-e5ed06d638cc", "comment": "Malware payload (Gafgyt)", "value": "6f3ab43274ca2da3d31aa9190c1caa24fd5c3850f69a7da10ad9640cbced74dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572720, "uuid": "770555d2-7106-45fb-84b8-ad75254386b2", "comment": "Malware payload (Gafgyt)", "value": "c091722a46cf2b8b84c3a8a634e285cbfabc3ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572720, "uuid": "0913f922-77fb-44e0-b5d4-5ea7d9eb206f", "comment": "Malware payload (Gafgyt)", "value": "596d24021a947d759725a57ec486de618a202b04245fb589563355cde78fd5711b412f40fda853fe3287730dc2f1e0a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572720, "uuid": "3cc7d9dc-816c-4c8f-b345-beb2ae77cd31", "value": "T127E4CF67F5261E43C8E3A13F2467C1695333E61623969706A70BF5BD3ED62398B0A3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572720, "uuid": "b220fc23-d251-4b86-935c-483c5d0be94f", "value": "12288:l7diBRtT3aToOLELq8CiT7NsHwCEsLBajoDjV8ptgCjLRtK7BCQXxV3vm:V+JawLtZNsxEeCfK7BCMxV3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777572720, "uuid": "6590c3fa-173c-47ba-864b-38bad8f54a41", "value": 661560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777572720, "uuid": "5206291b-9785-4109-9e17-e1aef5c53150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572720, "uuid": "9b97ddbb-aa34-4e5b-a93c-d0b5be6f26f5", "value": "armhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338d501a-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538411, "uuid": "8b342a4d-aa6e-4352-986f-9919675b833c", "comment": "Malware payload (XWorm)", "value": "b97acd600b939a54aa077998fe0dae1e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538411, "uuid": "02529848-8386-44dc-8dc9-4c97a00076e5", "comment": "Malware payload (XWorm)", "value": "6f5f2f71f3767cfefdbb634271fc18b3c5f02fec3f1799de6f56684045544d29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538411, "uuid": "670df2c1-c093-4a32-99ef-8761a92bfb31", "comment": "Malware payload (XWorm)", "value": "0ec79f24ecce578741cab47a40623ab293098af1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538411, "uuid": "d1a90e6f-e1eb-4037-8b9f-4e25d8e2e67e", "comment": "Malware payload (XWorm)", "value": "5dcc6d5efd1ef45a91830c222ddd215155588a92605c87ae2d242a76cc29b4576391a73c68c069bcade6735a9f92cec4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538411, "uuid": "f1f56b1e-dfac-4e28-a921-cda95203740b", "value": "T1733723414E6E0F2D065EA21C9079070EE9F98769427CB4C167F27D6BCB8A43609C76FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538411, "uuid": "1ad1b1a2-755b-4c34-9b74-0765fc99e832", "value": "49152:2KXxmU6gIKXxmU6gQKXxmU6gDKXxmU6guKXxmU6gGKXxmU6gAKXxmU6gpKXxmU6K:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538411, "uuid": "2d79286e-c00d-46ac-919a-5e3da844c826", "value": 23684328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538411, "uuid": "30d8da37-917c-4ad7-9526-1534f587fe5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538411, "uuid": "d0f74589-2335-418c-9943-d9eba328b995", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e925a0-448d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777551030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551030, "uuid": "8eb79dba-a459-482d-bec2-6113869dd173", "comment": "Malware payload", "value": "7e720fbe170054a1cdbad31d788a4877", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551030, "uuid": "7c30f4dd-83c4-4855-925b-c185f57ad777", "comment": "Malware payload", "value": "6f9477761e8ac88553749da4057da08a9760b55750c415047d3baaef9ee77a46", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551030, "uuid": "bd900614-b6dc-40c0-85a6-719bfbe147c2", "comment": "Malware payload", "value": "a21960db5721dc9e00ebe700399f3ab53d19f5e0", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551030, "uuid": "6eea3da5-9866-40bb-8704-7a1ecd6c69fb", "comment": "Malware payload", "value": "ec24407f36e0535e55267d675e79d6e61514a73e9224d81ec5b610143d8ae576a18b2c1fa46fad4cc2217c59710eb08c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551030, "uuid": "bf7ab78d-38ba-46eb-ab32-670e65e65cc3", "value": "T11BD323F84F994AC3C395C538D8488601C5C36B74E98CEE05F8630D693E8F955BBB6D26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551030, "uuid": "a8862ea8-0923-4c5d-a9b1-6dd7319d8e53", "value": "3072:d4W2knTu6gp9RqoGxgonHmLqE1uLY/eNtkkmcCnk:q3kTZgX5Gxg6rUCY/eNtkZxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551030, "uuid": "919634ec-6253-4769-8425-f40083315d32", "value": 130883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551030, "uuid": "d56d182f-5367-4c8a-952f-3d24b6587ff7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551030, "uuid": "09376435-a3c2-481d-8daa-3b91f8bbf471", "value": "Sales Order & Invoice Confrimation PR 10007897590 - 0023-26-EL-Q_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5addce-448f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777551984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551984, "uuid": "64990a45-b357-4439-82b3-76b25e367bdc", "comment": "Malware payload (Gafgyt)", "value": "6c8a76d01b3fe39a7251e5a808f84618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551984, "uuid": "5e27d333-a637-4a9a-86e1-ade92e7e4c05", "comment": "Malware payload (Gafgyt)", "value": "70c8aea3e355482a50ecc50b091bad3d21d27b48f9b6a19c83ccc2860b7e2e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551984, "uuid": "6930ed13-b981-46d5-afc1-89bc77e8d70c", "comment": "Malware payload (Gafgyt)", "value": "e7e21d634fe106fb9f7699b1edb4408423bd5357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551984, "uuid": "7156d0e6-cfd9-4c7a-a359-4564af84e1e0", "comment": "Malware payload (Gafgyt)", "value": "23e49a21698ae897970ff339d01d88464787890b1f008186e937886af06c538097777ff5cd2763c7a043fdee1e5b00e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551984, "uuid": "9a986b7a-d477-4ad3-92c4-aeb9e26d67c2", "value": "T1A2356B46FB1C4522C8570EF12A7F53D5F7207A4341F5A22A670F9B632622E3ADAC7349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551984, "uuid": "5cef5888-cebd-43db-ab5a-12ecae12424e", "value": "24576:ldSfNzsMUUW3FMVdT35AfBHV0oweWvn5jgvTiRBc/QOFwNvf6XN:ldSVzsMUUW3FMnJA5HV0owrnevTYc/Qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551984, "uuid": "5a6d7e69-8f43-473b-b0e2-ac7b9ff6e6ca", "value": 1074736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551984, "uuid": "36e4e551-921b-4ab3-8302-a0267350127c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551984, "uuid": "9b553ce0-e064-428e-ac5b-90ed55f16c33", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5880d7fe-4473-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777539762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777539762, "uuid": "0382389f-d228-424f-a816-c12d6fca3a74", "comment": "Malware payload", "value": "cb1bec51ceb551bcd522ee61afe3964e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedDriver", "colour": "#68BAED", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777539762, "uuid": "ff520288-7bb0-48f3-a8aa-24f8f83c4bdc", "comment": "Malware payload", "value": "70c9f9e8dcbba700e0fc20e6ae9b4c5df98326cf212ac8794fc8ee9a46e948c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedDriver", "colour": "#68BAED", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777539762, "uuid": "967be523-14a0-4dcf-9373-6c08661d2959", "comment": "Malware payload", "value": "61272df03b1d73a1de814b45d07590b502514828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedDriver", "colour": "#68BAED", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777539762, "uuid": "3807cb57-ffca-4dc8-99ea-8c55a626d0c7", "comment": "Malware payload", "value": "a6b90500239d71f874451ac270fae0a1a36343701bc8c50f0df1310e6ec162accc7d980e16e497103ff433e7a1509972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedDriver", "colour": "#68BAED", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777539762, "uuid": "2270f721-db04-4557-b20a-52e1dff4f87a", "value": "T13C338D9672A420DAD56EE6B4C2B1DA23EDF6B155173242CF0371CC952F733D0A23938A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777539762, "uuid": "51b806ec-15e7-4fc1-9028-4ef2417e6441", "value": "9261c7ebc31630ff8bd053b515a62e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777539762, "uuid": "4fc8396c-2a6e-4752-b0c1-ed9880649f7a", "value": "768:1Zj7hSINdNDbu5tN2ivTwj7tPuyD30DyNiJ96UtML9P3OzdZ901ikC9hDT23Pmfn:fh3NPEtARjIE0Dy+96UtpzO1fC72Sz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777539762, "uuid": "5701a929-7570-43e9-9b29-d1c308fb124e", "value": 55024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777539762, "uuid": "5ed67c07-4e24-4f07-b5f8-3d3f27a8c3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777539762, "uuid": "1b43e90c-d8c4-4c7a-a8c3-dd9895e930e2", "value": "weretwq69LQ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27ce88d-44b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777570058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570058, "uuid": "5f36f95f-4200-4b43-baf0-ac06e3cdb909", "comment": "Malware payload (Mirai)", "value": "1178be605f92f6e7233978372231c234", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570058, "uuid": "075ec511-3083-4653-a790-1aee5159bb47", "comment": "Malware payload (Mirai)", "value": "7110983f99d01524b83f9281ac2f9d17f908b65f306546610d332c5f1648704c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570058, "uuid": "7fed0d3e-0722-44ee-97c4-4a8905dc4ab3", "comment": "Malware payload (Mirai)", "value": "0d8aab75e46fdb553e03b8bb44c0d776d2ae8ccd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570058, "uuid": "8d9ee704-4128-4a27-8fe7-738b89b64855", "comment": "Malware payload (Mirai)", "value": "82d7ca544293f80ef6f689d5a5533923bf25a270a2d0ca6ce409cbdccc98a6302a5ef2c16e99b9cec03eddcfcd5013b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570058, "uuid": "cfa3f97a-a74c-4adc-a9d4-46392e92c24f", "value": "T1EFF35AC1A64FD4F2E94250752076BB364AB2FD3A123EDA83D3B89A31DC53981E417B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570058, "uuid": "e13b44eb-1c3b-4c7f-b82c-56741f4b1fb0", "value": "3072:oeqm6wLjlB4vFrpQITrggSByTJOBXXJd3PeKz50YKh2BVH6:oeqmVLjlBYE6vKykXr/ee50YKEBVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570058, "uuid": "7d2c8664-a7bb-46f9-8a17-b2b0001407d3", "value": 164588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570058, "uuid": "0d064b6d-bae4-4e05-80ba-ab387b54d4a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570058, "uuid": "9684df15-b055-451d-b7df-c63fc37138ef", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5968bc1-445d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777530576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530576, "uuid": "7809a030-4777-4650-bd30-db3c78e56ff6", "comment": "Malware payload", "value": "8739db7308612f3f1ee768a82f526576", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530576, "uuid": "eef10025-1596-449d-bf6a-418d4a1e180e", "comment": "Malware payload", "value": "71a0a7bb6a8601caf99e224573657e64186a4b05cd1005277a612f2f05e01890", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530576, "uuid": "a3dad3fc-7eec-4688-8679-7a2f6bc06977", "comment": "Malware payload", "value": "2c704252a33c7378055696fda1a576c1764cc579", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530576, "uuid": "2205293b-3064-4c1b-bd62-fc52bca71a34", "comment": "Malware payload", "value": "df53278b7a7f64b49c821fec594581ad7ec9d00652d74f553a16a20f4ccb2a66721b633cf75b5951758c189a17ce05bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530576, "uuid": "d6e87fc7-19d9-4c83-8590-e5279140afb7", "value": "T12AB67FE63E95561FFDC08B200CFD346B03845B4A5B6E61769D22D3BFD0160FA642E9B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530576, "uuid": "f64b3f5a-62d6-4990-8b4b-950e5e68feb6", "value": "768:Mn+igJFBFUcEsxI5bSEwaRtEKEELPBtbfdkNnGYEda1f56S+kdUxZzp1wKdVy1RY:nnYPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777530576, "uuid": "a4f35589-a23a-4568-b1fb-49f560f49920", "value": 10439892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777530576, "uuid": "76130f27-6f8c-48ca-8c2a-cf218ccac1a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530576, "uuid": "aef137da-7f0b-496f-bf1d-b56db533ce62", "value": "awb_fedex_post_clearance_customs_tax_payment_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb40f6a-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777537029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537029, "uuid": "f8c54a44-2d9c-4054-aa34-53bfeadab575", "comment": "Malware payload (XWorm)", "value": "26bc464af247e2d969ba8ed99f574080", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537029, "uuid": "87c7e1b2-9c55-469e-b664-1223fba33406", "comment": "Malware payload (XWorm)", "value": "722a01e6c4b39d86cd58ae0cce0f4a66d3aca29c4b7358251b0f631587f08216", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537029, "uuid": "34e61a02-5b22-4e78-8781-5bbc57cb993a", "comment": "Malware payload (XWorm)", "value": "00773f7379a01d985cfa933e87734be43c2356df", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537029, "uuid": "7141d8a6-40de-4d14-b680-7f43743fc91b", "comment": "Malware payload (XWorm)", "value": "d260195a19160a8700472315cbbcd72135da37dfb6fba6f5d4f9fabfd595c1c60d404f1c9b861b31ecebaf37f5aefe13", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537029, "uuid": "65d364b2-5d4f-4cd2-bbfd-30871c20b7cc", "value": "T19637231E9B499DAB59740E1C306D0FBA5787EE902506E4E7F297703EEA7CC1447CA02E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537029, "uuid": "7dfb8a07-0ecc-4573-93ce-38af7254402a", "value": "49152:T8rW8rr8r88re8rn8rZ8rv8rU8rK8rZ8ri8rL45C8rk8rn8rP8rn8r345X8rl8r5:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777537029, "uuid": "89a00331-2330-4c53-9b0c-cc804ae4efbd", "value": 22903935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777537029, "uuid": "ecd542f0-686e-4f56-9b73-e275ec635c78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537029, "uuid": "d7a1afb3-8095-4b24-a26f-384f5fbe0edc", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a69f7a-448e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777551375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551375, "uuid": "c68f06ef-2baa-4338-b27c-f1d0abc1b93c", "comment": "Malware payload", "value": "832538200fb0afac221de3134c1c34f4", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551375, "uuid": "73bbc2bb-5d94-4d30-8d3a-85fd526814c3", "comment": "Malware payload", "value": "72d6102b7ce30f4974d507d84161b956104946762284310685ac172f887cebdc", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551375, "uuid": "d8582309-8c99-4795-be17-a6b2853930de", "comment": "Malware payload", "value": "11b2bcaedfb12157ac56e454cfd49b41b2d25369", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551375, "uuid": "9c2a10eb-bbe2-4764-afe5-649b6d4179ef", "comment": "Malware payload", "value": "c5d27016da4dc0fddb89bdc22bc9cf6caacf26623b863773a5dbf24f9ac568f3c8f9419fbb6e5e58190ce09083fae3e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551375, "uuid": "9e480982-b136-40cd-bc4e-c62eb641bff3", "value": "T19F542A343AFE5019B1B3EF959FE474A69A6FFA733B06945D1050034A0B23E41DED263A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551375, "uuid": "ad8136ce-4ee2-43b6-8cdd-231f82ee0259", "value": "6144:MUnWqvLk6TSmt9Xd3EqG0vDfEdlG7Hg30On9PYFWEu731SAvr:7PTSA9XdEqGYDfEdlug30On9PYFWEu7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551375, "uuid": "15961885-bd94-4643-aa8d-6106533dc7c2", "value": 294934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551375, "uuid": "d70d68a3-0d4f-4eb3-968a-60bde36eab71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551375, "uuid": "a3e74bdf-f362-40aa-838a-ec72b9226e84", "value": "swift copy_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5c4f72-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777574017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574017, "uuid": "43399115-3e59-47a6-bdad-3198f8f56b5c", "comment": "Malware payload", "value": "50e013f0f9a020a3ad0b715e5003d2dc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574017, "uuid": "83f14793-e636-4e2b-948a-fb3e5edb4779", "comment": "Malware payload", "value": "73303716abc0eece80b766a0b5b5dc57f232d3297cf69c9790da455f029782fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574017, "uuid": "f1e4ad50-2531-4a85-9b1f-6d67ebd61157", "comment": "Malware payload", "value": "7cdc9e7f2d826b2cd6cf94fa9cd22f5a0e019f5e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574017, "uuid": "1bf2a4ad-603e-47cf-b67c-c299bfc62719", "comment": "Malware payload", "value": "fe7f723cd54016daa47183e4f906a70fbae8ae1f60224f1763b36e279f5de6ea1a2b28db4c0155deb83a01095f143b09", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574017, "uuid": "ae8097f4-e5ea-464d-8be6-c7043cc21da3", "value": "T160136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574017, "uuid": "a7d710dd-ffa1-4039-8c79-5f8ecbe34bda", "value": "768:b2XRWNGxVZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bylxEcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574017, "uuid": "a4ecd5e8-2674-4df4-b2f4-b69bc61ef6cb", "value": 45429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574017, "uuid": "e9d41047-726f-4a55-9b44-a1ad96dba462", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574017, "uuid": "cce615ad-58fe-4c96-8f99-787da2b04e7c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a25b3c-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535495, "uuid": "6f54a900-3203-4824-9701-8f78510310c6", "comment": "Malware payload (XWorm)", "value": "c45ab707bb12f09404f542f625c5173f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535495, "uuid": "7b04643a-d2ba-4d5f-ba8b-615d0637cdb1", "comment": "Malware payload (XWorm)", "value": "736e7dd7177b85bb9d1b530074e43c0db958d338cd763c1c3f1595c3af8e2c73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535495, "uuid": "e5bd895f-9534-40b8-ac01-e9fb4d05dec6", "comment": "Malware payload (XWorm)", "value": "ad4268bda97df308178d9174b0a4439c68c5065f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535495, "uuid": "16d2630b-78e0-4b81-bf75-9764f7e4517d", "comment": "Malware payload (XWorm)", "value": "fb9bbdc748701e89bf855b83b82494cc5f2dc629541a66fd6827d7a0f4ca9e9aaf11dbbf6b215e035e115217864cb09f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535495, "uuid": "8d83f42e-adef-4c00-9307-d5df42285669", "value": "T1F637221AC9408EAD96D695AE40FD1E0C2D9C4BC1896ABDEE074D2CC0E78CD65BF11D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535495, "uuid": "fb48414e-0c17-4d47-a8c0-4e5b68304d51", "value": "49152:9wZwDwCwrw1wvwawKwwwgwQwupKaYwPwowswQwupKaFwNwHwxwKwSwCwCwxwwwUi:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535495, "uuid": "2fa27c8f-56c3-451b-9ce6-92fe36089cad", "value": 23164075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535495, "uuid": "1be43085-c6c4-4237-ab15-c0aaf2e805e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535495, "uuid": "293ce6b0-4d47-4d66-bde0-e23db06ed023", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fcf112-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535270, "uuid": "f4e80e58-87ae-4340-9f11-0c718dd3fe66", "comment": "Malware payload (XWorm)", "value": "9dbe6f7ac5a62102256a1ad4b83e4e9b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535270, "uuid": "d89e29cc-081c-411b-b81a-09c95e872799", "comment": "Malware payload (XWorm)", "value": "755ba621d339a4e3b75e5495034fe2f84316454f9c5c0f20d52e2609df57ad44", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535270, "uuid": "879de352-e4e4-4181-b6f8-6f917913eb85", "comment": "Malware payload (XWorm)", "value": "7a6a06d52c943dcb9dc87bd2d34d066b5014ec88", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535270, "uuid": "687789ee-1c38-4d3a-9aa4-667467ed6654", "comment": "Malware payload (XWorm)", "value": "5ce862ea31c64f1bcf386ec31e13a7f57c990641d5bd65b49a161a8ef50ce89c9cf12dc0f360cc65b094970abab49669", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535270, "uuid": "20043865-eeec-4b0f-b5e7-af11e825bcea", "value": "T11437234DCD39EBBC86F995380AF6472F5B750E14C06548D82276ECCFC63AB24BE85192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535270, "uuid": "e02a7c2e-8783-42fe-b477-d2b1e6a32c2b", "value": "49152:fjFjSjuj3jpjTj1jVjQjjjLjGhHu9j0jyjfjfjphHuQj0jLjujhjdjNjFjSjDjjW:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535270, "uuid": "89891362-3c1c-4e11-a3ff-e44a3de7a865", "value": 23424199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535270, "uuid": "ea669600-51a5-485f-b7f3-7abf6f5c3533", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535270, "uuid": "787593f2-037a-480a-bf07-3b9a04723d69", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d220f0-44c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777575756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575756, "uuid": "9ab2a95e-83bb-46ed-b339-49d47392f1b1", "comment": "Malware payload", "value": "b5da5e821bf567d47d552c446caab580", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575756, "uuid": "388b92f4-7a3e-4f21-a61e-e9b59fd6e864", "comment": "Malware payload", "value": "78adabc74abe03ac1917dd4503e5d8c76a7fb280bd55f37ad8b4697b1665ae35", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575756, "uuid": "aa648d17-38b6-4c86-b7d4-54e928578db5", "comment": "Malware payload", "value": "15221d127ca4cdfb788b8063bbdb7da66ab50638", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575756, "uuid": "98cc3dd3-5df6-4449-904c-9fa101ba5035", "comment": "Malware payload", "value": "c5f5d5e9ff1c51df22a3b3ef84800076841ec035a6f1b28ec69398f6f4428b61100efdc50d771c360c243540cde18be4", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575756, "uuid": "5715ecdc-7001-44be-962a-3e1be4e4d579", "value": "T13403AFB195B3CC7D5BC521AA98598CFDC901501657C486E8CB29FA1D2EC37A0EE1B2FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575756, "uuid": "89e2542f-44e8-4ede-83ac-2be424b90832", "value": "768:7ed5msnWnWGWGds7VjGIL1TQqSA7amiU2oDr+BrUE6KsZBxYVg3Mp9Vl0vB+GVCg:7DWGds7RLOqSA7v7z/Er8KUBBcp98vBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777575756, "uuid": "b7cfc0eb-c835-46c6-a9a3-5e16bb8ec65d", "value": 40847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777575756, "uuid": "d7311e16-362b-4707-b3cd-9b37b52fb92e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575756, "uuid": "5639a390-e3b8-4270-a548-11362dbd7e7f", "value": "igula.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185f3c2c-44e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777588187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777588187, "uuid": "b84f1496-177a-497b-abe8-21413aef7111", "comment": "Malware payload", "value": "e55e5c7d9554a3fb76d5cf49bf529650", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777588187, "uuid": "de50e842-bc7a-4762-9932-9aaa3cd0f992", "comment": "Malware payload", "value": "794846abbea20e47f4dd643c82fdc9548aaa687120e87e6886579f5d5b1745ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777588187, "uuid": "d546d343-95c4-49f3-a3e6-c29e8e949e60", "comment": "Malware payload", "value": "4ae72d6a8ffd9823ee3fb1f6078a87314ec2d47b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777588187, "uuid": "3488463f-b3f7-4608-8681-83cf2da3d2e1", "comment": "Malware payload", "value": "46b98c521a3df64bcf8b09195f5313022653ae66d3506d45d046a202c2ba1bf1ab739139ccc4d377e37be8e55581b231", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777588187, "uuid": "ecd40395-96b8-4019-8606-eb522f450c32", "value": "T1A6D02B15A0C747A931BC4CE35CD54D54503F380C3081888947669AA823190D1541DCE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777588187, "uuid": "e8c1f97e-c642-405a-8d7e-f4976d229695", "value": "6:iay2AOzckHHy7nhepbWBIxhVBepbWIcwGivkKLNmeH03n:iQFkehWDhWgGivkD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777588187, "uuid": "4fb84f5a-4fef-4d97-9be8-50edd40e5a57", "value": 249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777588187, "uuid": "fe18aaf4-45ef-4ef5-a672-a7853ca83bdd", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777588187, "uuid": "ad475d20-70fd-4d87-90f8-0cae0824d57b", "value": "83.168.89.181_1777588166937988_hello.world_ADd_allow_url_include_3d1_ADd_auto_prepend_file_3dphp_input.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b9da4f-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535591, "uuid": "542fd069-6433-4b2e-898d-59ab8f534a9f", "comment": "Malware payload (XWorm)", "value": "1c9ca020eac91d8ec69d1bc277ca0507", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535591, "uuid": "a9ee070d-93d8-4866-96ce-c460caa0dd52", "comment": "Malware payload (XWorm)", "value": "79ce22dee7148ab75a24bf3aaa9812c269b5436a3be18e3dad1496d7130f47a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535591, "uuid": "11f10154-368e-492a-81bc-3df9e5a1cbad", "comment": "Malware payload (XWorm)", "value": "37072184d1ed6a172f9ada5ff5a1c0755632b53b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535591, "uuid": "cd9fa763-7285-4b58-8bab-657199103dc0", "comment": "Malware payload (XWorm)", "value": "3c533770c71baad1f1b83148e160677576aa6a730dcea3e54b336e86164a00bad2f48b3a95067cbc50f34815ffe74971", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535591, "uuid": "4c39e7c1-1152-4e67-a5fa-6066f26789eb", "value": "T1ED37225E463DBEAB4AF4743D285B174D3BE88E540315A076779338A29ECFB2471860EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535591, "uuid": "cac04ffe-e5e7-437c-8559-371679780bf3", "value": "49152:zGWG2GcGrGZG/GXG8G6GJG+GNqVV+aMGLGIGeG+GvqVV+abGVGlGVGkGxGeGhGkM:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535591, "uuid": "c03992c3-47c4-4272-a2f6-d4bfa26b8f12", "value": 23944465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535591, "uuid": "67941d44-7f68-4210-887b-12696d2b07e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535591, "uuid": "d85b385f-1f09-4f91-8488-6baddeb3d0e3", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0270cb40-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514277, "uuid": "a35923c8-7104-4dac-b837-b9a539258907", "comment": "Malware payload (Mirai)", "value": "de8751a3cc770cf9d62c9a2752820913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514277, "uuid": "d23c92dc-5fcc-417d-b460-949bde9481be", "comment": "Malware payload (Mirai)", "value": "7a40a429467e9c34a8095e92f6f1042f4f8fa5b04a1d837ccd50ea75ab8a74cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514277, "uuid": "a384b348-860b-4bf9-9f87-32b1e7bce431", "comment": "Malware payload (Mirai)", "value": "69e086ba0482bb5d05c63019a3fb3f93b2854f5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514277, "uuid": "366c51de-d12c-40ff-af8d-ea648d746226", "comment": "Malware payload (Mirai)", "value": "edde7752ab7ad05eb744eb349859fc8c1a9bde7cb3278219bb5111a460b4ba1a9635e9681e4e8943eb467bb057125828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514277, "uuid": "eb6d2e5c-46eb-4433-9356-953a5b7bc3f2", "value": "T108044A62DD26AF8AC526A1F0A1F28E785F12BD2548170FF9A4B6DDF44143DC8F1097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514277, "uuid": "98a5502c-46e4-485d-bd37-3c4a6c86c619", "value": "3072:0abjEytIIQLHMVv+N7UhKTJB4SVWTDvAjbDj87nGEU:0abjEySIQLHMVv+lovTDvQDjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514277, "uuid": "9a98da10-de56-4c34-91e3-c3cf2363ba67", "value": 189588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514277, "uuid": "0ab65bb4-d444-4341-8762-bc5ea45821bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514277, "uuid": "7360ab03-99ac-4e79-af75-af62b28b805c", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c445061e-44a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777559699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559699, "uuid": "b8332df9-bbcb-4dce-bd7b-16e43c8dbccf", "comment": "Malware payload", "value": "115e08f24778ef85e091a2faffd67e9a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559699, "uuid": "f105b356-b879-463f-b71a-aaf4730e34cd", "comment": "Malware payload", "value": "7aeb5883d29932ddd6bb31bbb76816460a3a4ca60f6aa0cd12db906394ae7d48", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559699, "uuid": "4073e8f5-e291-45fb-a0ab-26ff46331948", "comment": "Malware payload", "value": "d47ba97ffc017d5b806e87b7a07a2c1d5dd8d83d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777559699, "uuid": "3144bdbe-b544-49de-a24c-6567fb75e093", "comment": "Malware payload", "value": "fa76913f49e4b5052e878c83ed03f940de18fbd3ec81530a1f1e2c53177489e63cdde560df1b5822a07af71c81b8afe4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777559699, "uuid": "f48822a1-872d-435a-902a-25e42abed646", "value": "T104136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777559699, "uuid": "1995cb40-ee41-4bd8-a702-0c3513721a95", "value": "768:bvls9NyXsZztCO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bv6HusZicy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777559699, "uuid": "1653da8c-bcc2-404d-920d-359962b60387", "value": 45441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777559699, "uuid": "e890a42e-1e05-46ec-9692-0c4c1e26cbbd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777559699, "uuid": "cc5913cd-9dcd-4680-baf6-3e6daf58060e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e778af1-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535423, "uuid": "0b2d1a2a-3e6f-41fd-9741-f82919d2db18", "comment": "Malware payload (XWorm)", "value": "60d8353cfe6921ae373c2cc8504be38f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535423, "uuid": "6a30c520-45e8-4ced-94d5-08b642d0037c", "comment": "Malware payload (XWorm)", "value": "7bf4e9d40b695c1dc33efbbd1f40cb1057e3e51de143034754a9b4775cdc7627", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535423, "uuid": "4e445fae-2392-464e-87c1-a20b63468347", "comment": "Malware payload (XWorm)", "value": "4e420b780e9b7a10be5394e86e2df1d94b7ecf49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535423, "uuid": "4290f9f6-8e49-4334-90ed-742710de90ff", "comment": "Malware payload (XWorm)", "value": "b7194cb2216a06c041f73c418df7c5f9b15467f68c20928ea371195c061fe09673a776a50373b960b7dd3acc9eacf1d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535423, "uuid": "5438b764-8ae5-4033-b588-99e27554c280", "value": "T14B37235B3E140C5FD7F0096C22DABA1E2AF5DC0284BCD7AE235B5C78A5279D1340BAE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535423, "uuid": "cc29cc7f-6825-4201-860a-3d00d82633c7", "value": "49152:StyAtyTtystyCtybty9ty/tyTtyStyZtyZtypjUtyAtyDty/tyDtyxjJtyyty+tp:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535423, "uuid": "0c20fd8c-a021-4818-8c5e-f83a206b2b09", "value": 22903948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535423, "uuid": "b120ba51-5884-459d-a538-98f38f6b4cc7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535423, "uuid": "57102af1-d68e-49bc-ba3c-4d2a6e92e937", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a52a24a-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536866, "uuid": "05269733-7d93-4647-a821-e89087041b39", "comment": "Malware payload (XWorm)", "value": "e6b4f00f6198d1af2db1fa7e139cf1d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536866, "uuid": "d010fdba-d633-459a-8282-95f6693dc52c", "comment": "Malware payload (XWorm)", "value": "7d4d2fd916b3026c5ab4484c1ecae9c71c21c047c604b85c32a8ab4101793e57", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536866, "uuid": "d06ea5fb-ad45-40af-8277-3d9136c3b935", "comment": "Malware payload (XWorm)", "value": "5f1fa8bc67eafd4adce9a9c480920311ab4efafb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536866, "uuid": "08f7ff0d-ab7d-4698-b744-aa2d131e4c35", "comment": "Malware payload (XWorm)", "value": "0a207c45332c5c394b71ae29e7514e04b52b0c9c55965126dcc60fa331e3194a53c670aa694053a697ac0aa11dcbf897", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536866, "uuid": "53f02114-ce96-478b-81eb-77f003322361", "value": "T1093723199A4A9CEB8279497828BD16CD71E85CC1409F7FE98F72294DCF2EF8B404D4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536866, "uuid": "cb599841-83e3-4f16-9fe0-a7755c094cb1", "value": "49152:QFODJ/lFODJ/GFODJ/XFODJ/EFODJ/SFODJ/QFODJ/+FODJ/XFODJ/lFODJ/oFOs:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536866, "uuid": "6830c61c-a503-449d-b6c9-58ea8b6c1dc2", "value": 23944457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536866, "uuid": "0a6f36a9-7195-45d3-b050-33d15942ba2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536866, "uuid": "f6b0bb1e-f543-4076-8e3f-78cb1a34b5b5", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b9747a-4489-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777549365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549365, "uuid": "a204b788-d3f3-4fc8-86fb-260d4d11a1a3", "comment": "Malware payload (AgentTesla)", "value": "feaa3b1d1f9e4407e5ebab514ff69600", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549365, "uuid": "63668d32-520b-4d56-beed-f951c53101dd", "comment": "Malware payload (AgentTesla)", "value": "7d61c99238da9f8ebf30ad4942027349aa32de6fbc01dcced458faf7464e2eea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549365, "uuid": "0c831e2d-4679-452e-a4ca-4bd16b7c3bc7", "comment": "Malware payload (AgentTesla)", "value": "f5baf95738c1f2cbb823547944e54b9d638192d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549365, "uuid": "273cd855-1cb4-4c7c-99a9-2cb9a83ab387", "comment": "Malware payload (AgentTesla)", "value": "c5a3ab0149001bf3a945a123b667d015da22e1b2f977c6e893b635945919c0b7f7b1b26a8eaae0efd0c8cf2ff9e1996e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549365, "uuid": "a6363d47-c6fa-4de1-8cc3-cd4ace89b02e", "value": "T159C42355B220E02FCB5457B11D7A9533AC9A7B7839507DA7A34C6B2FB0B92C6CD2F006", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549365, "uuid": "118f5b23-af89-448b-b5cd-39684cfd672e", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549365, "uuid": "169b28aa-4a88-4e4e-a4f1-a7a7dbacda33", "value": "12288:xbwuYWepE4VlJv71qOZp0J10glFCQj2dQ0cQJ6SRJ1I4X/EnX:xbwrE2l57T0J10glFrMQ0cWRJ1IkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777549365, "uuid": "2d007925-3976-4a82-9231-61c9c0d51003", "value": 547046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777549365, "uuid": "92086d40-7d08-4619-b460-f56e674db88e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549365, "uuid": "701d707f-babb-4076-bd00-f68056327123", "value": "Po90596934T9TUTJTT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39697d3-4489-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777549417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549417, "uuid": "178fc7e0-4926-416e-9c8e-739adf5f3390", "comment": "Malware payload (MassLogger)", "value": "7a343557366a65a6366e5b5ea02dbe07", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549417, "uuid": "71b7720c-f1c3-441d-a767-1a9627f4cca5", "comment": "Malware payload (MassLogger)", "value": "7d917f5ae5f787f893ef5d5e5581eecace130b1a15ab68400cc72c8c253a3fff", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549417, "uuid": "73032ca6-95f2-4640-99c8-505073b4f967", "comment": "Malware payload (MassLogger)", "value": "f7c88b28c005a54d54bcdf68b633407a0d33d851", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549417, "uuid": "36105ad5-c668-4efa-8eea-1edef284891d", "comment": "Malware payload (MassLogger)", "value": "455daf8ccf358a5ac848b28e8b5d72c2c550bb0e7843e1063b7e9e406cd1fdf7a4ba4f621288674adc9c82542d7c58cc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549417, "uuid": "02904a18-3208-41b9-b8f6-94c8c17c0e97", "value": "T195B5EAD545B08484F2D0FECBB64CFE2DC48CB1E2A899EA907EF65588A1427E31CF6D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549417, "uuid": "4c70d4b9-6ef3-473f-854a-1b0f6329969c", "value": "192:65k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5k5kO:reL/u3Lvrjf5jfMg8rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777549417, "uuid": "0ffdc710-efb8-460c-8292-4dfae3ed4228", "value": 2275244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777549417, "uuid": "e7ab8886-4d2e-4947-a7c8-f28a6e091e75", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549417, "uuid": "907222d6-560c-46be-8a57-ec40c70ab229", "value": "rrc90043123.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0453d089-44ad-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777564531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564531, "uuid": "60cb94a6-d2a5-4e93-a0f9-0645930bbccb", "comment": "Malware payload (RustyStealer)", "value": "ab1f8537f6160dbcda6a5d30edb09885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564531, "uuid": "a099a270-f9e7-48e7-9fb1-a273376075bb", "comment": "Malware payload (RustyStealer)", "value": "7de487e28c9dee3ceb40fec5aca690e2128514ce26929e46fa5442f76ab2439a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564531, "uuid": "3e0923ac-9353-4ded-af48-fc9f745fa469", "comment": "Malware payload (RustyStealer)", "value": "bc71c42a4600724b7b5c0d310a2da7d6101d62ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564531, "uuid": "a2e1e266-ef0d-4fc1-b21e-484b88a466fe", "comment": "Malware payload (RustyStealer)", "value": "9da590ccc642f5cdc014d29b32b4d831439f5f6212810d543a7251df41884869eb483191e0a3e3cd77e431b3d605e9c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564531, "uuid": "0de24a90-d97b-4688-ab07-5efb291cc9f9", "value": "T1CBE4AE47FA9652BCD05AC079835A8233E632B88A073079FB13D44A303E59FE66B3D755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564531, "uuid": "f2e06fac-2d17-405b-b812-21f43a4c8071", "value": "068d31f962d279038667cf141732e0f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564531, "uuid": "6c339367-0113-4797-8916-5931d4e197f3", "value": "12288:AxymUyg4fETw+xwqhRK06qwk3dBt+fXJjyYpHfXJjyYpHfXJjyYplZ:uyjygx869JHdBIBWYpHBWYpHBWYplZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777564531, "uuid": "89053898-2015-4e7d-835a-b77c95e2730b", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777564531, "uuid": "4cef427f-1106-4449-b244-5d79900f791e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564531, "uuid": "41f95dbc-afa8-4ec0-aaa6-fa6d711c880d", "value": "2026.04.30\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc4fa20-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777531583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531583, "uuid": "fe3890f6-3e9b-436f-aa6b-aa9b27454eba", "comment": "Malware payload (Mirai)", "value": "125463890d4d8f1547dc70eede816713", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531583, "uuid": "0eb5c5f0-46b0-432a-a54e-0b450c41994f", "comment": "Malware payload (Mirai)", "value": "7e888f45b06bc4e7a9c3eac4760e902f89024257d78641e9dc173aa60a3b339a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531583, "uuid": "e7f6190f-08c9-44b0-ae51-316171b4b58d", "comment": "Malware payload (Mirai)", "value": "b4c5c401330bacd361b38f63c378dbc049da7a5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531583, "uuid": "70ed7a78-f4f3-4816-ae8b-ec6e77ee8a8a", "comment": "Malware payload (Mirai)", "value": "23b62c1842c4e7327cf3c432dab3e552c9fc9a214600704352526bce77c16f75ca03bcbbafc6cf2dea9c5a57bb08fcb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531583, "uuid": "a0b0e22a-5302-4e5c-9b4b-4c2270c79bc3", "value": "T1B4053A06AF503FFFD82FCD3702A98B1A259D984722957F753578D804BA5B50B4AC38AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531583, "uuid": "ec1c4d77-b7ff-4d56-85f7-194a9fba4c43", "value": "12288:6nkIniT6B1HCb5QyMJhVzs5Y/QGbcVn6v:WkIniTAHCVQ1AG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531583, "uuid": "9af19e73-41ca-478e-a6fc-f0b77f4a3c4a", "value": 799852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531583, "uuid": "5562150c-254c-4f48-aa33-26fae1884ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531583, "uuid": "4f086656-0769-41fb-a62d-e908361c8bd9", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6be547-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535524, "uuid": "e83e6b54-13d8-4279-a788-6db8865fa60d", "comment": "Malware payload (XWorm)", "value": "8d01bd54975b0c009c3ab9f1e7a467cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535524, "uuid": "3377540b-8398-46fc-b004-32138bf870d5", "comment": "Malware payload (XWorm)", "value": "7eefe111bbbe08bb730fd626955282674f0f6f8378cabf89ef2bbbd926b53c2a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535524, "uuid": "2e23e1a3-6bff-478d-992a-c050e62a42d1", "comment": "Malware payload (XWorm)", "value": "4469f533bf1f63e330fc856a594f729b80ea7c08", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535524, "uuid": "ae21bdde-3318-446a-9ca2-fad4143add2c", "comment": "Malware payload (XWorm)", "value": "7bc2b5e3f9e0e975d12b231a8f759552b2e5de401746d890e6c9776068974c93f3c31b763991b42cd373cdd4bcbe6653", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535524, "uuid": "9134f775-47a2-47e6-858a-6c7e14fa739a", "value": "T1EE371307497FAF480E78035691BB5F154CE99F109A09F0DBAACAEC7E1C49D5800E76BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535524, "uuid": "b1cdd71b-6916-471a-9819-d3676cc590ca", "value": "49152:T16EK9L16EK9r16EK9J16EK9516EK9o16EK9616EK9D16EK9416EK9316EK9R16l:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535524, "uuid": "5e2f7638-5600-4bae-912d-f78dd501d571", "value": 22903928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535524, "uuid": "edec25f3-6abd-43ee-91b5-9a7d2cd382af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535524, "uuid": "145fb8eb-30c9-47c5-9a26-0dcf2d35197a", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b22cce-4496-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777554685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554685, "uuid": "f0c67ea9-9985-477e-a6b5-2d4781125841", "comment": "Malware payload (XWorm)", "value": "7cc1da433e19987f29e99406dbbad489", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554685, "uuid": "0b9eec3d-d773-4238-a65a-7510df3c1c4c", "comment": "Malware payload (XWorm)", "value": "7f6bf838c8bc5c762367c5c1af278f8db83aa4fb32ab0a6154ec06df27f6aba5", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554685, "uuid": "f3d75b60-ff2f-44ce-964f-37d7d682e481", "comment": "Malware payload (XWorm)", "value": "2d70c13aeb194f5a058714f2077a9b486e70d541", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777554685, "uuid": "6fe2c4c9-11d1-467c-a68f-21c9927f1da8", "comment": "Malware payload (XWorm)", "value": "c162b96d06911f726d6b2e747567343a1fa23f20a11636cf9d47e81fe2290a7304e2ef6cdf88e86250e1adf33eba914e", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554685, "uuid": "df09d14b-56c6-406a-8de1-957e5fd02bd3", "value": "T134867F4DE8E7B051AD2199C31F9EE7F1091E6316B89A1C52357C034847D48FF2B8BA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554685, "uuid": "d023eab3-f1ea-449c-ada0-ba7b1bde7ea7", "value": "2ac0c4d3fec4c7e9ce9158815bb62c6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554685, "uuid": "b3d16681-b175-4a63-9539-b5ffb7b088d0", "value": "49152:GyyG8QBnAkFtkNNNl1+C33BZgxhm9oN2zmtbxLYhEm6QVneRvoDFMFydkHE9QkZc:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777554685, "uuid": "8bb27ab2-2f97-4c78-9830-615e5c63133a", "value": 8070064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777554685, "uuid": "a6fc18d7-0188-498f-8e89-4a9b99d95f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777554685, "uuid": "23490d31-4ef3-4518-bd58-166a0dfa2848", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4167ca10-4489-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777549172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549172, "uuid": "af5f0c20-73aa-40a7-b481-14b5a5140776", "comment": "Malware payload (Mirai)", "value": "abb30c2832bb9279d25fd3d1caedb0f8", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549172, "uuid": "fe2b4601-88e0-4db3-9137-dd14c96885bd", "comment": "Malware payload (Mirai)", "value": "7fe57160af3d0340cfb4cb315bd91ac18312222cdbf58bcbc43e4bb544237c52", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549172, "uuid": "ff1abc13-0362-4a7d-91ff-ab58b5d54fef", "comment": "Malware payload (Mirai)", "value": "87e61e6ffcb8cc3675f5493f5a5148787890863b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549172, "uuid": "437c88db-cfbf-4842-87cb-edcbb6f2d502", "comment": "Malware payload (Mirai)", "value": "1dde7cbdeec972ed208a53d7b56457e32392bc12dcb23d0a9d695ade405f7bdf6974cf5a9da55e353a1ef2259324ca1b", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549172, "uuid": "56ebfb7f-a5ad-46ae-8dca-4ae9aa6ece5e", "value": "T1CD735B03B642C6BFC49BD1F407EB9620D972BC6E19327299A7D4FD916E59DC02E1D320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549172, "uuid": "9c6604c8-3ee1-460a-9fc9-8dd221d120b5", "value": "1536:aUJeFRAk23y4leZgrZNg45wl3KxS7T3mxnCfBu:aqIAk/4keHgGsV7rf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777549172, "uuid": "e6b6246e-c721-4823-9ef3-34eb54c6d855", "value": 75072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777549172, "uuid": "e47ec8f3-2ccc-4159-a5c9-134bb657396b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549172, "uuid": "0d9fe351-c4f9-4e4d-90c2-91df8aa86d18", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b50de0-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777531496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531496, "uuid": "c8998b55-a7e9-4741-afd1-4da6ad8f42b4", "comment": "Malware payload (Mirai)", "value": "8607f189604f1f32892f9d01692e3cb9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531496, "uuid": "53a6caf4-7397-4ba3-976c-bf23155fa193", "comment": "Malware payload (Mirai)", "value": "823a76588b7ce2dccfc273c452651334e95417f505d93fa40c8330ed963cbb21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531496, "uuid": "5a091572-622c-41ff-9866-50dd824063dc", "comment": "Malware payload (Mirai)", "value": "ffea5d97688a7d889e9bb38e5e6b129b6db62d75", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531496, "uuid": "32905c84-fc7b-4b6a-bb2b-5a3055b30096", "comment": "Malware payload (Mirai)", "value": "70ccd601a009bf83cf720e45e662753125911bef6a1cf2faafb917f1c4af108f402be75444f61c1dcd5cca9e7d739009", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531496, "uuid": "4655bbbf-814b-40fb-a2dc-ba75159c69c3", "value": "T15AF47D237701CFA5E368D27006F3C66059E425A30FE3459A6278D32C7E2166D796FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531496, "uuid": "f57bc6bb-e72e-4ee4-8981-c7d336d87f19", "value": "12288:5bjg+XdEi6gednRg6/zZ/RdanwUICfiECOKTzoDi9rQWjCScfyXenkLZgzSQphXc:7tEpRdRR/zQnw/pOKTzoDi9EWjCScKeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531496, "uuid": "3cc0a719-2bfc-471c-8368-f46a478fbd64", "value": 758800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531496, "uuid": "daa76364-0375-4038-89f7-43034d77a717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531496, "uuid": "8df0dff8-928d-4cdb-aaa5-2895ac99ab11", "value": "agent-mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6007803-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777537019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537019, "uuid": "92f1f188-1a9b-414f-919a-10346f41c6ca", "comment": "Malware payload (XWorm)", "value": "f9ca4f6e49017e249d270e4efe623850", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537019, "uuid": "3908b258-abde-40f3-8b0e-a1c891318b37", "comment": "Malware payload (XWorm)", "value": "827dffb8ce33963b7c057fd4d885d83d7f51ae494dde7123c1b103c7f4ebddff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537019, "uuid": "05d1e951-77b0-49c8-9a78-a3750affe2f1", "comment": "Malware payload (XWorm)", "value": "047a353995665a56771cb1442ec7bf6b582cbebf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537019, "uuid": "f54fbcf6-098a-49a2-922c-5647ee42dcbf", "comment": "Malware payload (XWorm)", "value": "fd26e47687a4336904a087089d9c67f60754059975b1831ad048bf49f3ca5d7f03e6ecd2b125c58f2210532529747dbd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537019, "uuid": "ab33f83e-85ca-4106-a1e7-6b1cb1a32fd7", "value": "T14E2723598E25DF14085C60EE116F1B535224CC088A76F6E5F398FEDF7B1B96C32A13A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537019, "uuid": "fb4a36e0-c8fa-4732-853a-9028dbcfd33f", "value": "49152:hzaBT2FzaBT2OzaBT2HzaBT25zaBT20zaBT2azaBT2azaBT2kzaBT2xzaBT2gza4:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777537019, "uuid": "5ed932ed-035e-4031-9f1d-ddef0220bb35", "value": 21863417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777537019, "uuid": "18054d8f-e96c-4f5c-861d-0aec9bb116a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537019, "uuid": "f85e0a28-31e0-44ec-9e0e-642651214efe", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ca9bb0-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777531488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531488, "uuid": "7ade18ba-7695-40be-aace-796cc2a8a27b", "comment": "Malware payload (Mirai)", "value": "e5d50131332d93cbccaaf4525d5c2ea4", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531488, "uuid": "58ae000e-d8d6-43e8-b9f7-98a89ce74878", "comment": "Malware payload (Mirai)", "value": "84144beaeef81a22f9f82147e1cd131ff23884f5930e148782e056c2477ac1dc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531488, "uuid": "f39b7324-bf26-4cfd-b7ad-2d8c0b3065d0", "comment": "Malware payload (Mirai)", "value": "f17544cfbf61f80f2cbc3ad8547df4e47123bee6", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531488, "uuid": "14383d67-235f-41b3-a5b6-283d3a126268", "comment": "Malware payload (Mirai)", "value": "ed9ce8286bf5039a3a21c5426bb72aba24f175171e250036f196a9b4bee4f8049125bbbaafaaa44af02e1b4a7f6df1c8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531488, "uuid": "2e2cff15-4755-46ec-a1fa-2626f46d4b75", "value": "T196D43949B8809F62CAD53ABAFB5E42AC73534B79D3E671059E150B3037CB85A4F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531488, "uuid": "6404525a-5124-468c-a63f-a2df5c21428f", "value": "12288:tpPzZg1muHsehcU8PanQFnUkheNtTmUYkh8fQIATkImVdcJCdskf73dT4prmJQpx:tp7Zg1bHian7kwmdhpqmM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531488, "uuid": "fb8ac4b7-6e79-499f-9811-d695e921d7e4", "value": 599288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531488, "uuid": "da0e35de-0f40-4384-9af0-8d205c315a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531488, "uuid": "d29508d2-6529-4a87-9d60-0ef05d4c8eaf", "value": "agent-arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a53e19e-44bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777572407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572407, "uuid": "6fd8f857-ab43-4faa-9d7b-e03caa1a638e", "comment": "Malware payload", "value": "ce6a18a42bbd1e3d01b9f46997dcf978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572407, "uuid": "d2327e2d-f72f-4f71-8a3b-fa7cef77fe10", "comment": "Malware payload", "value": "84287db9b35beb4e7e4eeb2bdd220c5145575e8e247d165c7bfac17070b9b3e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572407, "uuid": "c899bec6-c35d-4962-84d2-ad31190ed0f0", "comment": "Malware payload", "value": "70b70a8a61ece829ae3eb9348fdf11ad3309ce8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572407, "uuid": "ce6f882b-4ce2-48c7-95d1-83b174416744", "comment": "Malware payload", "value": "9b5387963ce0017a23c4592a220f2f3c2a3c2eb0bcb105b73063625f80bb962790750d7c0ea262d683728cbf5e7c57f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572407, "uuid": "10ac3d32-9c8d-4092-a5b9-437e1c124928", "value": "T159834C18BBF84E15E9BE877D14F242010BB0F4265927E74E0EC51ADD2ABB7A0CD507A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572407, "uuid": "13728023-e1f9-4d5f-a89a-651c61fffe2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572407, "uuid": "fbd60a7a-e851-46a4-811a-05fe2d859dd8", "value": "1536:pXS1giApyy9H8YCb1KPI+2QJ5x7c3U9SI9i/Snw/:pXegig9HwboPI+245xgU9SIMqnw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777572407, "uuid": "f616e819-d70a-46a4-8cc7-8acd42b9d2b9", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777572407, "uuid": "bbc82f1a-f3ed-49f2-a7fa-429b32af6a54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572407, "uuid": "4d998d53-cb9c-433e-865a-ca45ecd0bd04", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56168bee-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538469, "uuid": "07fd04c6-0b18-4de2-a397-12594d51f2a5", "comment": "Malware payload (XWorm)", "value": "2154fa79b3e0b7663a17c7539fc18653", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538469, "uuid": "b46d85d0-6171-4dfe-b1cc-578504ff2a20", "comment": "Malware payload (XWorm)", "value": "8437609c1130726fafc08ae3cb3cb00f6252e3ec695abc3ef37f8d576fab0634", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538469, "uuid": "c6cf7604-9b59-42bd-8128-6eff3f70e0db", "comment": "Malware payload (XWorm)", "value": "3a2a1b3ffeb24ff615110b45e1ee684a791a3b7d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538469, "uuid": "725401ce-0b37-491c-8d70-fbf731ba54a7", "comment": "Malware payload (XWorm)", "value": "e29bdd0cd4ccafde141a80ac2cfbda723c0b98f8821ba1dc374eedbdf8da7687eb0364cab2722c88a93d894c1fce1314", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538469, "uuid": "987430e8-0c22-4601-a772-785d71d9ce20", "value": "T1193723639D369F2C0325234C302F2F9FD4740A19AF91D89697EE76D8CE99ED819B6340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538469, "uuid": "68839032-7c37-4285-aa6f-b6ac6fd2997b", "value": "49152:yqRDpqRDkqRDBqRDXqRDYqRDsqRDPqRDwqRD8qRDmqRDiqRDWqRDdqRDH:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538469, "uuid": "72e1e7cd-71cc-47c7-a009-8f7d9d5115a9", "value": 23164063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538469, "uuid": "00c0ea1d-d23f-445a-b703-fb4c0313632f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538469, "uuid": "cb77b6b2-e327-4c1a-9b49-6196df9b5c62", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45be5dc9-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514819, "uuid": "97a8ee70-c039-40e4-ad63-2cab19ce92f5", "comment": "Malware payload (Mirai)", "value": "502cdb4a21c722671e2dd12ca9f49bbf", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514819, "uuid": "e852f648-e33f-455c-9909-531d3eb4da0f", "comment": "Malware payload (Mirai)", "value": "84393056121c85f513925b8d275e2588eb43c3ab3c6dac17ffdf9245fa79f68b", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514819, "uuid": "efe18a87-8335-45b0-bf13-80dcb58e92c5", "comment": "Malware payload (Mirai)", "value": "6e67049bb3a9fa60d96be2d8a1608cb6f5a3e6a2", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514819, "uuid": "6c4f7c55-a327-4704-bbaa-92a19ea2042d", "comment": "Malware payload (Mirai)", "value": "952c4e557a4e281d5574f2b3b04bb15ece8e563e7ce6a7db0f7e33ac6da28da1749d722d0b49ea7abd5f879df2de6015", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514819, "uuid": "549933f4-b75c-494f-af31-46d02ed45433", "value": "T1665302772664C06DC475CB374B1CCCA2837A41189B648A57F6A8B5BF2D81D04F6A0E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514819, "uuid": "58da8df9-1407-4ba7-a0f0-9adc282a655c", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77SshejeWAQI:cSn9jaBybw6E4yUu707bhegQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514819, "uuid": "676b4146-4e68-43c6-b325-6cb3481ff9f0", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514819, "uuid": "d724732c-bd26-4235-9041-3e3ea9fef06c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514819, "uuid": "d6dffd4e-eff0-4b7c-9182-c81e44f6b06a", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412915ef-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514812, "uuid": "b93cbf53-b9a7-4d73-8674-54945844a239", "comment": "Malware payload (Mirai)", "value": "6cdc04f31da43ed54aadf04ac43880be", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514812, "uuid": "60e471ae-5711-40d9-8cb3-659dd1214417", "comment": "Malware payload (Mirai)", "value": "84d0b566c811e65a4d340d0fc1f8d8fb1031d578a5a05b605b54b52009413d77", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514812, "uuid": "c09a69f9-df8a-4103-a6d5-5e53128f8f83", "comment": "Malware payload (Mirai)", "value": "dd43b2a3007d437dfcd1f872a00517e0307bae59", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514812, "uuid": "1177f765-1511-4261-992c-3440bbca0f4e", "comment": "Malware payload (Mirai)", "value": "d4f7e7b8ce6c30b080c11278e8724139680ddb7f6bc947de73d1d00b97f777d595098d684c8ded21abf95116b741b071", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514812, "uuid": "a86fa6a6-0ca7-497b-a9b7-4e6f1a837d0e", "value": "T1E5B3AF87B2907ABEF0A49E3FC4135E26A6259F705583173D71BDF9906E3A3503292E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514812, "uuid": "d66a0596-1087-4028-82ac-0edd18cfcfb3", "value": "1536:toOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzm8rSx:t1xKlGWnqTUcXgZS5gZ7CSXhSfUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514812, "uuid": "2d61e1da-7264-43d0-a695-a3b84c5a7093", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514812, "uuid": "91398067-e183-4615-8cca-5c4c1231cf5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514812, "uuid": "77f0f11f-b373-4c6c-8cc9-3991be723b1c", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cf5244-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538442, "uuid": "00c2ccec-ae60-46bb-87b9-91477c97cbdc", "comment": "Malware payload (XWorm)", "value": "812e9aa3320db6c672f89501969a61d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538442, "uuid": "019b3f46-7083-4209-8509-1709bac4c580", "comment": "Malware payload (XWorm)", "value": "861ec77bf5d806f7cc07e1c9eb304ac5bb2f98c0bb07cc2a941bfb2f862e7432", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538442, "uuid": "13748df0-4f22-4da7-b75c-b45717cbc2f3", "comment": "Malware payload (XWorm)", "value": "a4d9ce430d0d74317e162faa4618d5ec9576200c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538442, "uuid": "37e39dbf-3342-4830-84a6-825c0361c7c5", "comment": "Malware payload (XWorm)", "value": "e37114b4e69b4a0129e3466d103afb74e50ad0570e1dc2ebbbacc6d0616092c62fc518ca7fa7e37e599490634898639b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538442, "uuid": "c0a0656e-e8ff-44ba-afac-4d69b128656c", "value": "T1812723064BAF4D1E4B785A3C20FF0A0E31F81F19925237F83AE564CD6E4ED6A958351E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538442, "uuid": "ee20bb42-d170-4878-9ed0-1d65c1aafb00", "value": "49152:N4lhww2flXVfgRhEwISeFiX0+Iu0/sqRueQ6cdgVRolheG/TnJjIOzAzQtzAz/ZP:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538442, "uuid": "fa2d4ce0-dab7-44c1-bc4b-91b1a5d48f8d", "value": 21863435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538442, "uuid": "627d2ee6-7c42-44dc-af28-d69ef6dac79a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538442, "uuid": "aeb3e4d6-7955-4784-94f0-5a4d58fc8440", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5b1188-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535418, "uuid": "db356f3e-5f0d-477f-9b11-b7bee145646f", "comment": "Malware payload (XWorm)", "value": "528ac66d191dc46e91e1002cb29af7ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535418, "uuid": "8b6b1fae-812a-43ac-a040-f469aa2c2304", "comment": "Malware payload (XWorm)", "value": "863cb47c6bf5e3f9c3ed42de89472952e79ec61327c8dc3037cf6b92a28fc7b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535418, "uuid": "95634ac1-1147-4c09-b452-fbf96e6678d0", "comment": "Malware payload (XWorm)", "value": "e0dba29cc089352cdb0bf30cd302a6f7edfad584", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535418, "uuid": "4579ab5b-bd5d-44a5-a3eb-ef590d7449ac", "comment": "Malware payload (XWorm)", "value": "5261b142b3ca3c10e18f8eb3b39cfc2baa304f08e1737c9f741ab27e0a714782cd5ec37af996f4edbd0eaa5d1e95088f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535418, "uuid": "208f6770-9f87-4a15-9ceb-498b5a50549b", "value": "T1723723024ABA8AFED6EC724C64BA475B2A7D4CD08024DC5132DA33951F1FF1B936F592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535418, "uuid": "a6cb78b4-a72b-426c-a3b2-c6586eb61f25", "value": "49152:jaRIaRGaRzaRxaRqaR0aRHaRjaR9aRJaRxaR7raR5aRlaRoaREaRT8aRJaRCaRjn:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535418, "uuid": "77ca9a10-cbea-4356-a22f-24b8a3025583", "value": 22643817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535418, "uuid": "bdd7d466-a93b-4bb4-86c3-5b5a4ad323f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535418, "uuid": "09b94e61-0a53-4f36-9fa5-4e3c4c036962", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5da5ee-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777574210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574210, "uuid": "aeedbb9f-2f11-42a6-95d2-bb2c359d1dd0", "comment": "Malware payload", "value": "89e63eea83080ca6fee0157d315246d7", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574210, "uuid": "c830e72e-b201-422b-afce-c9af0efc0120", "comment": "Malware payload", "value": "8764960b8bb08da880ef3c3799e22d29a457eedaaa08c0e99b7931ba5c9a4864", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574210, "uuid": "5d52eac4-b902-4aa8-9e07-5b902aba72cf", "comment": "Malware payload", "value": "40366fc98bc4d5d770f2ff115bee45be40aa3f9e", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574210, "uuid": "a783a317-a1c6-4ad8-a641-184de52a7a7b", "comment": "Malware payload", "value": "cfa650abd55ce200a2e465eb293781c0fcc4a01bf1ec51adb3df429b1bc1a0a850287e86ade1b6dc1cc1fb7d9b9e3b94", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574210, "uuid": "4f9b787b-5585-45df-865a-7721806c5a9e", "value": "T141B28D0DA3168DF01FA69F234C3586E893AC9D4A3981D6BBE31875B20C85935F7F2970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574210, "uuid": "27eec3bd-9d7e-45fd-9ac7-d1364382413f", "value": "384:uIs3dZRb2AmZKOw/O+zGRzt4/egtlPcHKtWCRPWw5Er6DPSX5ylEC2NTFclWM1cR:uIs3tBCzwGfEei2HwWC4w5q6rS5yv2NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574210, "uuid": "ed4b62b4-dc4e-45ee-a88f-f5d27ecff05e", "value": 23444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574210, "uuid": "ebe574f6-272e-458b-bfdd-030dd6d35c29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574210, "uuid": "7f9b8629-b2aa-45b8-b009-67d0fdcc18e5", "value": "ebefu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21119e1-448d-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777551186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551186, "uuid": "4fbf3a12-1f7f-435c-acb3-158eeacf1b2a", "comment": "Malware payload (Phorpiex)", "value": "80f9e6701d469016b713faeac1ce73e6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551186, "uuid": "62b39144-b13a-4f67-ba49-f894f25e76fb", "comment": "Malware payload (Phorpiex)", "value": "89286d1695ff14ad238088f42a59c7ee191bb417e39d769b9b550b83821ee8db", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551186, "uuid": "ae3e3d99-6db0-40da-9df9-ea6f88a6ba47", "comment": "Malware payload (Phorpiex)", "value": "76d9143c20bc7c932b22ac1cb7e4bc2215040a27", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551186, "uuid": "a28ac569-a49b-47e2-873d-9c98435c1b25", "comment": "Malware payload (Phorpiex)", "value": "8468daa6c2cc09c20fdf57f7c0f83d6c2ffb7a7398bdc93406872bbed496db7765b5154d97f5b6c59fdb7c9ccafbb262", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551186, "uuid": "e35c76bc-02df-46de-9754-f8973c8c3719", "value": "T145824A0FB8024226E5D110788663463BEA7DA4B5378064D7F7D48ADD4AAC6D1F83B26F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551186, "uuid": "e9e197d5-e965-47b3-b810-561d1a013514", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551186, "uuid": "c78a793c-a4a8-4bca-a73f-52b98175966b", "value": "192:i/IAASCngTBvHVZUxTn6VUbQQ8+OL3LvleQtLQKUSfPzwxT0jnsLmJxTmv8U9ctA:iiIHVitK3Q817v0YPqUDav8U9cy+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551186, "uuid": "b994a543-b3da-4672-93ab-8623e7e2bcca", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551186, "uuid": "fc8ace61-60e9-4d29-bbf5-712db2e5fd73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551186, "uuid": "061adafe-1b93-49a8-9328-92b926bd5ff6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07319c68-44ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777592024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592024, "uuid": "8a91e8a7-b422-48a5-bfcf-7aaed064a4d9", "comment": "Malware payload", "value": "22945bf9fcd2de70a5971ce804e7cac0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592024, "uuid": "970b27e8-0b78-4b0c-afff-1d0b5d76b5c4", "comment": "Malware payload", "value": "89772455de77245d33a540bc20da985af6dd9769d71a5bded8f82d0521b9fec6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592024, "uuid": "5fa8f797-799d-45c2-8786-27b96f6311ae", "comment": "Malware payload", "value": "2ba92efc8db75ed8671e80826627afa5066fb641", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592024, "uuid": "5fa3863c-e0d3-464e-a436-c484691467c0", "comment": "Malware payload", "value": "0f03d6554cd7a40d28c71fe0ec9426b6475ca5fd75804b4b72ce0dbbdd5c1a4c34aa32b261af0b756428afaed3849f27", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592024, "uuid": "35a522b8-20be-4534-9837-439e92fde816", "value": "T169B2E78C3AD6B1790251B4BB3D2B764F7A2E4D8461CCC124FAADD698FC35308F566934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592024, "uuid": "f07feec9-72c3-453d-883e-d799656e9eb2", "value": "384:/5Szmv5bowEmcPMKIlcWZEcJ40yR5+bYY0miiD0LDclYAOLP9N1:/Ye5b5cPMLlcW6o40yz+bBsb31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777592024, "uuid": "186131e4-6d44-4c66-9d2a-70af689c0571", "value": 23520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777592024, "uuid": "13ac80d4-22e9-403f-90ea-02431d25f0fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592024, "uuid": "c54cb1ed-7994-4490-88a7-8db1a4263ba6", "value": "Rendel\u00e9s_HRCGastroKft_20262265186800000211.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1990820d-448f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777551682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551682, "uuid": "239bbda6-30f2-48ae-bc8b-4b297efeeecc", "comment": "Malware payload (Gafgyt)", "value": "8158f50497506f976a3118395eb83423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551682, "uuid": "70f18923-bc20-4e51-bd6d-2dea84ce84d8", "comment": "Malware payload (Gafgyt)", "value": "8a82c5eeb9187b9debbfe087114ebbfc8adcca04991109155e475f21513ffd2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551682, "uuid": "4ed6af65-ba5c-43a5-b28b-97071204b5e6", "comment": "Malware payload (Gafgyt)", "value": "34725c2e9049a66d4a34987d4195ee2da0a2cf89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551682, "uuid": "8d71532b-e0ba-4fd4-8f6e-5217cc31b55e", "comment": "Malware payload (Gafgyt)", "value": "b55ca7b501292435c2149c42e227506713bf470be0bbb901d8fa94ac8e6c0768c0599c40667aa18d6d83e0b969062604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551682, "uuid": "02250423-2d4b-4141-977c-0c6b6209c39c", "value": "T10D054956F8809F62C5D125B6FA5F82A8731347B9C3EB710699188B343BD782F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551682, "uuid": "558c0c89-0c27-4bdd-81d0-5933afa16235", "value": "24576:YT2PSaqCsmbT3+WNcDxUmqSmAcMChHoNU:DqHmbT3+RDbv1cMChb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551682, "uuid": "418a232f-0a8d-4354-a031-ae232858ecd6", "value": 854592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551682, "uuid": "78b4be6b-e65a-42d3-95df-5dca20bc2a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551682, "uuid": "9bcf2192-c822-449e-a262-d1dcb1053650", "value": "x.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018cee79-44ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777576982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777576982, "uuid": "f6df0612-e034-4a94-a800-5b08e7352078", "comment": "Malware payload", "value": "dd1cc5eead8faae79b8fa76a50eab271", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777576982, "uuid": "d59eebc2-710c-46c9-aeb1-bd8f2be6d31d", "comment": "Malware payload", "value": "8ace50c93fc1271aa9305f635cdacd51ec9f4f9cb2b5d3c9f15bc7a427333aa4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777576982, "uuid": "a39c7bf5-01c5-40d2-b519-cc6a934fc4bc", "comment": "Malware payload", "value": "449d7a4d5e6564f59ad3650a1467da126a2862c7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777576982, "uuid": "b710eb2d-e07a-4b58-925e-724f2fdaa894", "comment": "Malware payload", "value": "e6a6e550ad27bfa1310ede5d188538ec5088ed0383f862b3154811fe9777ac2c14b1eb17a58e325a4ab31c0fec60fa8e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777576982, "uuid": "5466c152-0489-48a5-9cf4-005dfc81426c", "value": "T1AC11F1023BE91208F2F33E58AEB915651E26BA75FC38CB0C44960E4C08E1E549C76FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777576982, "uuid": "df38f5aa-7a61-4278-a099-d8365562704d", "value": "24:Q2L+SSUJdQyfzuLTkX16lV04KCU00S6Q5ETfVaD:mSKyfzETUT4KCJ5ifVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777576982, "uuid": "f7398d14-a670-472f-b57d-55d9dd3c3bd2", "value": 870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777576982, "uuid": "db3a4f54-9d00-49f4-b315-35b5dd35cc4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777576982, "uuid": "316dcd08-8eaa-42bf-a78d-c1c2419fb5ef", "value": "verification mcs 150.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcd9336-44be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777572087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572087, "uuid": "145d4829-0c5c-4a58-b517-c0820d95ecf5", "comment": "Malware payload", "value": "f365d772c85a2b1484ed8008791d1782", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572087, "uuid": "4a02570a-3ac7-4c1b-a1e7-a21a2a57b025", "comment": "Malware payload", "value": "8b002c2daf45f934bf66abba01a308805cc1e3b9cbfcb35ea496a0a770ac60a0", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572087, "uuid": "416f9285-22f1-48d9-bc9c-bc66d1356787", "comment": "Malware payload", "value": "4c43de2a20b4ce59677a859d7f6c8ea0b9689f6e", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777572087, "uuid": "3ec2914f-79eb-4fee-9e93-c0c591111a46", "comment": "Malware payload", "value": "1b6f767251fdb9bfdd59569cb8bca9be4ed1636e67bb4a5683086f51f08ea0e3cb9e5f7c323163af05a39637a173728f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572087, "uuid": "43a86c22-12ba-4c24-85fb-4656fed53541", "value": "T1B2E633B68A910966F99E143CC9F92D2810ACDC6F112CD340BF36F57439CB7CA597BA12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572087, "uuid": "bf4f7a2e-c8ca-4875-bb64-23f5ca52798e", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572087, "uuid": "d5b8fef8-e7bc-4bc9-acca-db25518721a7", "value": "393216:5wMp/2KuJj1oBXdcosRPthhz0E8RIOhLApfZbXgj:5Hp/iNaX9sdtbsXcpRbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777572087, "uuid": "3b9fb7eb-a1b6-4aad-b04c-ad68959a821f", "value": 14432778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777572087, "uuid": "2be0d24d-4c07-4d66-a69e-2e1e7e7323e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777572087, "uuid": "de61e18c-de53-435d-9c0c-e1a99c11dee1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1c2560-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536976, "uuid": "9e2a8a48-fe6e-4508-b09b-849d536c7ca3", "comment": "Malware payload (XWorm)", "value": "f4b9503718812b6d0ee4b89b860e5983", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536976, "uuid": "362b618b-2a19-4e60-bb29-6e12c9013dbf", "comment": "Malware payload (XWorm)", "value": "8b15e3e4a1d928543d962e7318f1617aa35ebdd9e447bcfce51987bc5a171188", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536976, "uuid": "882d5e52-af4a-47fb-8f47-3c44acacaaff", "comment": "Malware payload (XWorm)", "value": "14e9dba4ab14ea1cbd98b11425316c58d388ef64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536976, "uuid": "6e3b9455-1edf-4555-9ab6-7f2f05ca5241", "comment": "Malware payload (XWorm)", "value": "5ddc571b4580f03ce91f27d887078c2685bfd5e1df104c49262903fe7af6b7a6dad0b4e132dc909309945b7915a60376", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536976, "uuid": "a13b8a1d-9675-42dc-8bba-d5e4d19dd6e2", "value": "T10E372313AF3BDEAEC2A922153D58519F7DC74508A612C4C8837E79AFD16C3B1321A367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536976, "uuid": "f7eea20f-8920-457c-b8a0-99b5e712bda6", "value": "49152:wvSO3vSOpvSOjvSOPvSOWvSOEvSOvvSOyvSOBvSO1vSOEvSOBOR/sECvSOdvSOK4:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536976, "uuid": "1ce90608-e727-498d-aafb-b355f7959fa2", "value": 23684330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536976, "uuid": "c4a1471b-8009-4add-bef9-c2965af8368e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536976, "uuid": "00ff5e69-5c58-4de4-818c-425e9de784e4", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed29a98-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514808, "uuid": "ef0a2c42-9d3d-40cc-8933-4f6cc1545dfa", "comment": "Malware payload (Mirai)", "value": "5c9264f3d5587bb6d8a123bd14897558", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514808, "uuid": "260aa4b7-6e8d-4f0e-b2f0-7baa02bb66cb", "comment": "Malware payload (Mirai)", "value": "8b215223e158a907955322d896f54cfa81aa13fc08ee21f44bb9febdc8c2735d", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514808, "uuid": "15704ba0-b201-4db6-ba1b-f92754e448e3", "comment": "Malware payload (Mirai)", "value": "bd142508784cb9be716db229fd83ba698c1b18e3", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514808, "uuid": "695d3a0c-8595-48fd-a8c3-8d9c7f4abf69", "comment": "Malware payload (Mirai)", "value": "3b190302a77900c1cf1dc0ede638364cd115b8f886cb16a174e8d4ba7a6538148d7d00a310664938e987524983cd12ac", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514808, "uuid": "b7c58164-dffb-41d1-9871-48e20d2baaf2", "value": "T1456312BA553A7D4FDFCC6B39485012A96048D3E1F3B3A82074DBC4899B5A23FE51C762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514808, "uuid": "5a7a686e-0232-47f6-a593-7d8de8201246", "value": "1536:oVUQ0TcrWCT3gcHB+cyepg1k/zJhw7nWAvnQGUgJViXZjb5NX:yp0T2WCbgc8bm/gCAv3Jwpjb5NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514808, "uuid": "5a05fbec-8778-462a-9319-e670ed5facb2", "value": 70428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514808, "uuid": "5b4c1c33-3a2d-4e98-950d-7d75f9eeb500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514808, "uuid": "3db5935e-3215-4386-9511-ac8d6fd50f21", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7635aa06-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514901, "uuid": "14500043-c526-4b0c-aaff-345ebe2cfdc6", "comment": "Malware payload (Mirai)", "value": "eacb3a21efdf538f2b2bbc3a0584979a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514901, "uuid": "82cd8a49-bd81-46e6-b2f5-102060b526db", "comment": "Malware payload (Mirai)", "value": "8bd4bbf845b88e487d9f4ca8df0333a8ab308fc34a6f4127cbcba0fe788a344b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514901, "uuid": "3e0441d0-6ecf-4ba1-888d-02edb8f6c367", "comment": "Malware payload (Mirai)", "value": "e7af8bd099bc5a7ce67e73edc915411c7731cf8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514901, "uuid": "b273c90d-6e11-411c-a6db-b9004675a84c", "comment": "Malware payload (Mirai)", "value": "27fb22ae56145f8501a6031c7c11daeaf833b3c08e82da5f4794230368fdadc399daed138e9e17dbd276ada9cda6050b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514901, "uuid": "73618f37-01f4-47df-80a7-9319cac685fb", "value": "T1FDF33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514901, "uuid": "6723f40a-9cc6-44f1-9dce-d98c7a2a81bb", "value": "3072:o3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3nTfau:oFJMZBtqCnFCtE1R1WpvDrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514901, "uuid": "c84d5fbd-b2c9-4f2f-bc39-a11a4e6c1e8d", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514901, "uuid": "df335b21-f454-4f51-a9d5-e7ed85db2924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514901, "uuid": "e7c1a668-b7a8-4bb9-8c7c-1f57ce2de2ba", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c126a8-44cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777579480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777579480, "uuid": "66bd204b-525c-4d62-9d99-11b00d8fcd82", "comment": "Malware payload", "value": "1acbfb769dbe763c13f2f5e664fde20d", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777579480, "uuid": "aadd63b5-22c1-4ed9-9117-05b95a5c6246", "comment": "Malware payload", "value": "8c1b8f927071194e5da78f6faf3d75cf33a13cb1c1bc17ada8d04ab6ced1ed7e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777579480, "uuid": "de1f4637-1dc9-4e01-a583-51bf6e5422a7", "comment": "Malware payload", "value": "ba5d38dbdd2505ae1fcc9a0912d2c35521099df5", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777579480, "uuid": "dbd92f55-c888-4499-987b-5b9f605fc58e", "comment": "Malware payload", "value": "a910adbcb5dbbf41c4b46dfbd01518c0c9f592745be85d4f08ec34eae41c46174949bf67c7e40709c7f6b48c45545aa4", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777579480, "uuid": "17e68c9e-dc38-44b0-b515-58dd139992d3", "value": "T1C5762305B9C9DBF4C48A87F0660240EF749D36A7D4FD19583ECA4C22A7A0D3D856E7E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777579480, "uuid": "db47daf7-13d7-4d6b-8acf-8748ab65dd8f", "value": "f3201d8cf27e3b4846984664d5bfd984", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777579480, "uuid": "452542ff-b19b-44ea-9659-097f98b1b688", "value": "98304:lXvEKelwokYqA/h3ank8pPqiW21EXlZ0WNdxK++Yh5iPKBN8QnMcUdiFlXIXZszN:lolwUh3ankBN0kxX0s626iwNvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777579480, "uuid": "4819a45b-3597-44c3-8b36-d6bf2ac3686d", "value": 7582720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777579480, "uuid": "575e0460-0574-48af-abe5-aeb2df7fe53f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777579480, "uuid": "c0044df9-3042-48e8-ae7b-0b1ef310fd02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fbb64f-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777537024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537024, "uuid": "405cbead-e4af-402d-80d5-4d9c56e43d37", "comment": "Malware payload (XWorm)", "value": "e81eceaea79f0f56a1e12cb1642a9700", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537024, "uuid": "03e477d9-ba9b-4eb5-8778-400e0d971675", "comment": "Malware payload (XWorm)", "value": "8cb8970a50f23e82528467b6bc5699a2a87e8c258e011134abc2a37cbeb2343f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537024, "uuid": "79213e33-9dfe-40e9-a132-5a8ecb0448ea", "comment": "Malware payload (XWorm)", "value": "3f79a6c7ae4c8e5aac3cf38c961a0488e0de1517", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537024, "uuid": "03d79e59-db7a-4c1a-9678-8d5da7a8e24b", "comment": "Malware payload (XWorm)", "value": "6b81c7818e68ac752a24582a3e85743c63f1dc5724072d4930990ad9581713d637fd982f8c0f30cc78e95d889f92a0c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537024, "uuid": "bfeb09e9-9932-4b80-a1eb-82bce159d1f3", "value": "T16437231E6D7AC8AC5B8D925D90D03BDC22ECC829119AB35692FE585DF31EF5A324F00D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537024, "uuid": "fdf835e2-cedd-41a7-8e09-6b0795d0e360", "value": "49152:rtI7wrNtI7wr1tI7wrutI7wrptI7wrBtI7wr/tI7wrHtI7wrgtI7wr0tI7wrRtIt:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777537024, "uuid": "75a900cb-4671-4689-b4bd-b1f1c22f23a6", "value": 22643807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777537024, "uuid": "9c9fa893-f02c-43cb-857a-81e7f0ba283c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537024, "uuid": "4f17376d-a958-4ce5-95be-1740d8461741", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b4b5f4-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535626, "uuid": "995cabcb-2307-4bb8-9e28-dc97a88b27eb", "comment": "Malware payload (XWorm)", "value": "042571f966c43657acb40fe77788dc32", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535626, "uuid": "c37cee24-408e-4cc2-a7a6-b24199c6b68d", "comment": "Malware payload (XWorm)", "value": "8d5313b99661acde1495c2f0d41abc8bceca9ab4d8e9a2cf4730c5e6276d7427", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535626, "uuid": "a71c6fcc-8c9f-49d5-92f1-355849d81ceb", "comment": "Malware payload (XWorm)", "value": "69c39b1c697d1281ce3933e63e16c406a8d3fbeb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535626, "uuid": "0c252788-6b2c-457f-a165-ad502119dcd4", "comment": "Malware payload (XWorm)", "value": "b36e63467599a2376c839861e00ab3f874b764c5ebb87b22146c7c2017b4f142e25baaa9e395342fd9f9d893f59de0e8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535626, "uuid": "8d8aa102-f7d0-4bf9-8785-f0e1105070a9", "value": "T187372300DF1E0F1FE546205C60A41F466EA9CECD4426FAD9A3E158FA07ADF3C687B5A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535626, "uuid": "48c47e5c-d77e-447e-8f10-cdc0db8029af", "value": "49152:ioyzZoyzzoyzyoyz+oyzHoyzZoyzhoyz/oyzkoyzXoyzVoyz8tg4FoyzCoyzaoyF:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535626, "uuid": "ca91086b-6964-4f37-96de-338b3e797e8b", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535626, "uuid": "af2e0614-6370-41fd-b49c-8a05fa171d9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535626, "uuid": "cb7afe7d-b6d5-4a67-b935-1d67c059c7fd", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deaa22e8-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536980, "uuid": "ffc87978-a32d-4755-8d2b-5bbde4ec0946", "comment": "Malware payload (XWorm)", "value": "47907f531d77faaacb23f9a8573f9271", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536980, "uuid": "2069ed24-7329-4df7-9867-ad7fc07d4f5a", "comment": "Malware payload (XWorm)", "value": "8d6255b62d19320d8c7d6fc6aca3fb09bb5f3b1d181edc23a6425e7eb5af1d8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536980, "uuid": "3be096e6-2fe8-4366-94b4-c2dd933deafc", "comment": "Malware payload (XWorm)", "value": "0d011951e93a0bbb237fc2633d75c72f7a99df6b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536980, "uuid": "9b3bd82e-0df2-48d9-ab7c-2e6a2bb3db39", "comment": "Malware payload (XWorm)", "value": "cb4c5ac20e5b97afef6159d8262c02b2c3b8d0d5882b1ef6d9fa9f6904beca3c590e2e9989e1077ad3ea443afc9f5309", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536980, "uuid": "9996650b-07b5-42d4-a040-0fcff1e9941d", "value": "T1873723A3BC116BEE47B8311C40FFEF5BA5C9D65120E041D0A3FAA94EB67EB01171A59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536980, "uuid": "76d1f62f-5ac2-46da-ad3f-daf30dcdeddc", "value": "49152:TYD7i/YD7iMYD7iCYD7ixYD7izYD7iVYD7imYD7ifYD7igYD7isYD7i9YD7ijjfj:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536980, "uuid": "d4b89b18-5d22-4efb-9baa-c8547ecef589", "value": 23164054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536980, "uuid": "21746b3e-4098-4c6e-8173-9593c94284ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536980, "uuid": "6bf8c075-dd36-478e-8428-64fffe5d5a6e", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659e8868-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535489, "uuid": "480e2d9d-6575-487c-abde-3f696ec3bd1d", "comment": "Malware payload (XWorm)", "value": "aba9d2b00de21797995217bea5fe36d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535489, "uuid": "6b625b6d-548a-491f-be03-fc368d66f4b2", "comment": "Malware payload (XWorm)", "value": "8e31db1d940d36e7c2c1ff8c9d12a021d90cd1510261e4790e7ee0b89deca140", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535489, "uuid": "4c8f75d1-4678-46b6-b70d-2dfa978586cb", "comment": "Malware payload (XWorm)", "value": "c2542d3dc983f8115553821dc0aaac5bc38da07f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535489, "uuid": "3b4d7aaf-c427-4abe-8542-4d98baf8ceb3", "comment": "Malware payload (XWorm)", "value": "71e32fe9e318a39a1687fe549c88e7c4b9435e6b216911498007352e649a81d0f5e7a2091ba262c2102f9ae8dc0dac06", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535489, "uuid": "44fd87f3-764e-4e3f-ae26-b7b5eb431fad", "value": "T154372332AE19792D8175755C12F32E1FF4A04A8BD12178F473B8AC4E4358F2F629B279", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535489, "uuid": "b4015581-0844-4580-92d1-cbebe82b54e6", "value": "49152:Wn6nhnWn/nhnbnanHnQnsnJndabknZn3nOn+nPabJnensn/nZnpnZndnmnLnrnNL:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535489, "uuid": "f7d18713-cc6c-416c-ba79-58a0bdcf6077", "value": 23164071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535489, "uuid": "9d8c1a40-1575-491e-b12b-885d15cac8f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535489, "uuid": "07b1a477-c565-4cb0-9527-bd7a194cae56", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c46d06-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535455, "uuid": "98510669-f81c-41d0-97ea-92c3dbe99a37", "comment": "Malware payload (XWorm)", "value": "806ffb3aba8d53a47ed302df895c9465", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535455, "uuid": "0bb58145-9a39-474d-8a07-717b03f28a6d", "comment": "Malware payload (XWorm)", "value": "8f99f18e362e9391f0567bd59c9acfc7520fe81dd93ad476a27f79f72c9e1409", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535455, "uuid": "08423261-ea5b-4df6-b273-e14d1b4352ce", "comment": "Malware payload (XWorm)", "value": "d97d671652f2584b65617d5d583cd6d7b98e8c03", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535455, "uuid": "28af47c8-5672-4aa8-abca-3bb34a2a4bb6", "comment": "Malware payload (XWorm)", "value": "a53184f28baf5028753c1459fd296cf0469f66a5569e7ee0cc2b734119d7bd855c38999174ca2e4a957d4be73682f96a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535455, "uuid": "95d58b6e-74c8-4f53-a440-f27e44f3e813", "value": "T1D9371200864E9A7FB3BC5539A0BF4F0F54D908620817BBD9B715B8AF8F0EDA53068765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535455, "uuid": "e3ec51fc-00f5-450d-bd19-b2028f7e1f03", "value": "49152:MEHtgSE0uPy0kAGvlE0XA3loxgOAiW7E0Jy0AIAreFgA6GqjKbbw4M6w0AM68QMj:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535455, "uuid": "09ac0642-0b6f-44bf-b668-4f6df17ab804", "value": 23944473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535455, "uuid": "1eb0cecf-55f4-4744-a519-30831d90c207", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535455, "uuid": "2c209ae4-ccd7-4c90-923c-529acb498d52", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a09c334-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514290, "uuid": "18288c9c-e6bc-43d2-81cb-464ab678dafa", "comment": "Malware payload (Mirai)", "value": "4ff54e6c0f080db56056712dc950d5f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514290, "uuid": "54e9bd2c-9acd-4026-be7d-46bf2504586e", "comment": "Malware payload (Mirai)", "value": "8fb4a0f1aa646ac1f2af66eb5b888e38f1ad63a809087b60a93f78db4087801c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514290, "uuid": "4195c8e4-6040-4f1a-b04e-c06afeaaa724", "comment": "Malware payload (Mirai)", "value": "62044b0d81c00722c8fed4886d8a35e74beca589", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514290, "uuid": "e74c852d-cacc-444d-8c4c-ed77ba82c33e", "comment": "Malware payload (Mirai)", "value": "1b2aa90c462a7e948ab5c4f5d4d50ebac44285b37c6f4491eed423db74404b7b184300fb72fcd8bffb8cd18e529a87b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514290, "uuid": "d3136384-8a78-4617-9d09-725aeb758d9d", "value": "T141041AC7F900DEBAF80AE33748530909B130B7A144925A377257356FED7A1D9097BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514290, "uuid": "343a2ce3-c9e3-4545-b17c-413993598ea0", "value": "3072:vtztO3IE7SSDpMQwyIiYh5wySuOn1foD6t1eIFUDFHnV3jbinLh/CAA+s:vtzIRmghGsySNn1fVtVgFHWLkN+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514290, "uuid": "d72bdea9-1778-4951-9bbd-e858f3d83f46", "value": 178148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514290, "uuid": "0b747485-cde2-4fcc-be02-208b2335cdf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514290, "uuid": "5caa5e6a-fa98-44d8-a6e1-c2d29138c367", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d191a015-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536958, "uuid": "a20732ab-d979-4ceb-a6e9-8321f0324ddc", "comment": "Malware payload (XWorm)", "value": "6103038d7e90293a91545447d2a5d5ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536958, "uuid": "07bf9333-a655-473d-a252-04f88355dcba", "comment": "Malware payload (XWorm)", "value": "8ff6db6dfd992398e6d603e96f40f0bce90f3c17188d0d3fa921793939f7ed2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536958, "uuid": "6621c35d-1404-4489-b659-a98a6c2537c8", "comment": "Malware payload (XWorm)", "value": "070ce850afebb10bf000301eb78082430f6da6a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536958, "uuid": "0ce66ef1-75c8-42c0-827b-60932fd9d905", "comment": "Malware payload (XWorm)", "value": "e117a2e7b114b1c7aaa1ca87497db0033d0590f7d101e1e503cf498ac7eb724cca7a4e936e7b589644b770871fdb344e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536958, "uuid": "e66b95da-6f0c-4fe2-aa03-54bbc836e0ae", "value": "T1E53723A12F3E5EFF08342A5C96B91B1FE091DB188E587BABC7D09DE5805DB4500B3897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536958, "uuid": "d56f9e03-2e6e-4b05-a6f0-3eac410637c2", "value": "49152:pLJLMLzLrLQL+LVLHLlLPLhLaq2MLWLpL5L5L3q2pLsLZLELxLyLtLfL5LgLcLmR:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536958, "uuid": "7533e52b-375f-409c-a604-1f4e55d8aa92", "value": 22643808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536958, "uuid": "8d49bd3e-3e67-4f0a-992c-83244821e76a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536958, "uuid": "56768d48-8708-4136-ba26-a31b191a1489", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40641e75-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514810, "uuid": "c945fe17-a310-4c0a-9293-52eab075f170", "comment": "Malware payload (Mirai)", "value": "544299d097c4e98727b4a5fc39fdb92a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514810, "uuid": "b7c9f58e-6d05-46c0-ab80-21db22781234", "comment": "Malware payload (Mirai)", "value": "90c53c5e88d378a4b9918748cc9ca2a65da2028537dd9ac6a9f5e4d0c89a174c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514810, "uuid": "d2f92f9a-2451-4453-998c-1fd7cbcbfa84", "comment": "Malware payload (Mirai)", "value": "92928a45f6a62aa31da735281f54be38b972eefa", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514810, "uuid": "691eb73b-e075-4b5f-b420-222ec39fb7e0", "comment": "Malware payload (Mirai)", "value": "627701d147364adaa0a869c2f00f1b58d8ec81bc5111ee76f3a9280774daf0f61d243db6e1033c6d7c0517fd8b5138ba", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514810, "uuid": "8ff0bb1c-b1fe-41fc-bdfb-75f7ff71cd93", "value": "T1E3F30851A8508A53C5D15BBABE9F938833324B78C3DB3316AD28AB342F9674D4F3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514810, "uuid": "0ee8852b-3c47-421f-9caf-be95fc7babd7", "value": "3072:oJEabXFiPiw8lenYJPMoDimZPUVrejPcPvXKdi+V3R//wEpRu:oJ9TFiqw80n+PMalqrIPqidiq3xwEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514810, "uuid": "ccbdcb6e-adb1-454b-8627-8fcfbbab3374", "value": 171840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514810, "uuid": "e94f50d0-e79d-4d29-8974-d206218ecc85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514810, "uuid": "5bbe3c70-b53b-404a-aeeb-931d57f2ac95", "value": "xnxnxnxnxnxnxnxnarmv7lxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324e2929-44c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777573198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573198, "uuid": "56188c07-dd06-4609-8c78-3fb774ceee79", "comment": "Malware payload", "value": "c655d99b03d94a436455ea7d574c2a74", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DNSHiding", "colour": "#EBCB30", "exportable": true, "hide_tag": false }, { "name": "Fake-CF-Turnstile", "colour": "#850214", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573198, "uuid": "3710c36f-cc87-436b-8a7f-1f3a47f9ca19", "comment": "Malware payload", "value": "90d7ff3b0f1b25ae53459dbec61f70f2185188228fea30db75d8386a6f2ba1de", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DNSHiding", "colour": "#EBCB30", "exportable": true, "hide_tag": false }, { "name": "Fake-CF-Turnstile", "colour": "#850214", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573198, "uuid": "95370b4d-29eb-4f9e-bad5-4bf0c0bd7b52", "comment": "Malware payload", "value": "3df0c3c7aa42056975c00e44cc0231f66835e6e1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DNSHiding", "colour": "#EBCB30", "exportable": true, "hide_tag": false }, { "name": "Fake-CF-Turnstile", "colour": "#850214", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573198, "uuid": "955b778d-c4ba-4576-891a-e535c5d1889e", "comment": "Malware payload", "value": "6d3fc9972049d281557b551e70c756273305556633f839427c977f2af88c84ed4194d68a1736cfc6baa00b4a392fd21c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DNSHiding", "colour": "#EBCB30", "exportable": true, "hide_tag": false }, { "name": "Fake-CF-Turnstile", "colour": "#850214", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573198, "uuid": "36e9fdfd-bf28-43d4-bbf7-29d7caa53535", "value": "T1A2418618F96192F9D0D38BAECBD68AC9215E94FD51C73538406FC20614E09A52FA70C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573198, "uuid": "03aa76d2-c9ae-451d-9c95-d88c8b221305", "value": "48:IZpqhUSphOijcyOVjsW3VpKVoB3SpYlIMcDgEVzEVTjVEYPFvzhAJGAwDFhGVz0:SpM10yOV53VIWBCk+gEVIyYPFbhA4AwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777573198, "uuid": "869ba16c-4263-4037-97ca-eb79ff1528f9", "value": 1892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777573198, "uuid": "c0616b33-6653-452c-8036-31103587de38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573198, "uuid": "644ebe01-f06f-4370-a5cd-f52fe9b28531", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17521531-44ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777578737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578737, "uuid": "f76be891-3547-42d5-9ea9-205e89d25813", "comment": "Malware payload (Mirai)", "value": "ab8df6a7e3f48fff88d25abf7f9fc885", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578737, "uuid": "a128ef30-49fa-40c3-8a28-c49c6783d242", "comment": "Malware payload (Mirai)", "value": "927eaae876733594f2889b37b1701a8d90ad708bf83da4dd77e967966c51873f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578737, "uuid": "16dfcf2c-7251-4bc8-9137-67c85d0ec637", "comment": "Malware payload (Mirai)", "value": "f2c9994236ded8cf8cfefa4f6e51f1686fd083c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578737, "uuid": "0ca8a130-491c-41f2-b4ce-5c44db718b4c", "comment": "Malware payload (Mirai)", "value": "fa5f4d83963a2f852e244d8ba0a1c6caa4a17628923f9be9a50331e83cb4bf9cc4152c9bf49f09e21322dd8d841affc2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777578737, "uuid": "b045af91-6bdc-4758-8351-ea07c061b0b7", "value": "T19A733923EA16AF46C14761F0A9F64E740F12FC2A8D671EFAA564EDE981439DCF1043B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777578737, "uuid": "776f1552-ad40-4213-b43b-647170668789", "value": "1536:+pwtq/0FORx0SFe6Rw9jnipobBUOgTKs2HT7c+G0wKCmWUHs0SG:+pv0QRxJ7e/benWsGjG0wKoUDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777578737, "uuid": "621bed50-1eb6-4f23-8e20-8118dfa1db8a", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777578737, "uuid": "c0151166-51e8-4af4-9ae2-fbd8f7ce0285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777578737, "uuid": "d5adb6c8-183f-4fb4-9749-9e712b91a33c", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad76b80-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777531498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531498, "uuid": "2621a89c-7ff6-40d6-aaba-66adc82eef81", "comment": "Malware payload (Mirai)", "value": "0308cd9b40aedd6064fdeab8219b003d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531498, "uuid": "f807577e-6acb-466f-8a19-c80a2cc00b71", "comment": "Malware payload (Mirai)", "value": "9335ab8706fb041a1e2ef12f844463f745e2600971dfa078d3e1e5f311103a0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531498, "uuid": "17559bfe-887c-45d3-ad0d-1978f533288e", "comment": "Malware payload (Mirai)", "value": "06d5afab30752948fdca0623a0a98a9902b61673", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531498, "uuid": "6dd55c02-c516-473c-bb20-82627876e5e8", "comment": "Malware payload (Mirai)", "value": "fefc3e5515c009ec1b52d483abaa5175e216bdcf309e9996d235858f33beebe51ab242ef329f9fa8c713a0ce45e04576", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531498, "uuid": "f7c8f7a7-cbd5-439d-90ae-3a0691694bde", "value": "T11AF44B02BF905FEBC0AECE70497EC217009DB5D346C5532A72FCD68CBA59A6D0AD3598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531498, "uuid": "cf636728-4ba6-42af-bfac-f4094f0c49d2", "value": "12288:/QiBIuj8cvUcAcPeOVsAPPsoZ7043Wz9MOBRbtMRcKnYJiCAb68+Hrgn+jOkYVOk:VZ3LYxpppNfV/0w0JCKAdZHeHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531498, "uuid": "51264111-9370-4953-8680-487478a6a9fe", "value": 758832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531498, "uuid": "8f5107bd-6109-43f6-932a-e693e32de2ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531498, "uuid": "a926809a-e5ab-491e-8de5-a9c60a0d8db2", "value": "agent-mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9258e338-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777574218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574218, "uuid": "92f4dc28-d89e-484f-a776-24b6a1f4eca8", "comment": "Malware payload", "value": "58f042131f7c7263efe64abf63c6a137", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574218, "uuid": "2f609cec-7933-42f5-9216-5c7525b45247", "comment": "Malware payload", "value": "935e473277f20fe6c98025b00fbbfff9e1c0b7924a2cb93e810ee63dcfa11f05", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574218, "uuid": "90d5cf8a-f4ef-4069-98fb-30ab46899c3f", "comment": "Malware payload", "value": "1bf286aa3afccef7be5b04140c8b5a594b6552f9", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574218, "uuid": "02c06c7a-a2e7-4441-9f17-4cef1badc807", "comment": "Malware payload", "value": "761677109410a19668c2a51077612f68d23c49d2fcbaeb05087af46c5eea75e18e56095a225c437f1c8477d559ceb6a0", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574218, "uuid": "3a27c09e-4f7b-4964-afa5-87d579a27bdd", "value": "T17213BF6C9291DA311F6E434715B306C2EE5CE3C7CACB4EAED31497462913576E3118FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574218, "uuid": "b8db7cb8-007f-4652-bf78-9d1af3cb8af1", "value": "768:uIshMd4Z9F/bB523vakSmZwnmtnXbxvdn3T8/PqjezAs6KsiSZc2NjylWM1c5hb9:iMd4vF/9w3vakSZmFXllHBKsiSZFBych", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574218, "uuid": "ed41dd72-1bf2-477a-bc8c-6987554fd72a", "value": 42404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574218, "uuid": "54b1cf1a-1c6b-453a-9e92-a8b48bee88dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574218, "uuid": "8f6e2505-a4cb-4b00-8d58-3c334fb43848", "value": "efawe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea21477f-4463-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777533134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777533134, "uuid": "6e274cf9-3b8f-481a-b3c9-14c4a5d7af8f", "comment": "Malware payload (AsyncRAT)", "value": "7acb14fbd7070725d8dc30ec7974b648", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777533134, "uuid": "a95a02cf-29ef-40b4-a68f-afb2a84c49f7", "comment": "Malware payload (AsyncRAT)", "value": "939b247d1cf5a8b674ff632365af9982256363d6ae390876d0d3d9cbc07d163b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777533134, "uuid": "dd791189-8cf2-4f09-99c6-2cca626fa541", "comment": "Malware payload (AsyncRAT)", "value": "b934524a20ceed1b0c93fd04b9d09d6b5f3fe35f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777533134, "uuid": "12c0546f-68b2-4a88-8bb8-d0e132c93efe", "comment": "Malware payload (AsyncRAT)", "value": "f56e3a6f639889239446f9034d992ee2420b9bc1b941b9763d6e900863c7d3c2594121119cf746953d85a2d13bfe7dc4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777533134, "uuid": "3cc05376-0afc-4d42-91c7-63ab2fe03396", "value": "T128150109239ACE02D8925BF06D70D3B516744ECDE621D3638EFAFCDF78696816C642E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777533134, "uuid": "ac01465e-70ca-42bb-9d1c-1baa539ad9f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777533134, "uuid": "f94c78f8-dccd-4f11-ad3c-bda020a9b8a3", "value": "12288:+S12V4gALxDeBik3VD7i2KVvLClorcIeCU1H+LGOLXM8jKeO/d3+RMHz3KPEQb2/:+S1fgyciPvLlrHS1H+Li81OcREDoaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777533134, "uuid": "97d1a1c4-e1eb-42d9-a8ba-6650087e8e0e", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777533134, "uuid": "ac22a008-4f86-4bf7-981e-a6949da70607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777533134, "uuid": "957d9b0e-86cc-48b8-a851-db45aa2d8d0f", "value": "TT-PAYMENT COPY -04.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401568d9-44bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777570644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570644, "uuid": "7dd288d0-7295-4f3c-a603-d62245271b68", "comment": "Malware payload", "value": "81f08f8bc67b88ff03c429ba806ddef3", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570644, "uuid": "fa8bc6f9-c1f2-4fb4-84e0-3d427a948ac8", "comment": "Malware payload", "value": "946db99533ef553457b1e1967ce8220d86eaf1d4810334996857f6f4b806bb00", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570644, "uuid": "aafc6f1d-9bb4-462d-af4d-3ca5688c9801", "comment": "Malware payload", "value": "361f39178264b7c8c02743117c9e90f33f10adc5", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570644, "uuid": "c95b1a01-c047-41af-aa25-e93aff1cc8a5", "comment": "Malware payload", "value": "da15aa612f88e23fe4ce76e2a89a5459582bc4eb22ef2ed9cc73e3c2a49147c9e36a9dbb746da19c4624a897fe6be3e7", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570644, "uuid": "69371664-4375-4416-92ed-405c8f52695c", "value": "T16BB28EB3C34058F2135F3D879A29C2EABB4DA57E8875698FE73033759892CD4B9164B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570644, "uuid": "1e525cf6-584e-4173-a213-912fa8b61294", "value": "384:uIsWaRkdbmDnfI6jrAYn5NL9vJ90bog8mjv1WVX1rvws+/6vNMQmuQSwU2N8Fclp:uIsWTdaDqYnRRg8mjNWZxvnvLmTSwU2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570644, "uuid": "116dda1c-8f04-4756-b06d-293a20da325d", "value": 23444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570644, "uuid": "a581b89a-8515-43a6-9a29-479a57ff3d9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570644, "uuid": "5d835486-dc42-40a6-b8af-3091f1437b79", "value": "icoce.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff93e9b2-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514272, "uuid": "7645887a-923d-4227-8aac-7e158235d23f", "comment": "Malware payload (Mirai)", "value": "5983529be3c89760c5e41582d244e13d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514272, "uuid": "18532ad4-66b7-49b4-9398-967fc2ff626a", "comment": "Malware payload (Mirai)", "value": "95d300336dc06f4aff183f9ec404234115a502aaeba19c4d4027e10beca80b3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514272, "uuid": "b18827de-60f1-462b-92b4-f72e38d7b1ea", "comment": "Malware payload (Mirai)", "value": "b8697882bb3eab9e92d2e99e019259140089090a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514272, "uuid": "4ed54a5f-5d0d-4003-a3d6-4052046cbd67", "comment": "Malware payload (Mirai)", "value": "d6c2d1ff86e7ad4c4edb57e6c870f159c980963dd53bb3cb931185e39aa7c8d507f7e249139e9cd05e55a5a9cc80501c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514272, "uuid": "98c3c216-aba6-4f38-bc87-914139beda94", "value": "T136040842E653CFB3E15310F102B78B314E71F97A6C66D542E3A8BCB89A619D1A50A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514272, "uuid": "18f8d623-b428-45a9-b4f9-e2b91cc0232f", "value": "3072:WT5mqeElrcsIPhaQGjcKAL2E3QE4xS3IE8WA3QZZ6lp7e:PClrcnSeL2tw3xlAAZZA7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514272, "uuid": "aed0d21b-d82e-4f2c-9c75-218070f47f72", "value": 188900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514272, "uuid": "ac53e5ba-7fc0-42c8-bcba-d17aeef6efc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514272, "uuid": "5e3d4308-58a1-4464-9581-12518fcf2815", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a915d72a-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535602, "uuid": "1c375048-fd24-485e-b767-61b72ca7159c", "comment": "Malware payload (XWorm)", "value": "e4f68c7ca7a978f04a2940251090095a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535602, "uuid": "306fd40a-af8b-4fb4-9b6e-e734ffd009f4", "comment": "Malware payload (XWorm)", "value": "95de7526e0cab690093fb53fc24fab326ba3cc0fcde5ff01302a29f844fb3869", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535602, "uuid": "b93efc1d-c6eb-4de9-bf38-9ae060d69deb", "comment": "Malware payload (XWorm)", "value": "3c04f08e61e4c891bf8c7c0266787dc90740bf92", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535602, "uuid": "e65d865d-60ff-4b19-9e17-104d1bb5a2bc", "comment": "Malware payload (XWorm)", "value": "4668b1c3092dac70761f6f1a0903fc6bf7c0499a37180ce4b10d87d3298ae628329e15d973e164bf80823fd528ffd34e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535602, "uuid": "746b705d-e4c0-49d2-a1d1-994668f66b66", "value": "T13C3723134D7BCCE5C8FAC5ED1434DB1D3A6A4D4D0CAA86F7ABD2EDD66608F2A020B514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535602, "uuid": "94433e50-72dd-4ad9-8d25-6e90f9a9f113", "value": "49152:19nV9no9nG9nn9nN9nT9n79n89n49nJ9na9nN/wJUo9nE9nO9nz9nP9nc/wJUF9b:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535602, "uuid": "d68ea7fe-7f04-4efd-ab93-7eb2758f79a9", "value": 23424206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535602, "uuid": "064da498-a417-492d-8f58-1e64fae0bc0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535602, "uuid": "2a03c9d5-8950-4cb6-8a54-7f2edf26862b", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6b0129-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538478, "uuid": "052da52a-054c-4d44-a250-19b39c454b8c", "comment": "Malware payload (XWorm)", "value": "83fa0a5267d79a034c4d9feaa57cbf6f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538478, "uuid": "78f875f8-b5ba-4067-81e3-e5e8bf66f44c", "comment": "Malware payload (XWorm)", "value": "969ff00fb40898cc42120ed4c3180e6fcea1c5576034a4e1629e59a51d6fc6fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538478, "uuid": "90e3f33f-35d7-4095-92c5-e57ba4a7dfb5", "comment": "Malware payload (XWorm)", "value": "e6a7505b367a87c6025d55c45fbfc0f7183eb297", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538478, "uuid": "48369878-be2e-400c-b96b-987fafad528f", "comment": "Malware payload (XWorm)", "value": "9974afe89ff172e49ec6b7882775b11e2cdb3612962ba4a5728501c69222a667042a97cfa71dc246f171c1cd2ebd1cfd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538478, "uuid": "ee0cb153-e7ba-47cc-9f46-b710ca692812", "value": "T11437238B0EAE7D7CC26C12617A7F2F5B46BD8490836138E6397BF99658D8D3063341E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538478, "uuid": "3a7ee79c-0767-43f5-b1c7-c96b45443be7", "value": "49152:BgisTgiswgisKgisjgisTgislgisrgiswgisEgisRgisagisiSzMdgisEgisPgiM:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538478, "uuid": "6cd2d67c-f476-4a4e-bab2-27b082192b68", "value": 22643791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538478, "uuid": "274601e1-5203-4d83-a346-f65f200117ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538478, "uuid": "ac76e198-82e2-4c12-9468-9f61286593a5", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8377c484-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538545, "uuid": "fbd6dc47-ba23-4c56-8b21-0d494f1c79be", "comment": "Malware payload (XWorm)", "value": "3e5836868b4463c573a305db6d2b6196", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538545, "uuid": "dd0c17db-2e8a-4cc1-b097-49a91bb4c3b0", "comment": "Malware payload (XWorm)", "value": "97d21c2831214f858b54fa79a721e31c476482d38f3f632c164f1867a715f2b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538545, "uuid": "bb8fff27-3265-4e4b-bfc1-aada94d474fa", "comment": "Malware payload (XWorm)", "value": "fdf002fa28ce32485000bbb0b90dfd0eedb07869", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538545, "uuid": "73dc7b14-c86b-4fc8-8707-4a5139323942", "comment": "Malware payload (XWorm)", "value": "b6c250ada950dc7afcc69848be5559c91d8b77e545f8893100ce0335b23428ca428f88ef627c4d155f723d13a6e370ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538545, "uuid": "88f2817f-1828-4461-a2a4-f181291a52b1", "value": "T1E8372374D4593FBF4BB942C8243B19CE62858FC858E88CC63F67ACBB4B6EC055349865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538545, "uuid": "44c473ea-6c64-4ad5-9ca0-d7425801e724", "value": "49152:y4bWDB34bWDB04bWDBP4bWDBZ4bWDB64bWDBo4bWDBe4bWDBC4bWDBZ4bWDB84bc:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538545, "uuid": "b8f55cc9-c0f5-4d4b-87d7-24cde7fb84cb", "value": 23424217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538545, "uuid": "39c66702-17c0-45a1-b069-9c4e7494dc69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538545, "uuid": "53e8ee7c-4ef3-4f4c-8623-011ffda0045d", "value": "invoice-1645080830.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd98d04-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538559, "uuid": "7ea69677-a163-4280-934a-96910a3f5395", "comment": "Malware payload (XWorm)", "value": "62a9533b42ce3991365004b4c9de8b90", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538559, "uuid": "20451223-b0ac-4d2b-849f-cc2573db5424", "comment": "Malware payload (XWorm)", "value": "9876bbda8b2885999a1b4214a2661edf7ca1ca48c57bb89cb29e7d74d9f779e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538559, "uuid": "07f646c4-cef8-4cf9-98df-fe789081307b", "comment": "Malware payload (XWorm)", "value": "947d96d042df211b93a7f2dd3960d3c6ce3c36b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538559, "uuid": "78edff41-cbc2-4a17-9aa6-a1f25b48948b", "comment": "Malware payload (XWorm)", "value": "db429ac50e5131cb139942c722269ea9163261511162607ab623825267d650b92683394dca413044dd26c4a1b877838a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538559, "uuid": "f712a04b-4e7d-4115-8c80-f585bba60557", "value": "T11537231A973A9C15025C04DDE99F1F7767D66F980020FEEB42E51CF2C2CCB9D21AA6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538559, "uuid": "5dd7b606-674d-48ef-8f36-834a9d85f8df", "value": "49152:4PJeLXJNtkP3jaD6oKRh5aDBHg2ci/XHUQAIl8aDEaDFMSRaD+OACXgIFZBNp7Ns:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538559, "uuid": "6521e2c6-90ea-4941-b29c-432c4a922bc8", "value": 22903944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538559, "uuid": "ab5d18d7-55fa-4dc2-93c7-0a980955eb5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538559, "uuid": "975ba0b7-5850-4aad-b6aa-88ec18953fa9", "value": "invoice-1645080830.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac657ba-4447-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1777520733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520733, "uuid": "2703b71c-863d-4478-9375-faa045c85984", "comment": "Malware payload (RatonRAT)", "value": "a61c26c3e61254f6edf1d06536acf694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520733, "uuid": "48027a90-dcfb-4ff1-b0b2-b9b35208015a", "comment": "Malware payload (RatonRAT)", "value": "98a10e06649c17d38a39b4eb8e1f5205fd359807d81c04c57b664baf2fe1f4ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520733, "uuid": "02118a63-e78d-422f-ae85-eb8aabca8838", "comment": "Malware payload (RatonRAT)", "value": "d8f39fccba5e0adfb65aeea075cab91e04c039c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520733, "uuid": "3366d36c-66cb-4b69-92a6-d009e90cbdc3", "comment": "Malware payload (RatonRAT)", "value": "dff67b21c58aa9b55dccf4dccec04d8328a95435b11248aa5d3bf3277a1ae454780a3c439484345b403911d4f81bc827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520733, "uuid": "17b5bc17-be78-4c14-81c1-caee9abbf7ef", "value": "T183D5121C33FACB18F2AF4BB4A87185664771FD178D62DB6C58E1399E04B6F48AA10713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520733, "uuid": "d946bec6-4a42-422a-97af-fde64d1e456d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520733, "uuid": "ad1f73fd-5af9-4b7b-a10b-632c87033e17", "value": "49152:JgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4c6We:JgVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777520733, "uuid": "09439aba-2d18-40e0-94b5-75a1bd5d2c2c", "value": 2945024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777520733, "uuid": "bb5d23dd-1d40-4b45-a60c-78471f8a2ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520733, "uuid": "6df67f04-f7d6-4518-a36f-025d365c0e17", "value": "Xeno-1.35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6718144f-448f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777551812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551812, "uuid": "825f599d-1e93-407d-8ad8-e88f009ebd96", "comment": "Malware payload", "value": "6e2c3d298c092b0cd2701d9efee84ccd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551812, "uuid": "8d78c7a7-2eb5-4cf8-ab1e-0bcf10ebd6e7", "comment": "Malware payload", "value": "9998ae10ea10b5e8f5a789e1fc3f5c006116ff54693f196ef900ce42760dbdc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551812, "uuid": "67f2abf3-8b0a-466b-937b-4eb072542917", "comment": "Malware payload", "value": "253fd98ade100f2f2090201edfededd1e935685e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551812, "uuid": "1b566e75-f9b8-4954-9707-1e222cc0910b", "comment": "Malware payload", "value": "4c2c65a9f4fa5691c7ffde564e90cad334c8cda0dbc71296dcd91a2c72673361e7affcecea71048255bc8e7bb26e4865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551812, "uuid": "d98927e3-30fd-4432-bbd1-f544421a96a4", "value": "T14B254B06BF405FEBC4AFCD30492EC75710EDD8C686D1A62A71FC8B8CBA9D6194AC7548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551812, "uuid": "3bbad9b1-9df3-4e3d-bbe4-134537d1e521", "value": "24576:bWrrGgg2j8KA10K1JjjWPGpG4Wra/ROrX:qrrk0CAJra/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551812, "uuid": "328b548f-b32e-4eec-8806-3dcb9272462a", "value": 975160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551812, "uuid": "b43182aa-2d68-4fb7-8a8c-d6f43a53d763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551812, "uuid": "3744bc25-6e37-4026-a774-ae8a391c415b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2694a27a-44e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777589929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777589929, "uuid": "6badc4a4-e136-4bfc-8a4e-fba0e41a5a99", "comment": "Malware payload", "value": "0064d59a30c1792dff16cab211d2595b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777589929, "uuid": "dffe6133-f89c-4dc4-b672-e680c7203fc1", "comment": "Malware payload", "value": "9a12ed6052da95055d1e0813611bf2b4d20f7e8b6a837c3b8132e5f6de2167a8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777589929, "uuid": "cfc74ea3-3357-4c8a-bf40-e682d2a4b7ab", "comment": "Malware payload", "value": "914a192b773c57d4f7f254971a809a10ef80ffc2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777589929, "uuid": "df7a9ad6-211e-4b3e-bf2d-be1acbadaf45", "comment": "Malware payload", "value": "9d4903a174c4c123f77d6eb2c2848d65137cc1dcc0ebd5684fa46b1b9fed61126651b161f96633ebf62d9a05d9c730e2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777589929, "uuid": "6ef00bbf-aa09-492f-9b67-c4c2660f306d", "value": "T16421FB2B47249C0270FFE4928F2A902F9A6EC8D7765BF7CC90E941A7163F13A0180884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777589929, "uuid": "dd718e25-0406-4fbd-aa9a-e413e87efa90", "value": "24:gPWWDsYMgQk27ktX1AGkBEYa8AGPS7AGNtr6dprq4Z/6NdSdYDFr6dprHT/DHbsH:8WWDsYMgQLaXZMEYaMPKNtetqwSyOetS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777589929, "uuid": "d9839eb3-f624-49d6-9bed-4fa08855ebe0", "value": 1309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777589929, "uuid": "3e972f4b-e7f8-455b-8653-f8e46c7a5b98", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777589929, "uuid": "264380ff-f15a-47dc-b6c7-4f15ee71a6b2", "value": "F9CYyKjY.cmd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5efdfc-44c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777575633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575633, "uuid": "26bba8fe-a160-4ea8-83e1-07ad647682d7", "comment": "Malware payload (Mirai)", "value": "36ea20435aa578e8076ec4f7692db7c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575633, "uuid": "31cb8e6d-ae36-437e-a482-2ba8be7355a1", "comment": "Malware payload (Mirai)", "value": "9a5027a024e1563c4c4dde724db7729680450a30e0ad085bcfc2cf572a9f760c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575633, "uuid": "3a282b93-d2ea-4b8f-89fc-f0a7c55ba29a", "comment": "Malware payload (Mirai)", "value": "09f96ee14df9ef5909dce73776a43001f44bb0d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575633, "uuid": "d048c643-5aba-4ded-ac7d-8d05db0aa306", "comment": "Malware payload (Mirai)", "value": "a3f4739afdca13a2fdde519cd52ad001dcc07a3283d7a577760f8e6d7012a5c091af5fc735c648af5c876c3c857d1bbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575633, "uuid": "5695376f-b795-4690-b70b-8cad79d70b51", "value": "T1BA931AC7F810EDBAF809E73B4493490AB230E3A10A821B767357356BED791A51477F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575633, "uuid": "866f5a87-d5d5-47de-89c9-d258ab112f83", "value": "1536:XhlAPpmY8FXvv/ilyHIp3bvme2v3NEon2iYIf+RndB+lSZYhge:Xhlipm7v6lyHIpr0v3WCWRndolBOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777575633, "uuid": "c769f83e-ae7f-4e50-8651-092d07da3824", "value": 93512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777575633, "uuid": "27caa1e2-916b-4dc4-8710-d14f32cbd5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575633, "uuid": "9084bf2c-36ca-46e7-b13d-dde29b56aeb0", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918e9872-448d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777551024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551024, "uuid": "b767f018-6eba-43a1-907c-b6bb43e70853", "comment": "Malware payload (AgentTesla)", "value": "ed59fbea89ad52f2021bb8333b8b4aab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551024, "uuid": "41380fc3-4353-47c0-8fcc-758db951cc22", "comment": "Malware payload (AgentTesla)", "value": "9aa087f314de89ae469e089433ccdbf7bcc438f75585fd1b70d34a615a134063", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551024, "uuid": "98f9bd41-af94-4374-9211-194f34e2c323", "comment": "Malware payload (AgentTesla)", "value": "93d8f2fcf70a9d0d8c1b90dc0bafbd6beeb6251e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551024, "uuid": "cbc7b59d-bfaa-45e6-b152-3db7dcb103bc", "comment": "Malware payload (AgentTesla)", "value": "33ca8a82012a14153f3fc79642ec8f87730f4cf94a07114249953e05adf89a71d56116895da72123a94f1629af2db23a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551024, "uuid": "b33dd644-02d2-4d28-b743-48ce0ef05b0f", "value": "T19C2533119EDF941BC2A57F5C3DAA12FF60DFBA177D2B7E510807A88E3D42253CA24099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551024, "uuid": "7e676a0a-8585-4f92-85cc-27c61b2f45f3", "value": "24576:Pb4wt6j9nKCBwKQ8dqLqwQ8REvk3rMfXXuZvXIo30f453Q:Pb4/KrKtdqWwQwr8Xcv/Ef4NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551024, "uuid": "3ec9d4c1-325f-48a5-b390-17ac503b8a38", "value": 1037648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551024, "uuid": "3c18c5c4-0adf-4357-9531-3b206c24f9d9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551024, "uuid": "a898abeb-c1f5-4e34-8644-916ec7287ca2", "value": "New Order 26OF-03091.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd65f24-4499-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1777556117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777556117, "uuid": "f67f14bb-b481-430a-8d21-18a1cb8b104e", "comment": "Malware payload (RatonRAT)", "value": "5a3bfb4edd180600ce7d53540ad6a845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777556117, "uuid": "4850df2a-0b96-49f0-8c10-28ee967781a0", "comment": "Malware payload (RatonRAT)", "value": "9af387891a8a7c8c13b6f03bd684cdf8f2debb86cedc4ebee1ce59acdde2d7de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777556117, "uuid": "fd879846-0a2e-46e4-b435-b1e30d1a2c99", "comment": "Malware payload (RatonRAT)", "value": "31699f00e5f69cd4846d301be0e11616bb947834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777556117, "uuid": "fa746692-4be5-444f-868b-e5c0fc76fc27", "comment": "Malware payload (RatonRAT)", "value": "a19e4fdd94777565de6a6835f56d676e49d64f422e59865e5898d963aad2ab1711dd268d18d97530b03452b7fe07f777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777556117, "uuid": "9cb06d9c-42fd-4a2c-8268-26d91e5fc00b", "value": "T16C933A0073FC6929E3FF8BBD69B120510F76B9279E31D64D598A605C0A70B869E20F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777556117, "uuid": "c46c7f24-636f-4b82-8a0e-ce36a32a84b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777556117, "uuid": "8a988279-b2dd-4837-b537-7937f4cacecb", "value": "1536:C6gVZgr9rGdTsqa4tsi5QmfSUYb1SbbKp+CXC8Ov1C:3gVKr9eAX4tnLaUYb1SbbKzXCfvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777556117, "uuid": "82c4909a-e76d-483c-99a5-ce9c6627cf74", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777556117, "uuid": "99949293-d2ea-4569-9a91-6760f4b39a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777556117, "uuid": "bf623785-f24d-4849-a154-0583d3c75500", "value": "XenoClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2362c3-446f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777538295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538295, "uuid": "ac537d28-c969-47ab-84d6-1a0d27f580ff", "comment": "Malware payload (Formbook)", "value": "9c27d30fff7daf21e680e8e410259207", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538295, "uuid": "00912e41-f7fa-4297-b5a6-bdd205582c60", "comment": "Malware payload (Formbook)", "value": "9b8d9e92281c0c757df12655a68cafcd0e1862daf5047a6faf036e2366cdbd1c", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538295, "uuid": "6f8cba3f-293e-4812-a076-0fb43df1053b", "comment": "Malware payload (Formbook)", "value": "d6a16ff66371db42e517dc3b14a80177de7b9462", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538295, "uuid": "114cab65-0b64-44ad-905e-f1499a818a3f", "comment": "Malware payload (Formbook)", "value": "943adab88a2063aba45436faa82a9ddc4f7f791de6149962b7c4eee2eed9ededa98ec74d3f6f66b2aaa84df449cf44ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538295, "uuid": "59b78df7-9626-4516-9b2f-6a09e81d4b59", "value": "T1DAA5011189C42FB4DB9D5B1C90FE161EE3A10ACE6415698FEB33BE46BFB760442171B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538295, "uuid": "0e43af49-4336-40b7-92d5-56237d547fdf", "value": "24576:YaY2x6hFXd3NLaWZDU4bn591pjn4Go9vCi06H68d8MVd34YsuEZ2H5pyvtWdXX0B:i2AtNM4z5PpUDCb4z81f9sFWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538295, "uuid": "3323bc59-8aa6-4071-aa2f-1c8bea6525d0", "value": 2109212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538295, "uuid": "24ec3b3a-060b-40ab-829f-8ecca6cc36ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538295, "uuid": "0721c6d5-c3e1-4573-9f6e-4b4f0dee8d53", "value": "REQUEST FOR QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18081edf-44c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777575731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575731, "uuid": "e6e5f047-ab7d-4d64-a1c0-3a3113cd4d54", "comment": "Malware payload", "value": "98815251d244a711d926b022d7d36b39", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575731, "uuid": "666ff3d9-8a84-442e-a0ee-9ddee91680dc", "comment": "Malware payload", "value": "9bf886ce25cab267823e98c9e261eeaca36c2618b94822c52ba48f44cc84226e", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575731, "uuid": "17035b70-00f8-4ba6-b0fa-db8d65fb391e", "comment": "Malware payload", "value": "82f5c268f0cddaf30ccae2587bf05cf80c82319b", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575731, "uuid": "27c6de6c-ac88-45ce-a2c2-18ac31324b13", "comment": "Malware payload", "value": "840f8dec2099e7ca987490c74d9c053bb51a7d4483fddd0e85d7456d9bb668aa64692a4a173425612952867d55e4e8a5", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575731, "uuid": "c3ec5eff-aae2-4890-9fd6-b3fd834d3dcf", "value": "T131B29E38C77D822005E61BB78A2919E4EF748B026EC4748AF31D6D750D7982DFD324B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575731, "uuid": "3dc5f683-cb0b-4647-af9b-882089a55392", "value": "384:uIsMg/LtqCGp/388pkB4nrJYxO84rRGQrFBG3w1IcTtNs562yDge3T5KJKMul33c:uIsM6top/388OM84VGQ5gzcpNsySYj2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777575731, "uuid": "ad8904e5-c7f4-4010-b8ad-d55f1e371dde", "value": 23444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777575731, "uuid": "509243ce-b4e7-405e-835c-fa5657b49e99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575731, "uuid": "22681dc9-089e-43bb-9815-c5404dd1cfe4", "value": "agosi(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f18914d-44d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777582776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582776, "uuid": "7a176808-0240-4ce5-9177-4d14fbeae0e1", "comment": "Malware payload", "value": "0f3a46479b2b0c3614147d008df71ee4", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582776, "uuid": "761ee670-c906-4468-ad0e-f5047386d07f", "comment": "Malware payload", "value": "9c5bb3d29e9b323a092b47674632e16cff2eba1185ab2ed1913c3e12c37ea3b8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582776, "uuid": "becf9f4a-e9c8-4eb2-aa66-c97bee7509bd", "comment": "Malware payload", "value": "eb0260097544a08a56bb5206eabd58802c9bb135", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582776, "uuid": "63a8b446-927c-475c-9020-438d19e447fc", "comment": "Malware payload", "value": "53015a226521938af2e1dace4c1bdd416e03482f52c5c881cd7fddc05ab4a66a9fcb1dbd90b6a3670e70a056790b0209", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582776, "uuid": "9caf4bde-f599-4795-b735-239ff7bc0ca7", "value": "T1BD43CFF7AC7156D96ADF133508EAE1F42719336D1E9336396B0095A9AA3120243CB377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582776, "uuid": "af168cbd-d3d8-4ca3-899f-2f862d5a165b", "value": "768:bfNEstR6k4yJwipQDKmLa1ebAZnVsGfYWqHqj+Ep3okuOfIt6jHdW82Zo5hQ4/zc:2stYLMZn2pH6ftq6I/cC4outGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777582776, "uuid": "fae76113-63a2-40f0-959b-ab8cc9a167eb", "value": 57193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777582776, "uuid": "d8737898-c26b-4b27-9a61-56f76a3e6f9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582776, "uuid": "78bf94a4-cb03-451d-96de-57ba3d7d6c14", "value": "dy515430.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829a068d-445d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777530383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530383, "uuid": "5f778db5-4369-4007-a39a-8e99a713f4f4", "comment": "Malware payload (RemcosRAT)", "value": "81806afc9114ad9ff8e031322ea432ba", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530383, "uuid": "1731aab7-86e5-4d43-80ae-5efffb009245", "comment": "Malware payload (RemcosRAT)", "value": "9d29b0645f6cc8361dd6919370677171de9086e1797992dee797fe02afc5023c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530383, "uuid": "67b6ddd4-dbc8-4ca6-89a2-904c56ba69d3", "comment": "Malware payload (RemcosRAT)", "value": "8288f29307ccd421b0a02e4643bf796466af7ecb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530383, "uuid": "c68c53ab-d34f-4e52-adba-98c6340a6fd0", "comment": "Malware payload (RemcosRAT)", "value": "c4cea7603fc72b892f34a2a859710d569dc22c948b5803809cb53140363747e0f99194462aeb57e12f4c5d0a0afa3ab6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530383, "uuid": "0517aa6a-e960-4337-9aa9-80242f2d28c0", "value": "T1F482D8264E01EFF4462E7292AA1F3C2B2A41073296713C9CBD8FD85D376E751CF95988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530383, "uuid": "9503d881-c46a-4e49-b196-bb1a1d5984de", "value": "384:Kf74nB6mqTzpryIU74Dxz6sih/cktg9EvfM0WGPH0AwLcug6N7g9:KjnNZYzS9qWQmLcug6C9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777530383, "uuid": "d30acd24-c761-4bc9-b6e8-8636d88bf5ac", "value": 17734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777530383, "uuid": "cbf7bb85-b226-4c77-a7b8-79c1dc8c7993", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530383, "uuid": "e11fba06-09cf-4b18-8e9c-f432e57e0fbd", "value": "ORDER_SPECIFICATION.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af72929-44ad-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777564757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564757, "uuid": "6ac8b57f-b51b-4c46-8ec2-8744f6c7d50a", "comment": "Malware payload (ValleyRAT)", "value": "83ac84137ce98956cc848b9639830679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564757, "uuid": "bfceb80c-c23b-4132-b0ba-7af6b0e3f4b7", "comment": "Malware payload (ValleyRAT)", "value": "9d4d400c573f5e3a3f96c9e5b10106fb82c5731f971c89381dad5f2b8ef6c3dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564757, "uuid": "1e56b8c6-99e6-437f-8ae5-f3f9393ee684", "comment": "Malware payload (ValleyRAT)", "value": "7314d1851eeb23850de733a577952fb358941034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564757, "uuid": "48fc9e7e-7361-4f98-9d81-d8ee0b95c6a2", "comment": "Malware payload (ValleyRAT)", "value": "002d73319e2edc532f245beab98dc266b21f044a1c63f1152587e8c7a3858d2e869c80afe983cd8f5aafdc394d7ef63f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564757, "uuid": "a9ddc33c-3624-4f32-9345-ba578870636f", "value": "T1C1173399A36028F5EDEBC538ED970941D7B17C4A872062C72BA861483EB33D5DF39247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564757, "uuid": "dc112f58-c9db-44af-9f22-a3ce1ceabfff", "value": "e8a30656287fe831c9782204ed10cd68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564757, "uuid": "11398979-61d0-4e2b-855f-5ae150020c45", "value": "393216:z/gkeWhn9zR2FwYt7GXWU8uNL7FnCHSYbYMmn17Zu67S2eRFQCxYasgAaUVdIIT:ckh9ohqXWUBUHSYbDm17MTFQCTsvUIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777564757, "uuid": "bc1e0100-7ba8-49a5-998e-aff8a8280461", "value": 18691300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777564757, "uuid": "006c77aa-d0dd-4cbb-af46-431224599418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564757, "uuid": "90d4d3a8-6b21-4254-96c0-58feb00523f7", "value": "x64-Chrome_Setup-886301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b28fc9-443d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777516502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777516502, "uuid": "e5de5bdc-3d07-4e69-b8be-734481565aba", "comment": "Malware payload", "value": "cbedc230162cfeb00d22223ed2b7c32e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777516502, "uuid": "fc4a75ec-2ef6-4923-aa52-a4bd37f1940d", "comment": "Malware payload", "value": "9d9f128f61aec17af6a955b4577e1e6af493b3c4b6dfc5be5a4976f6f644ea05", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777516502, "uuid": "48d4a6a4-6cdf-4d22-a66f-a93dd424da6c", "comment": "Malware payload", "value": "ab4df06ad4f43c5bbea8d11cac1132cde2466ad1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777516502, "uuid": "522b1f36-8bb5-4bc9-9bcc-410b40477eb7", "comment": "Malware payload", "value": "b1a78772f226083b27ccbc81b59ebd8a78c274f3b503a76ce4a4285ff691a2de3d3e116e640201e525c8db08d9ddfcdd", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777516502, "uuid": "a81303f5-12a9-41db-add6-0329508e25f0", "value": "T1EA178C1762E501D8D57AC0388B279517EBB1BC1A1330ABDF16A0A6562FB3BF01D7E325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777516502, "uuid": "66df7509-d3ae-47cc-9f06-6fcb16145bb4", "value": "9bc2c620b7c66ab1d6a3d71b0ec7d288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777516502, "uuid": "d1260e43-5a72-47ae-86d6-28f9c530f346", "value": "393216:z5WHh2WS1z7AInuYlK6yygKFdu9CwJsv6t6cq:zOeHU5yiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777516502, "uuid": "ca74ae99-233c-4020-9a57-c36b09ea509e", "value": 19408128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777516502, "uuid": "dce410b1-566e-44d8-99ce-4b5c5a85feec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777516502, "uuid": "9623722b-900e-4e1d-922b-42b26151c09a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eda6624-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538484, "uuid": "91e4399b-4ce9-4426-b01e-6ff63147bc0e", "comment": "Malware payload (XWorm)", "value": "87c8c5643dc532e9e594eee28741bf62", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538484, "uuid": "fb168404-9853-4fce-90c9-9796b3260261", "comment": "Malware payload (XWorm)", "value": "9da76de9f8fa8c961743f2a08f21ee79fad3176525753bfe733ce79e411e06d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538484, "uuid": "d08584f8-02f5-4be0-a5b3-0994dd25b7be", "comment": "Malware payload (XWorm)", "value": "e3308c869b2d1daa85eee28be9aae7a762cb320d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538484, "uuid": "5e25fe20-cd66-4e49-92c2-03ef97f6844c", "comment": "Malware payload (XWorm)", "value": "2e2e284e0359d7998f6e5dc68881613eeea85ac4d6cfe1a1170267b4de9bac99d122ec458205592780a99bc69de135fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538484, "uuid": "00ab5695-05bd-4fc3-ac5d-8a51bab20cab", "value": "T1BF3713121E2BCD5E96B172A202F8550FAF7849CBE4D41FF689EB7DDE014F760214CA98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538484, "uuid": "d2e4acef-441a-4312-b5a6-37c2ba662687", "value": "49152:4sm8smxsmmsm3smjsmxsmksm0smosm2smSsma5smTsmwsm2smysmiWsmOsm5smxW:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538484, "uuid": "e9d7a93a-dde2-470b-9294-06e1fd64698a", "value": 23944466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538484, "uuid": "1b0d3e94-3643-46cd-8e43-cdb9ea1365a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538484, "uuid": "774b1cd8-6998-418b-90ac-48a41150b4df", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb0938c-44d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581648, "uuid": "74594020-a6c4-44ac-93da-6b5345b8be85", "comment": "Malware payload", "value": "850c200871d88c7dd3d9874f29fb0beb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581648, "uuid": "0750b8cb-463b-4ca1-a79d-4b410c3ce6ff", "comment": "Malware payload", "value": "9db4184ad94899952d78b7cb1c6459f7042ab128d7739d4ec9fec169f99a787e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581648, "uuid": "134a30a9-912f-44b1-a2f1-da70cd438903", "comment": "Malware payload", "value": "36c050dc15b191576c6671b33f1625af655ff78c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581648, "uuid": "9a5c4927-c880-4366-8066-bf540f34ae70", "comment": "Malware payload", "value": "3a52f2c068ba55f16f9693e248589d722c8bb69f8aa1e4b94b721c5fcafa2b02a5418f745e321430cc32e13cef5eb1ad", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581648, "uuid": "23cf915d-b5fa-4817-803b-908db0651284", "value": "T16165506E1A4AD4CEA3FA3C45519D4CF3A62D9C21032AB4B1BE197FF3D506815A781CE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581648, "uuid": "cab48eec-ad1a-4165-b243-429b0d757190", "value": "3072:oRpwp87LlxTdoQmjx2+LGUGqgR4IJy2BlPZ1Kt9LGQ3ZHaRhXZiW+H1A2W6ZTTEA:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581648, "uuid": "f9c50128-04ca-4d9f-adc2-fcd33aeccaa7", "value": 1538904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581648, "uuid": "72af9363-4a98-4db0-b2e9-6e89d3b60f53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581648, "uuid": "436c193a-fbd5-461a-a769-a13b9ca9fdbb", "value": "Notificaci\u00f3n de radicaci\u00f3n.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ddff38-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514263, "uuid": "eb27aa4d-bf81-46c7-8c4d-e8c92fe202f8", "comment": "Malware payload (Mirai)", "value": "165c813395247aafca9344259788a1ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514263, "uuid": "44f20a07-cd25-4eab-a6e7-b5a1af80b9e7", "comment": "Malware payload (Mirai)", "value": "9dd2cd073a0dc4eba7f048a541dd85fd859e2b22cff43053f9dcea6dc1a70ee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514263, "uuid": "19916cf2-5e26-4e08-abde-415e2b5be88a", "comment": "Malware payload (Mirai)", "value": "95c796e631b0b91dacfe96725eea76dcdeeb57c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514263, "uuid": "ce894b23-2ce0-4b4d-9041-e017c955bd0a", "comment": "Malware payload (Mirai)", "value": "b71970e07e3cc18e6791b06d58881f7cecd506b287e7127e4846e75ef6eb73549a6ddea64825281d031387b9d621cbfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514263, "uuid": "4871e0ba-4fac-4382-8c1b-1959b7ffb365", "value": "T197D36C72CC356F68D624E5F0B0309F791B93A960818B1FBB55A7C2B59083D8DF6853B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514263, "uuid": "a68661d2-98b7-4cf5-9400-0b2e92b51e86", "value": "3072:kuylzUWzEWJ8W0EMjS52zQhxx+W9VUcyLn:7ylXvUEMjS4Gr9VaLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514263, "uuid": "87faf9c2-257e-4449-82bd-4b7c635119b5", "value": 139132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514263, "uuid": "fb5e2314-ec89-46f8-93a0-da13d680e4aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514263, "uuid": "f1533ffa-7c5b-4977-a658-31adcd1f956f", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d28cb29-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535475, "uuid": "677b0868-175d-4b3f-927f-36186fa999b9", "comment": "Malware payload (XWorm)", "value": "d360f6c8e9961d0cf8307790dcfa359e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535475, "uuid": "ff9f6e25-f600-4ae1-b96c-63e8ecde38e4", "comment": "Malware payload (XWorm)", "value": "9df1eaf7b87006da89679246eb5111177110e9e3a931bd7443659ed47a807011", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535475, "uuid": "68cb8c7d-71f4-4589-90c4-04915806c4e1", "comment": "Malware payload (XWorm)", "value": "abe752446d9988fbae30bfe09750022e82b69aef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535475, "uuid": "dfde9320-53cb-4f95-93ff-ef181c63c76e", "comment": "Malware payload (XWorm)", "value": "1a426f50bd9164019fed6cc9a438e68137c04948db643595ea18482f5475585ad64b1fb4399017e1e3f3d6d956c4cae8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535475, "uuid": "e9d4efb2-95f5-4916-a45d-9cd00511f823", "value": "T1423723D3443D6D6D92B51A6D04A72E9BF4BC8B0B0D40A4E073E5DCEE815EF5A2627E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535475, "uuid": "a911cd44-a9dc-41bb-b45c-6db779f9a653", "value": "49152:avlXvltvlovlfvlnvllvluvlUvlKvl4vlWvlAncob3vl2vlivl9vlFvl+ncobSvM:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535475, "uuid": "0317984b-b678-473b-95ef-5750ea05dcdd", "value": 23424211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535475, "uuid": "57a565d4-134d-4c27-94b4-7b5baf04ce9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535475, "uuid": "becbfd30-b222-4a82-8a8f-dfde6668e9c8", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f13f5e0-44bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777570616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570616, "uuid": "1077ff7e-ffde-41b5-8388-b587470165b0", "comment": "Malware payload", "value": "63382950ae663873acdc40f58ea8f008", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570616, "uuid": "e63c830f-09bf-48e6-9658-1051ca6fa310", "comment": "Malware payload", "value": "9e25c19e821e646c7037f0f9b191f81f652a933eac092b63dc603de02865c956", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570616, "uuid": "31e0f7be-7b48-46e2-bbf8-0c102d3c65d9", "comment": "Malware payload", "value": "22a1cb569e7eb3f43197acdaf5dee0e2885fcfac", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570616, "uuid": "25ecda9c-b53c-4b52-92e2-1aa8ebbee7d5", "comment": "Malware payload", "value": "421054b4530c0477b80c3ac0a4f49caf78003ea9d8f280ac7d5694594eca43e9ae73cc3509772d25c66140b3e59f2103", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570616, "uuid": "e23a14eb-626b-471a-8371-7db54e6b3c03", "value": "T17F13AF261B21F6F393C40B6A48350DC799945A5794EC12EEE2146A12FDC9A2EF0F35F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570616, "uuid": "2dc2f702-d5f4-48c0-ade7-a9b90e12e74e", "value": "768:uIsfeMTCAMfMTFqmxgD3OtprdZoGoR0IbeQkg02EijaMP60whheSc0FYH28QnpVM:IHpZTEmy3OtldWlRzHVPEiFIhh8A8ikp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570616, "uuid": "ab17bd2f-e11c-401c-bd05-5ad29d60cae8", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570616, "uuid": "236f2ed0-79f1-499c-81f6-3c956f9dceb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570616, "uuid": "59e4666f-ace2-46ac-bd6f-55f10f5c52e3", "value": "ejici.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a74ffef-4458-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777528195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777528195, "uuid": "54af054c-c13a-4315-afa7-24a8dc7b4f29", "comment": "Malware payload", "value": "650cbb282892c85edeaa6786cabdc89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777528195, "uuid": "849252f0-a2e0-4cf8-9ff4-0d7b189f5af1", "comment": "Malware payload", "value": "9ecb8ca67395418e9640e8c39f82a481013669e7c95c763650192478978f5be2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777528195, "uuid": "f3b719d5-8b80-4b0c-b14e-a951e6a39bfd", "comment": "Malware payload", "value": "3279a9cfbd7f2381dfce3073a25d3ca23918ef72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777528195, "uuid": "70a1fb24-e5fa-4266-aae0-596e7b50cb3a", "comment": "Malware payload", "value": "713e877c69740a1e452938d2df7f040bfd5697e24fba0eeb11e2bbffd3ed817f7e3cf8706c24ef3102f9b685f1f14847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777528195, "uuid": "485b6ab3-8dc1-40a8-a324-6650467fc7c3", "value": "T1101833101EA0CE2BD36AC33E96E0F7F63108BE931E9912975962F49E66F9F2C3474115", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777528195, "uuid": "9c8318e0-4c1a-4380-b003-c57914a8805c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777528195, "uuid": "a4b59fa8-1f55-42fa-9462-e621d5ed8e57", "value": "1572864:Ku+BWMFDe45kLqS0+Ns6hDRVOfANnH7MZJ9HJLJ6fzoXzcA2fy7BlwhPyxQai6qr:KfBFle45H+NnhDRVcA8HJLwfzoXzc7y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777528195, "uuid": "87439f61-e5ff-4afd-8b1a-57cb42ae2ac4", "value": 90461611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777528195, "uuid": "bf2aaab2-8c22-4c91-85f7-ba7fa522630d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777528195, "uuid": "81f16362-f3a6-4dec-8dc7-715889ec4106", "value": "TheEnigmaCases Setup-1.4.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb00859-44c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777573214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573214, "uuid": "239595d8-a832-4253-a8ea-deb84fd1b6c1", "comment": "Malware payload (Gafgyt)", "value": "e658e01e150cb179aa2af9d654f83b01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573214, "uuid": "6b8452d9-bf56-4779-8c9d-6882e54d14c0", "comment": "Malware payload (Gafgyt)", "value": "9f9a0c8056657d60754f41644f53e47efe7ed1768f1ccf6211ba461e91af53a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573214, "uuid": "09ca4dfd-0320-4d00-b24e-7e1945c50916", "comment": "Malware payload (Gafgyt)", "value": "217ad365476cd5e7320acf6f770c92c198e2d870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573214, "uuid": "9cf50437-3969-4840-b99e-d64fc231e85e", "comment": "Malware payload (Gafgyt)", "value": "d8b964d2ff1c984fa9eacdcd2bb35fc0e1ffa56b950ae3c5bfc0b14a9f886d1f79f4aef182af2b4f0f43349c760e0f3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573214, "uuid": "25a33797-c449-4845-bb2c-d72f92ab9f4f", "value": "T1C2F4BF53F2A1EDCBC0564BBA046AD3308357E5A11763F280F23AC3681E63A59FE4D765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573214, "uuid": "a46a113c-4687-4a2e-9d85-c24a3cf68b56", "value": "12288:lh62PYlPpGPqsMZXJ3rV9OLsq8q1FXt5qqFuE0o4xgP8pVjPm1rONMGXNr6GS:TcsM5J3+wVq/2S45PCsMsNr6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777573214, "uuid": "60721dba-016a-48bd-b178-ec7419f79aab", "value": 755272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777573214, "uuid": "e4525f60-8e5b-47ff-846d-2bd08ac001b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573214, "uuid": "2e43e08c-e800-4670-b05f-76e2163ce435", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659a8ba6-448e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777551380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551380, "uuid": "fc5403ca-40d7-4574-8c6a-afb87cb9ccd5", "comment": "Malware payload (Formbook)", "value": "8c713bb58892e0054cc6bdc53601e4f9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551380, "uuid": "32b86595-ce8e-4642-aaa4-d452fa205c39", "comment": "Malware payload (Formbook)", "value": "a13b343a426a77ca6777f53691d9e17d6843f0171c9d2869b708c320340a9bf0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551380, "uuid": "7f15c1cb-fbeb-4385-8f6d-581d33d019f8", "comment": "Malware payload (Formbook)", "value": "480eb1249f05bfeb7b89fab32eac05bb61f7630f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551380, "uuid": "d647be97-d32f-47d4-bd72-dca2d8192cd0", "comment": "Malware payload (Formbook)", "value": "e43aa7ef7b45b688ce669d9df36e9f0c72415f060781a9154ef08de4981f11c632af8e5f8c7d4af2fda4472393a439dd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551380, "uuid": "701e66be-9a05-41e6-9723-e61781d319d3", "value": "T10B6533205CF0BD6A97E8025868FBFEB55BC00FC3409EE1270B5124960A9F715D97FA6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551380, "uuid": "4cfc1f53-9a89-45ae-bfad-2b9173e54fa2", "value": "24576:L9oxBAJy+5KCeqH5nCmErm28hRuJZ9hsRrMNn4yIdx:R8AIc4WGWMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551380, "uuid": "6f99dca0-1bbb-4733-8a60-1e00890d077a", "value": 1530746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551380, "uuid": "a7f5ab5f-4b56-4213-9495-2cab6c475eb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551380, "uuid": "0302a7e5-4356-42d8-b434-b791059ad3af", "value": "ps_3JvSUZsKwGmt_1777540134843.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846a5ffa-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535540, "uuid": "bd4cb822-1661-480d-96aa-33db4989c28e", "comment": "Malware payload (XWorm)", "value": "cbf5012c82b10884c107142425ddcb61", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535540, "uuid": "74b651e5-4417-4551-80af-5310ef9dcaa2", "comment": "Malware payload (XWorm)", "value": "a240f901424ce6d99c44f8c6f134ef28233fc099f304cb4f22a9dbada3adc7f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535540, "uuid": "7aeaa733-32b4-4a8b-8d5a-4bf0176cd0fd", "comment": "Malware payload (XWorm)", "value": "60d3ab744f5d7a32863224700c2dc74de5acefed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535540, "uuid": "2dd173ce-b682-42aa-8116-280717978cc9", "comment": "Malware payload (XWorm)", "value": "e75933a0554fe28294c1c58b0779ea6ec113c202120e4d013b4fa217b0d4669785c20ce0ea182eb7d35280f62d565c1e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535540, "uuid": "86ffbf3c-844c-44ce-9770-fdd3ce0e1b84", "value": "T1AF37230D07BFEA0E53F820AE14274B0D81BD37515C409DAA9FDFBC8A225DB219D1B96D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535540, "uuid": "1509aad5-b6df-4cb1-839c-a40c195860a6", "value": "49152:0/4cjRnS/4cjRnb/4cjRnM/4cjRnK/4cjRnm/4cjRnF/4cjRn8/4cjRnM/4cjRn6:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535540, "uuid": "6d1f92d5-8f29-4711-94f1-4c55b5327bf1", "value": 23424182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535540, "uuid": "eb0aa503-b769-4d7b-a50d-59fa2e97f983", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535540, "uuid": "9fa71541-38f9-4a79-967d-6faeb1ebb241", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bfc22b-44bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777570654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570654, "uuid": "6c35d62a-7a20-4c2e-ba61-db1dd8bd40c6", "comment": "Malware payload", "value": "db24f2fe6d19577321e1f14cebcb9cdd", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570654, "uuid": "c68621f8-d0af-455d-a792-296588618c0f", "comment": "Malware payload", "value": "a24e2ed087aeba56ee48fb863ead816f8b00521aece91f231d7c086c5823cd6c", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570654, "uuid": "0d90b005-85bc-4127-b94b-2d633460ccb0", "comment": "Malware payload", "value": "4932145fa0a676eecdd7d2f03f8262bea57f906e", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570654, "uuid": "e13479d1-c2f1-4c01-868d-37f86e7cf8d6", "comment": "Malware payload", "value": "3a90387aa963445bf48c976ecf81175caa1bd50c220f90f2cc79f5681e3420407bd1007831c2c8251de5b37d6803546c", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570654, "uuid": "82df52a6-a85c-4044-b063-305b1e937d63", "value": "T17A13AEB6BB469BF08BC1CB53C554D0C5FAAD58A9104122A7970F31922D4EC76B9F30F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570654, "uuid": "bcd90936-79cb-4369-8cb7-00d493d7c811", "value": "768:uIsbL8ZIpA4dzYAdoqv80ZElGhdAE6CyUs4x7j/aIb6rtG6t0Fbfl+07NbN5SouG:k042AhA4ykNGrtX05ZbNcomByc5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570654, "uuid": "ce5244b5-32ee-4d1c-8ed1-a4f9431bdd80", "value": 42412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570654, "uuid": "1eeaa06e-826e-431a-8aef-0673e703b6ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570654, "uuid": "940a8d12-eb1e-4b76-9383-454be8f7759b", "value": "idasa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14f67ee-4448-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777521469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777521469, "uuid": "eb7bc53c-67b6-4b0d-91f9-36b813a84e5c", "comment": "Malware payload (RemcosRAT)", "value": "416171edee4a2f381d409ff3573fa78e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777521469, "uuid": "33c9ab61-70dc-4569-8855-9c33d4409764", "comment": "Malware payload (RemcosRAT)", "value": "a2981e21862033fe1d093f522b57bdb9b462dc177bdffa195c5b23ef4f70169c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777521469, "uuid": "cd28d7f9-56b5-4ca5-acf6-0efaccd66b0d", "comment": "Malware payload (RemcosRAT)", "value": "8b70f990bb7e5ade965791f8d30c5bdf0ece456e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777521469, "uuid": "e6aa3bb5-61c2-4bd3-8c5a-e8cf4686cc33", "comment": "Malware payload (RemcosRAT)", "value": "22ff119ca8e1d5f16ad537f92007b2c7e8c21044a776a09ebd66ac757b6d90a4d31b0e9457c4e67ed2f313fb698cc752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777521469, "uuid": "7531a175-7c99-45d0-ad97-89951ff2292d", "value": "T1C9F4E00932B2C94BD3520BB059E097BC757DDD702D16C316266A399DAD2FFB80AE01B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777521469, "uuid": "f4a5cd3a-ef5c-4da9-a4bb-83316271c9f0", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777521469, "uuid": "b821b125-b2e8-4cbe-8405-6a7417766a46", "value": "12288:7X4unnzoRZwLaHRTpp+UCEX2PUklcN+0PA+WYt96OVtOeGpjw6j1l7:z45WaxxC8fkCN95t9VXhuk4l7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777521469, "uuid": "02cf45c6-b733-47d0-9bb7-c7ef103e99ec", "value": 791590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777521469, "uuid": "9ed80ea2-bb1c-41b2-8146-887ecaf21869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777521469, "uuid": "65a0a68d-7d3d-4154-b287-5340fe49d772", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1de7248-44a2-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1777560205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560205, "uuid": "35a84826-72ba-4d1c-a04c-192cc79b305a", "comment": "Malware payload (BlankGrabber)", "value": "037d10f615101b1bf0db7f32a48987d1", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560205, "uuid": "44e670c0-f963-43fe-bf1a-964ba0982089", "comment": "Malware payload (BlankGrabber)", "value": "a3d819218f433e6d8f8bfac97beb5a073cc910a7f2a7b3ba9297da72a7fa3bfd", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560205, "uuid": "412107d1-094b-4926-bba2-769d098fdb7b", "comment": "Malware payload (BlankGrabber)", "value": "4de7229b6251ccaeec59232a1bd04b9e51522d23", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560205, "uuid": "fd8c1941-afd9-44e7-9f7e-d1bb981815a8", "comment": "Malware payload (BlankGrabber)", "value": "0fec15c035d8e367736c19cfa18cc7923a54933f4fe4430351bbf50b43bee4af57ddaba96c890ed1f7ca82e8fddde429", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560205, "uuid": "ee1fcd30-b32d-4732-8179-8f5b5413a982", "value": "T1E1773320B61498F1ED33E574FA316781772FFCA20725C6A7125AC256ED367A02A34EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560205, "uuid": "90d7b969-b1c4-4c70-a019-e2659b9cd489", "value": "ad510aa4318530074af11ba8249f6938", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560205, "uuid": "8625c510-6052-42a8-82e2-39a7fb80fce4", "value": "786432:kufjjMqwvY2WfnQ8lSs/omTITA/xxj4l8587RXU:vfjjMYtfnQ8lVHECxxjEFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777560205, "uuid": "91821eec-de31-4b47-adad-fd2220c4b885", "value": 34177432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777560205, "uuid": "e861a292-1af5-4f5e-8805-0bea88a6de45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560205, "uuid": "58da152b-1e6b-4c23-a0b5-06e4dcd0ee3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b68802a-4492-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777553054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553054, "uuid": "f3776785-667f-4c55-a954-aaf12087f1a0", "comment": "Malware payload (Gafgyt)", "value": "7146d6c1d8e581a636e0504f08784752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553054, "uuid": "23c72918-a4f5-4979-8596-5b32d67a8fad", "comment": "Malware payload (Gafgyt)", "value": "a4f5dabdc4f13e71a0c43ac25ef106941267897e7fc82d205b516a34c5eedf2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553054, "uuid": "f600611d-82db-40c3-ac32-a920bd5f4c25", "comment": "Malware payload (Gafgyt)", "value": "503755623bdd03b28d33abdcb067f8b1b4785ed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553054, "uuid": "14e2c8e9-39dc-4905-b0ef-6dcaef673f1e", "comment": "Malware payload (Gafgyt)", "value": "580b44760649b7336eef8f50a3e88ebcedc0ef7ecaaebd38415d7c120d1fd0e1409530151f58280c131f89f80ed328ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553054, "uuid": "736bae3e-b76d-48ef-b0a4-df602e5b761c", "value": "T194157C5BFD5E3C07D2E7E23EAB8AC3B0522B7590D22351677982032C95C6ADCCFA1651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553054, "uuid": "10cf7c51-7d99-4897-8bfb-c3c9ccb055aa", "value": "24576:HnKHWpd1j5VftydJ90i7n0kjhY+HV5HS88:HeWyL9HhfHV5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777553054, "uuid": "dab0dfe6-a88b-41f0-b5cf-b6ab1d462434", "value": 940592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777553054, "uuid": "43ba0eb1-241b-41e9-b36c-2009937c8d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553054, "uuid": "4e2229a8-40d6-45cb-865f-3727cb64c5d4", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc130f86-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536949, "uuid": "2db022d1-25b5-4ed6-af6d-eac8d7cba9d7", "comment": "Malware payload (XWorm)", "value": "1a48d388a02afa131e939920d4e235b4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536949, "uuid": "c276a354-89e4-4dc4-b418-27ae12e321ed", "comment": "Malware payload (XWorm)", "value": "a5249f9fcc658fd63711408337e561b33e05b8f70e9acba944531f1f2625a6e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536949, "uuid": "9c774b2d-644c-4091-a354-5e586d3c69e7", "comment": "Malware payload (XWorm)", "value": "a4ecd30c74cebff5b86cb9f6c5f6b7304cf2ebd3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536949, "uuid": "6fda0109-e00e-47c4-adb3-c6f336a7d5bf", "comment": "Malware payload (XWorm)", "value": "3f2c1925de537c4eeb946f800fa2618a65a2cd6de94e067071509d9a69015c8b949037a8a8d4ee89714e2a6b27a41024", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536949, "uuid": "f280312a-2c90-4d16-ad2a-4936d148fd91", "value": "T19C3723858F788D3E4B2C55CF1C9B1E4E6E3ACB54E089E012A162DC9C6D8F638561F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536949, "uuid": "58b88d0d-9953-409e-8bb9-558c50144fae", "value": "49152:1GJRXiQRlH/3cWrv6tv+eMWrvf6WDzXRY90l1xbLWrv1Wrv/lZ7WrvmXZ0ufv0cK:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536949, "uuid": "a76fb785-e70b-4cf7-bbec-3404e1e865b9", "value": 22903939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536949, "uuid": "b5778b48-d7f2-4301-ae60-75695498e2e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536949, "uuid": "bc901c56-6d6a-4a3c-be9e-61e56edb2090", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb3d784-4486-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777548042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548042, "uuid": "38bc0e70-982a-4809-9ca0-5e4913bc3ceb", "comment": "Malware payload", "value": "75b009a56079eef56d8b845ffab385eb", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-31431", "colour": "#03A971", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548042, "uuid": "2ae59c25-244e-4ed0-8add-e212037c7ad7", "comment": "Malware payload", "value": "a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-31431", "colour": "#03A971", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548042, "uuid": "cf431fd2-8340-4937-a9e1-ebd1d53a03c5", "comment": "Malware payload", "value": "83194d178f4b9c6fcdfaed0ea4ae3ec2ca3db6f4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-31431", "colour": "#03A971", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548042, "uuid": "614f1e59-26d6-41d1-baf0-a933a40379c9", "comment": "Malware payload", "value": "6b9a416a16fe23bf13715d39d3ff7176e1a9e1ea1edd92f83dbcb99b464b72185ed0650af116ac507b150b1d9227c594", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-31431", "colour": "#03A971", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548042, "uuid": "93b8f911-0c1a-4c5e-af06-ce0cedda56f9", "value": "T197011594BB3452DEDFF81EB90A147A4025C9346049D38D0857ADCEC06983EF2896D655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548042, "uuid": "66da3ba5-d5f8-45a6-8320-0d1b2a6d1f8a", "value": "12:H8X+yWTNB8cDbxxog1EfPuWCfMplGmsr7UqF1mhBEwO+eJpUvE+BAGuVQa6jKmD1:++yWBB8cDbxL1EfPuWCfMplsXUSD2E+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777548042, "uuid": "32641e07-75f5-464e-aad5-0ebb90682c92", "value": 732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777548042, "uuid": "73f92705-b23e-4d90-b627-5f9bfbf4cb6e", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548042, "uuid": "c9b8b512-3d9a-4d4b-997f-19a99fdc66ca", "value": "copy_fail_exp.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68bfd15-448c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777550711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550711, "uuid": "9072bf6b-5906-4f05-98ae-d1bf0426fb37", "comment": "Malware payload", "value": "29b8f9602c64ea63c9d2f1438547d80a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550711, "uuid": "ad351a7d-c44d-4163-9327-449c138a5c5d", "comment": "Malware payload", "value": "a5b189eff1131e068b5e2640604dc43e1da4fcc55001dac774bf3286fa4dde8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550711, "uuid": "a1a2c2be-0111-4cb4-a1f2-4810abcd769a", "comment": "Malware payload", "value": "94c71b0499948555acf176df81fa8b3a1d87c5d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550711, "uuid": "e1bc88ea-932c-45bc-aaf2-28df887060f1", "comment": "Malware payload", "value": "6335b483bc43c29213435bc151845feedefe832a5c0ea93a62795bcb2d596b076ede16eb2e131c96c358a3e8a8fa18b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550711, "uuid": "1a495743-5848-4c4a-b346-f5aaf4933f45", "value": "T1C5646B242EEA602DB1B3AF549FE475E7DA6FFB733A07945D1090034A4A23E40DDD163A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550711, "uuid": "6ea0f2e7-f888-4500-841f-19d6a2b9461f", "value": "6144:OrYYTwhw5Kvj0Q08LQh67fjdWM/Vq0FiG2P3RCXDsb2B5rFkhD:6whw5Kvj0Jh8fZWM/VRFL2P3RCXDOE5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550711, "uuid": "54202d33-8ee3-4ab0-99ac-de7d06b62cae", "value": 320880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550711, "uuid": "05bae932-f812-4556-8575-a87cf451119f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550711, "uuid": "4750865c-8d80-4258-a8de-1e79a7f60653", "value": "Spare parts New order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5934a0e3-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565103, "uuid": "9b91e055-5eee-472e-b87b-3971081729de", "comment": "Malware payload (Mirai)", "value": "1229e5d083620f4300d695cc53063d6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565103, "uuid": "00f1ff40-70e6-4872-80d8-dbe2e7bf5d4a", "comment": "Malware payload (Mirai)", "value": "a5bc19fb52ff02dc8a93ab0ef6a64c82be383892b9c346f473b66f24dc792a14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565103, "uuid": "74d0cb83-10e4-4888-9557-593cf2dad3ef", "comment": "Malware payload (Mirai)", "value": "c2b3a77729a5150ed3030f8af1d81ba48404c311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565103, "uuid": "34ab8833-baac-4143-9e44-e2c9ca45e65c", "comment": "Malware payload (Mirai)", "value": "4c388f600a41c985d266002906ba79a647f1e303d1fd81bfa69b60ab882b7f6e9b477f92c67a8d2f43761fc8bc6a7ce0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565103, "uuid": "e22444e0-4134-4960-ac82-fa042cfe194a", "value": "T10C156D88EBC794E1F25300F1068FD7F71924A2265053F6F6EB4C2A977432B526E1636E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565103, "uuid": "ba64a4bf-8cd8-4988-9696-df6d32e6c71e", "value": "24576:nugziEDwhakhPprah7XZGsuXGyvpSoNNxn1GQVmkB87ZMg:TiVhakhgdE/GyNNNqtMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565103, "uuid": "9991cf38-7c41-4d90-af95-3a6bca911b73", "value": 910428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565103, "uuid": "eceb60a0-1e10-4f7c-a80d-b8fffcbbb522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565103, "uuid": "64fa9f3e-92d8-4edb-ae91-20980e315a02", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8003f73-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777537023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537023, "uuid": "018c5e2a-73a0-4774-b491-0ca15f50bc17", "comment": "Malware payload (XWorm)", "value": "75fa25646ead10ec6eab486657e4890b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537023, "uuid": "4e97ac65-7381-42e8-b653-2578611506c3", "comment": "Malware payload (XWorm)", "value": "a5d1cde9be3c19650d5703f4c37a1066593000d26ee4b7459d8289df6ee87b84", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537023, "uuid": "7d8e5afd-0fd6-4258-b204-e547b0d3446e", "comment": "Malware payload (XWorm)", "value": "028b92b35720914d5677fa7fe7de8d8fbc41ebff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537023, "uuid": "234c9a03-0c29-431a-9bbe-277f9925e9a6", "comment": "Malware payload (XWorm)", "value": "ef5143053d4cb011bfd349bc693d72f735207e8e6bf37d8490731bd6d8fd95ce3bb930cfe73af730429c73a4ce1cac2b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537023, "uuid": "4b68e5a8-1059-4ffe-a24d-f02ac7d46814", "value": "T1673722471F7EFC3709E8025924BB4B8E4F9557AB4995C9E1DFB208ABA85C8C7002536F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537023, "uuid": "a02e8359-6094-4aa4-a8a6-996d6e8a510d", "value": "49152:KJQ2JQ+JQTJQmJQgJQSJQdJQeJQlJQ3JQwJQZAnMKJQOJQ6JQhJQ5JQIAnMbJQzY:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777537023, "uuid": "2ef560df-4c7f-4ff9-a074-c9e786d5468c", "value": 23944459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777537023, "uuid": "005288b4-71cc-4d02-a915-80fd6f315d2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537023, "uuid": "17def3a9-02f4-4b3d-9d5c-408ded56e636", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72e6485-44e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777590574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777590574, "uuid": "983e3923-ea5b-459b-a363-1721768d6805", "comment": "Malware payload (Prometei)", "value": "f4d827075497724f814aca017b88d62a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777590574, "uuid": "ee4b65be-ab9e-4d86-a3b6-9a4a4cf0defb", "comment": "Malware payload (Prometei)", "value": "a5f1ebc80cb481ade68f52214f669744583383f26881f081f04fd1ba1a5c0c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777590574, "uuid": "9ff41dee-b759-4464-93b5-01d48ec5258c", "comment": "Malware payload (Prometei)", "value": "44f79f071e519f538bccb68cf4e862c7a9fb047a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777590574, "uuid": "4430781d-96d8-45ea-9ebb-63a658e359c3", "comment": "Malware payload (Prometei)", "value": "02ed4cbe51ccc361949e2ba0173613ee6c646d27082d4e631df9749f0df10308dfabc239307124f3e718c58d29b7c4e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777590574, "uuid": "b6f47528-2186-41f6-8e57-01182718314b", "value": "T1D7A423B4F9229E9F6DD769B91B24C31DE181C172589D4C2313AE94A34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777590574, "uuid": "1ee1d8d9-80f8-4ba7-9240-a53e237bafd6", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsda:Fs6pyCC/Ya2hpi6T6N4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777590574, "uuid": "1d7debd6-b446-4313-a718-3fdc2cba5167", "value": 449080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777590574, "uuid": "1f6eadc0-c887-40e8-8d5c-634aad32ce6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777590574, "uuid": "b823b4ad-43ba-4318-bce0-91932670f903", "value": "a5f1ebc80cb481ade68f52214f669744583383f26881f081f04fd1ba1a5c0c4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3fe6ce-445d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777530478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530478, "uuid": "bce2f4d0-2cc5-4db6-8001-f1ff52d2b1a9", "comment": "Malware payload", "value": "f6734071e7525043c3740495e33012c9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530478, "uuid": "aacc7561-6257-4991-824a-5622727bc32f", "comment": "Malware payload", "value": "a69b0c26629aba3944b7deff796b331cb8345e2b84e885b7ccfe3451b25eacf0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530478, "uuid": "1bdb0ba1-4ce3-44f2-8843-9a8fb15032f6", "comment": "Malware payload", "value": "88d557517b053d3f15903e615ad4f3ffc9d1f8a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530478, "uuid": "c44d1fd2-c790-4522-b659-00d78acce3ba", "comment": "Malware payload", "value": "629adac938f31db3bd3635d81a547877b9bda27b78f2db0707c929e303a0879ebf03847b8b6179ffdb8b70f538b38ae7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530478, "uuid": "4b8bb277-fcc6-44dd-88cd-50a5414a3b02", "value": "T1AF949E38ABEE1019B1B39F54BEF42496D96FBB233B1E985C1091034E0633949ED9573E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530478, "uuid": "9053e88e-0ac7-4c11-816e-ad02e4d26d98", "value": "6144:dNJE0gpOxITXVXNbUaSmA71C1SPyPCqNYxxvoq1iYOWPbvGiiUNplSjKrp6QbPaJ:dfxITlXOaSms1CEPyqd5oq1DPbvimPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777530478, "uuid": "f5d42c8a-8e71-4f4a-8a21-b183c594d113", "value": 423632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777530478, "uuid": "590f04a2-21ad-4933-8b29-b65a5cf72487", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530478, "uuid": "3030e04e-246e-4257-8c2d-ed1ee5ec3184", "value": "Inter-Fund-Transfer 29April.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edcf0af-4445-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777520123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520123, "uuid": "b3efe62d-c78f-4262-8bda-4c1192b42fc7", "comment": "Malware payload (NanoCore)", "value": "c31f3b3a1ae565c721f8811f75888bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520123, "uuid": "26dec91f-290e-4eb9-a9fd-702e2d996a41", "comment": "Malware payload (NanoCore)", "value": "a6ed86a7a3fc21fad574482b06db74f424b8272b25a3fa5b28cd90dc5e4a0055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520123, "uuid": "0c7b9fc0-feef-4795-a740-7158102423bf", "comment": "Malware payload (NanoCore)", "value": "961af688559fc56fd29f517bb1d789288ffe4c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520123, "uuid": "2ea4919a-ffed-4f7d-be98-1384c62c90c9", "comment": "Malware payload (NanoCore)", "value": "8fa30a6e5953fae8c0b3d983c1c8bb1448fd4e0cde6cc44364b2b00a0cc3df8a9087cd01e999ffd1cae1c8ecef51b4bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520123, "uuid": "d30b64b4-c397-4510-9f8c-aa5a6c1114d2", "value": "T10B14C05677A94A2FD2DE82BA61221143937CC2E399C3F7EE18D464B74F263E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520123, "uuid": "2a2e8633-7b69-478f-871b-73070cb76761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520123, "uuid": "e9bd6c59-2475-4379-91a4-100b13b0a23b", "value": "6144:sLV6Bta6dtJmakIM5UMBrwBJnaMC8xFev7y4QT1tFY:sLV6BtpmkFMFIPHPe2DtFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777520123, "uuid": "102cc951-43b5-44c8-9d2f-65f018782cb8", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777520123, "uuid": "aadf4cf1-cb55-4ac4-81ca-7cb5cd5de88b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520123, "uuid": "d383ad8f-9a5a-4b41-930a-f6e2aa9003b6", "value": "xnanoratcore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5ebf9a-44ed-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777592031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592031, "uuid": "9b68ce7f-af51-4d71-aeb2-906fbf91af19", "comment": "Malware payload (PhantomStealer)", "value": "4d48fe5706cd61bcaaeceae42f8a1bce", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592031, "uuid": "51eaf4dd-20a7-451c-8ffa-c95dcaecc8aa", "comment": "Malware payload (PhantomStealer)", "value": "a6f26e627cc0f76cddd335fa29a515f6ed353614ce54d2b827135f75670e1694", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592031, "uuid": "a54e0bd4-b090-460c-8097-e8dbcb5f8141", "comment": "Malware payload (PhantomStealer)", "value": "9ff31ed79c6baaf599b0a2e732c293c503df32c9", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592031, "uuid": "e99f694b-bbd8-4d95-8cfc-a4fe0105b8ce", "comment": "Malware payload (PhantomStealer)", "value": "b9721954817a34e5f088d53a1f9c5d14f4d31026518f8eb7464a4c2fa743304263cbc8b514bb0cf6140e38721cd45e83", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592031, "uuid": "e7e571fc-65f9-445c-8873-0da10b6cc315", "value": "T1C7F533280FD82DD602A4C65D362FFF684A730F92848C69DE6BD421C70E6F649851BE7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592031, "uuid": "6ea78f19-ca84-4617-adcc-db2468876095", "value": "49152:sz3p6pGeDDRPKjuqlaCsh+yB7VYm6mP4E0yb5s26qMeKi0m5G8iFT:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777592031, "uuid": "e0116513-4a9a-4bd9-ba9a-a29fdb3f00eb", "value": 3526811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777592031, "uuid": "90383cc0-6000-4414-93f8-afbd31e42aa5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592031, "uuid": "c8c4a710-84aa-490a-9c4b-ff2e0e111d80", "value": "1A39VJNQ.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff50812-448b-11f1-a769-42010a9c0008", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1777550324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550324, "uuid": "8acb5475-aa76-4162-99d9-e26cbbaa55a5", "comment": "Malware payload (Rhadamanthys)", "value": "4a356827683d5dad47377d7901580b10", "object_relation": "md5", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550324, "uuid": "94376f32-f7a2-4929-8c0d-207c1352ae6d", "comment": "Malware payload (Rhadamanthys)", "value": "a793c1a77afeb7d85ee525d6333339e40e2fec841a9d79d87d02524cf9034909", "object_relation": "sha256", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550324, "uuid": "428ba71d-88c4-417d-b248-1fb862ab4e86", "comment": "Malware payload (Rhadamanthys)", "value": "6413cd6ff735d15cf6e359424de5740cbb734edb", "object_relation": "sha1", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550324, "uuid": "4de17b16-29cc-4320-8c59-75aae1e48dcd", "comment": "Malware payload (Rhadamanthys)", "value": "fef7979a52d3e8efcc5ad901152044f5b271b2949ab97eadf6351ba913cf47006900447eaa6268839ccd1fa6f00d6c85", "object_relation": "sha3-384", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550324, "uuid": "c421f9e0-1530-4437-9f18-30eb7b7623e4", "value": "T100F36C4773A420F9E1B7C279C9920A46E7B2782507619BDF03B047BA5F236D09D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550324, "uuid": "7c2d9df7-9a4b-4304-a711-8895e364164c", "value": "23aa6ede111f6ac860a5e9008f9b9673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550324, "uuid": "86a3fb3c-e49b-40ce-9483-e735e905a217", "value": "3072:ME3LoiohzgBlfhsoXF2EvKLQYvjj06C6rLqJ/Pb/CiZhHHoqSPQ1jRt:ME3Loioh8BlmWMEvKU4rVqJHHmPW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550324, "uuid": "d782edf3-2e1d-48ba-a702-eaac11b1890c", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550324, "uuid": "44d28e6c-509b-4233-8300-687fd73ea792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550324, "uuid": "1f95a7bf-d9bb-43fa-bf2c-8a6e3b9326cf", "value": "metacore-loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d90a35-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535575, "uuid": "5f14f9c4-8bc7-45d9-8b1c-e163c8b67795", "comment": "Malware payload (XWorm)", "value": "efbc2e03c5f063d611593a06e2b5a0bd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535575, "uuid": "b386377a-f87a-4325-a686-150c27b3a867", "comment": "Malware payload (XWorm)", "value": "a84728cf0a49fc5b8b14f55c86ca898ec03d042c959a6eb6199f1d94d9b0385a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535575, "uuid": "e094c9ad-dc7c-4096-9f65-2659c5f4a488", "comment": "Malware payload (XWorm)", "value": "274fdcec281489142ec69950cb56ae06da20c36c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535575, "uuid": "6cc1353f-3b4d-4d8b-8b06-a9e450ab13eb", "comment": "Malware payload (XWorm)", "value": "6892213e86a85f0de601d4d02602f9159a7e7e7fd3764cf61134ecba72ac7d6454b31a8c3a90e0f0c7b7c171ccb1ed1e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535575, "uuid": "3d2ac2e2-7902-4790-9600-9cdd02c753b5", "value": "T133372343C22D9B3B4E207B7610FA037D06A149468159F5F19A26ACCE173FB6D72AF532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535575, "uuid": "eeebf07f-88bf-4995-b5ee-953c8b06f3b7", "value": "49152:kTFOy7dQVU+vNcEB0kWOEVRBhcEB0kWZKCq7UmZJuiq+AbcEB0kW0cEB0kWlHU5s:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535575, "uuid": "8d6fcb6e-2665-4da8-95b7-623ec1afad80", "value": 23164065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535575, "uuid": "f989eabb-3423-4675-87a6-cc39eb7a001b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535575, "uuid": "dd1f049a-d0f0-4737-8caa-4953d548c8e5", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466d1bce-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514821, "uuid": "85ae0fc3-1938-42f6-88eb-6be50fbf60d8", "comment": "Malware payload (Mirai)", "value": "0298b4788fde52043b91c2a67483914d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514821, "uuid": "6c53bd07-af98-404f-80a0-5fa79f343abc", "comment": "Malware payload (Mirai)", "value": "a84df504ca9afde415974e0c8ffe0d89877448e8924cfba1ac4b2753f4b6501e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514821, "uuid": "00eb54a4-2e6a-4e19-aa2c-df594f1f53e1", "comment": "Malware payload (Mirai)", "value": "d915bcc827fa8f5b8b9e7269fc5fb81ef8285d2d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514821, "uuid": "5b1c79ec-3f7b-4843-a4ff-26a5c239cec4", "comment": "Malware payload (Mirai)", "value": "4290dd7fd09accb0c8565fc1055bc00dd0cd95a8907cef00a44a643c17a5b76e4b577056a162124fe2b957d033c735ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514821, "uuid": "4793b307-9e3a-4dbb-96fb-4cfec7dae33f", "value": "T1A8417ADE3304E735A3199D4DF7EDA2707B06E4D17AEE8B05E28408694DCFD0D5A90B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514821, "uuid": "cb2de9fb-3712-4dd9-b5b3-0eb51d898203", "value": "24:3J3PFUJcu5ieigEmEfE2E5MX0TwXUvAfMg:RFUJcu5ieigreveMXaAfMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514821, "uuid": "611b1dbf-62ec-4686-a0cf-4c9129650cd0", "value": 2134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514821, "uuid": "bfe2f958-4a09-42cd-b352-09dfa6f66a01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514821, "uuid": "98e1375c-7e7f-4e2e-b4d4-391e2dee3059", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8366d0-445a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777529036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529036, "uuid": "16946468-eaa4-46a9-bae3-c94a67dfd55a", "comment": "Malware payload (Mirai)", "value": "2c135e3d6ec2cbf9535b071f09b2576c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529036, "uuid": "62e1d5fd-ffdf-445f-9cec-322a8e7da269", "comment": "Malware payload (Mirai)", "value": "ab60ddea7281cd4fc39d94668a431f7e23159a4430f504c83be30ba27c511ff7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529036, "uuid": "567fb1a8-7c5b-4c43-98bf-9450804e4792", "comment": "Malware payload (Mirai)", "value": "bac66884058f4f82d3eb0496022fc30f1b0cbd10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777529036, "uuid": "50bd4ea7-73d1-4730-8d3b-e14913fb50b8", "comment": "Malware payload (Mirai)", "value": "c75c9f797d097f56fff26f88074c0ea1b9436da8af0810ac25f9a0ed0a1c16002412cda2d09c95cdb2c52fe35db65962", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777529036, "uuid": "cb1bcef5-3d40-420b-a0eb-f2c9466fe3bd", "value": "T11931158B60749065C584DE15B1F4EBC4D325B69963F4063AFCD10D6AB08AD54306FEFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777529036, "uuid": "82a4f3dc-d879-4c18-9d07-1643ee2d9c3b", "value": "48:3xdTPtTa8CTnQ14Ta2CTmnBT7rZTXtTu3ZTTyo7PTsvyCT5SCT22CT7b:n1+RIvgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777529036, "uuid": "24ace63e-3fe0-452b-b1cf-22cdba8ab12a", "value": 1831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777529036, "uuid": "ef0d1d2a-c6e2-4de1-94dc-5cd3e00fc9f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777529036, "uuid": "1dc94363-d0cd-4a71-9f11-8d489e18e738", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ca2c11-44d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777582081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582081, "uuid": "9f122359-cd51-4a3f-9d5e-04f89f4a3f4e", "comment": "Malware payload", "value": "41fa4b3d4c1f3faf48f75d0bf9980e03", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582081, "uuid": "b7c4c57d-f507-4685-a4db-ab2146a5814a", "comment": "Malware payload", "value": "accd625b83c81a6c31fe834596bde00801a264606c786002484422c7eb22dc5e", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582081, "uuid": "4600c20e-4375-4721-bbec-421bebbc8e0f", "comment": "Malware payload", "value": "975cdbde79caaf2af15555525101fefe2a53be73", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582081, "uuid": "afcf8bd6-b722-45e8-976d-3e8137119c1a", "comment": "Malware payload", "value": "e78e01fd1dd52030908f8cc0213d6d5a430f8e21cb364b270fbdb27c360449c50e3cac58518035d171ec54e0450d01ba", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582081, "uuid": "ed46622e-8da8-4aaf-9d02-217ee1fb8823", "value": "T183A29D25A2268E99D3480978383B94C6B6E5267EC163F475C36CE5B439D1CE2B1FF038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582081, "uuid": "9e5133c4-de4d-4f19-a61a-696fa4119b0e", "value": "384:xgZto4pGw58h9Oz5O3qnpxDXWImOgEZxzlA0UpL0hvmV8J8e/H5O:xgZu4X58h9M1npxDXWbcJ7vmV8J3/HQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777582081, "uuid": "1b81432f-2c2c-44ba-a2ab-026c2968b7a4", "value": 21891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777582081, "uuid": "261fb6f7-d899-4724-8bd8-497f8483ead7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582081, "uuid": "a06f5f30-6101-4912-9c8c-54e0157e6da6", "value": "ikozo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d1ef66-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538386, "uuid": "85ab677b-2ee2-4b14-b465-1c7c5139c42a", "comment": "Malware payload (XWorm)", "value": "5271824814a8a8d5deb1266014a07594", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538386, "uuid": "88703c2e-637c-4cd3-be16-6decbf1a21a6", "comment": "Malware payload (XWorm)", "value": "ae6ee87b3a48407970c2998427f3b6c3a4ee07926d301ae355f4a661471e857d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538386, "uuid": "d23a0600-82de-4311-94ba-8481da17cf8f", "comment": "Malware payload (XWorm)", "value": "1ca6e25137bc030b4778db7d085019a25d106984", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538386, "uuid": "ca7c8cba-ba5c-4b99-a7bf-f7e8512ad33d", "comment": "Malware payload (XWorm)", "value": "0cda26d5c32338a14c90ee3637fd8fbf05b9bf13c10ac0029648edb569c3d591603dc3b44cca08ee907ce80fb3023689", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538386, "uuid": "d5e13d52-989c-4fa7-a765-4321f81f2cbe", "value": "T1C34723339A267EACE30D93AA00DA0D0F83E5C5649265DF9D33D21A5F908FD4D205EE5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538386, "uuid": "4f0ab258-ef88-4773-900b-e1a16d52cba2", "value": "49152:xnbnnnzn4nwnCnAnGnhnanwnM5rnDndngncnm5enSnxnxn3ntnEnBnznqnDnLnSq:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538386, "uuid": "716344c2-f7b0-4a81-94f4-e5f33f776040", "value": 24724848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538386, "uuid": "77301343-d076-4223-b00c-45c52f3ee9ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538386, "uuid": "bfd3aad2-0d29-4606-a1e6-fdeb0fb41e96", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f5dbb3-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535622, "uuid": "97c4eb69-5288-44ab-bccd-38e7db7924b6", "comment": "Malware payload (XWorm)", "value": "7464fdbf91f67ef82ed2c604fdd96b3e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535622, "uuid": "01b339fb-c124-456c-8352-4d59d0f31752", "comment": "Malware payload (XWorm)", "value": "aee810302dd2cff1d643ead5d646323fabedb9b965d05ad32c00f9ccbe106c8a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535622, "uuid": "2c30614a-8d9a-47cc-84ab-6780930aeaff", "comment": "Malware payload (XWorm)", "value": "0706c69c6d4ef6b9f5b6514e17ff4ef6f23962f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535622, "uuid": "490ad7dd-08b2-4365-a857-d40924482a1c", "comment": "Malware payload (XWorm)", "value": "d3d37b1072f80513be7764b1770dfa64d6f6877410045ca92da8dcb9044c1cbe975c5817521c71904673f45fbf9e1a76", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535622, "uuid": "a523c88a-a179-4574-a48b-08b22bf4462b", "value": "T18027238A3DADEB0F849C33A1357E1E4DABCF86444D0C5F91A6E4B8EDD16EE50324A0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535622, "uuid": "c540157d-6edd-4a51-8237-931d1e6749b9", "value": "49152:M5/o5/+5/x5/F5/i5/y5/U5/P5/65/I5/M5/05/t5/1:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535622, "uuid": "88573ca5-1155-4e75-ac88-44f57892d954", "value": 22123560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535622, "uuid": "dbf4bfc6-54f0-49c5-8020-54178ad05aff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535622, "uuid": "cf89cb00-9aef-4659-89f7-b827db8c482a", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4973e431-44b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777566365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777566365, "uuid": "e936fab4-7d52-4410-9f1c-58b295d635ba", "comment": "Malware payload", "value": "c982147fee584a9844d2934ffb018ad4", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777566365, "uuid": "96dfb047-eb8a-4adc-a82a-930ac8ce8e36", "comment": "Malware payload", "value": "b10eda83bb2abe125675fe8a35d4b2ab5a97e7700587e9eac37024f3eb29eda7", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777566365, "uuid": "cd2e66b0-3bc3-4e51-93f9-dc8f6e4a8631", "comment": "Malware payload", "value": "92e68910da4311671e6534a6177bad41521b1181", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777566365, "uuid": "75921a90-cef9-4721-9ba8-7bab25f50661", "comment": "Malware payload", "value": "d945dd772c8c9e53141263f07da375dd4a0623c14195878171138941446213bff3d14c64caf79ad15b269b5b7bb421c0", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777566365, "uuid": "544984a9-9c87-4a9d-849a-52d05ff94483", "value": "T13F362840FAC7A5F5E903183054A7B27F57306D058B25EBCBEB207B2AF9776910937289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777566365, "uuid": "74452cf5-e588-494e-9935-81c89c3846b0", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777566365, "uuid": "73f27ac6-d4d1-4349-b959-11fb7725ad36", "value": "49152:iQ+1juXRxghIFu0C5qOFuYZCm8ch3CEYxVy324PKH1:o1juXRxg2N7E7RKH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777566365, "uuid": "b93e34fa-a28d-4dd8-a808-30d1c0179cfd", "value": 4994560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777566365, "uuid": "80fa4f26-32b9-49a4-a4a4-a72baecbd33e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777566365, "uuid": "58a6110a-6670-44e5-a65d-4c7b22fc40fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe36d13-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777531506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531506, "uuid": "276c331c-b4ac-4f34-856f-dd7a7d73192c", "comment": "Malware payload (Mirai)", "value": "305690b98caad7dba233bdb42cf7ec8c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531506, "uuid": "eee08636-1a16-4097-bc88-bb5533de6f4b", "comment": "Malware payload (Mirai)", "value": "b16ca521890ecc5471a9259d03381e598a2c2e3b9c30c3fea4b02f734f2e2c98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531506, "uuid": "901a3674-53f3-46f3-9e18-f159022a06fb", "comment": "Malware payload (Mirai)", "value": "45bd2f3b8584713cb45a49c5ab5fbe3917f1b341", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531506, "uuid": "87a822c9-8e4d-459a-8e20-a58a44553358", "comment": "Malware payload (Mirai)", "value": "f43424d26eecde5b862dbd323b652a484192524205903f7da3c285050b4ba82ee2cc93fc2e9e1cf12a86da22aeaaa609", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531506, "uuid": "bea89272-4780-424f-b31f-a162e472dbfc", "value": "T1B475AE47F2A760BEC126C13146ABCB625637F87A02116E3B6594E5342EB3FA45F06F13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531506, "uuid": "451bff97-8cbd-452a-8270-7ffbf9fb4e1c", "value": "24576:hsZi00dmTTVMGAtqPqsKfmUG67YtYAkF7eI1Jnm1gn/STUKQoxS:q000dATVMVAPqsKJGRtWFkgn/STFxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531506, "uuid": "cdbf51a1-a9ce-41c6-9338-f40ce1536dd2", "value": 1678272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531506, "uuid": "2b9c9c8e-8993-4ef6-b7c7-4ae266d63a8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531506, "uuid": "d2dc98e0-b330-44fa-8d44-04370dfa7eb9", "value": "agent-native", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b542316-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535552, "uuid": "bce3690e-0929-47fc-9d3c-e991b73d09fc", "comment": "Malware payload (XWorm)", "value": "b7e5014ca84147bd80c9622fa11e219b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535552, "uuid": "ad5a5384-056e-4f46-b622-6ad8d55d2b2d", "comment": "Malware payload (XWorm)", "value": "b1e18f00a6f04e3225908eb2958d978e3ed96a6f64b5ee07aea58f002f4c9e4d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535552, "uuid": "ed6d3b6d-2f91-422a-8026-6b3346169c1f", "comment": "Malware payload (XWorm)", "value": "7d57371885a989661f39e1b96580eec7c721f446", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535552, "uuid": "98033413-6527-48ff-9cd8-1d72e1dbee87", "comment": "Malware payload (XWorm)", "value": "37af602bc68e787290c33212ed01416bae3f57b2fc6de7d6fb98da9ab866d1db6ea452ddab471abba16dfce4feb2f72c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535552, "uuid": "8fbd7377-9101-46ba-b915-352248b29b53", "value": "T13437230C0E565B0D11BE34EEE8BD1B8F2F824744A9E95967F3E27C4A611932015C6FAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535552, "uuid": "9fe39589-295d-403a-af38-281a9837d5e8", "value": "49152:k8mcw8mcM8mcZ8mc68mcQ8mcu8mcs8mcQ8mcj8mcC8mcq8mcb8mc58mcB8mcw8mX:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535552, "uuid": "a50b1c6b-0822-4011-b7a3-3178bcfd198d", "value": 23424199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535552, "uuid": "a449958c-6883-48c5-bcbd-f5e3d75edc55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535552, "uuid": "e4fb528b-ce2d-4fb8-a848-9e9d83cb71fb", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812b1c8b-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535535, "uuid": "b4b24bc0-cc03-4083-9088-af2c3c7e06a0", "comment": "Malware payload (XWorm)", "value": "abd4a01c505eb01a7b463b69f7e3b593", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535535, "uuid": "ec54cdf5-4a5c-4c88-b471-c3e6a09c3ee4", "comment": "Malware payload (XWorm)", "value": "b49a46b198c8b19cc96cab2199e06c9c6636ee6faf1c5489f07810e2c2ac93c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535535, "uuid": "56271c9d-54cf-4097-8c96-943e564b71fa", "comment": "Malware payload (XWorm)", "value": "e1beacc536cc16572330273361ccf1e2d129c077", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535535, "uuid": "9faf49b3-14f5-4fba-a251-62dc09473013", "comment": "Malware payload (XWorm)", "value": "31371369b9d6bb9e5d2ed4a57fddfbd8ecb21b4109b95c10357dc26e620698f7534c557013221a9750cd929b723ea701", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535535, "uuid": "39e08146-3897-4b0c-8d04-20ab4812a8be", "value": "T1A1372347084A5C5A4678101865BB1B1E39DC8F2184BDF37B337AADEEE3AEF06661345C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535535, "uuid": "3643446b-62ff-4c5c-8a18-291014262e67", "value": "49152:cUNCYpDcBIKnBUKOR4UmLr+UKORdEjarRx9YlvNInYUKOR2UKORh1qTUKOR0S5XJ:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535535, "uuid": "d98a0bf5-a6d3-4780-8b5e-01d7502cf503", "value": 23944472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535535, "uuid": "0292cc23-ca1d-4c02-a97a-9a52c2b32743", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535535, "uuid": "ce66debc-d0c7-4871-9c7a-163cd3e9da9e", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4887081a-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535440, "uuid": "6da1a62e-50f3-4c5b-9328-23791ca55952", "comment": "Malware payload (XWorm)", "value": "556c616bc775b47b96792424e99e9372", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535440, "uuid": "82d2d6e5-901e-483f-9861-f6c272c4def2", "comment": "Malware payload (XWorm)", "value": "b4af6cd3e1840edc3cf93abfa2e11e59b8f6a6b7ac24b4ec7953fba8886741eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535440, "uuid": "d9015170-7948-49d5-ab62-7bd341600fbb", "comment": "Malware payload (XWorm)", "value": "e90248a281392aafe877ac13b90e91e2f4e1f361", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535440, "uuid": "071b250c-52cf-43c5-8c2b-c2368dbc2766", "comment": "Malware payload (XWorm)", "value": "6f1e753fc18e977af093be216fefc89e3ac71ad3eb2aebdf1db401747594dc320b06ff44e40002b6350cc8061bc1c1d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535440, "uuid": "aabe22ef-74e1-4fd9-8ba6-7bf318fe6958", "value": "T11A37237189FEAB530FF83E0D405F250C2BE9081504D67BA3B9DBBD8C270BA25676D598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535440, "uuid": "a9f88f94-34aa-498c-afac-462b7429b43d", "value": "49152:LdGYdGEdG1dGQdGgdGydGKdGYdGzdGkdGedGrCUR4dG5dGOdGkdG4dGZCURzdGBw:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535440, "uuid": "b746b79c-6400-43b2-b8d7-fde68e7a75cd", "value": 24464730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535440, "uuid": "9f824568-17ef-4caa-8e30-1ee7feda5107", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535440, "uuid": "cb57742e-0620-421d-8024-ca2721dded47", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887bce22-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535547, "uuid": "c823744a-5b26-4b1f-b6b6-eff0d4be5916", "comment": "Malware payload (XWorm)", "value": "b0005d47235937e414cf29e8225ef922", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535547, "uuid": "e36da7ad-8bbf-4233-9fb4-d24729cba9bc", "comment": "Malware payload (XWorm)", "value": "b4d24545a32e3e8b64bf556e794ba3b1753308b5c896417ee7faed359871677e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535547, "uuid": "6d902626-bc99-4edc-9875-99225ecfcb56", "comment": "Malware payload (XWorm)", "value": "5038ed1702d07d45ed99caa05e221d4ad306a51f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535547, "uuid": "9353b655-eac0-413a-b31d-94b5645b72df", "comment": "Malware payload (XWorm)", "value": "71c98dbc6d8d5d752633c04a57266f46c690f4eed59b05784223a96e97b535bf6b575c0e29434a46c53c7776c16b3be4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535547, "uuid": "f806cd67-58e8-45cd-b855-1e0089d5d107", "value": "T10D372301ED5F599EC9780590FDA7079A3E250E5223F10CF89A93747B22EEFA906247DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535547, "uuid": "d081be94-2072-409b-9143-adedf66005fe", "value": "49152:O9W9x9M9Q9/9Z9L9X9K9V9d9wpt9t9E9y9q9JpQ979X9n9G959I9J9v9a9P9t9Yv:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535547, "uuid": "dc262e91-005f-4268-955f-d2b11ebf28b3", "value": 23424190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535547, "uuid": "401aa963-3ae1-471e-b01b-82c5ae3f5dad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535547, "uuid": "49663d01-359f-4b70-b8e7-13812c692deb", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c584cb47-446c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777536938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536938, "uuid": "9fc2934c-6017-46ae-b75b-17ab4eae94fa", "comment": "Malware payload", "value": "bbe2abbacb82f3f4f9fa3abca4fae1ed", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536938, "uuid": "01d334f8-ad6b-4531-947c-abd11c0e2e19", "comment": "Malware payload", "value": "b5182954de28b18b0490d4b88d1159dd074db8655ef9066d9274d75b408f8a74", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536938, "uuid": "ce713942-d70f-4ef8-a28e-934e639bfc14", "comment": "Malware payload", "value": "a3ab8be7ee9cc5b2932707aa1ba35e4f139d7ba8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536938, "uuid": "a2a776a1-cc63-485c-9cf2-a57b5453fc8f", "comment": "Malware payload", "value": "27d7444330f1360673cd90bba14f73654844fc27b74f0b571bd3fbbd81a0350230bf92f363478d6baa6c560620599bf8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536938, "uuid": "356390d3-20fd-470a-b1eb-6c2bf9ff9cc1", "value": "T1EB25E036F94588CFC427C2B07A12DC500B4EAE56B758ABD2342E7B66B773E5DDA83041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536938, "uuid": "cf936c7b-d99b-4bd3-9163-51b2766c5b1f", "value": "24576:D9rVcBeAK3odli9rVcBeAK3odl2+hK09zv:DhVUn0hVUnQFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536938, "uuid": "fd3ae2d5-6127-4f18-888d-e6ab6d8e9b49", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536938, "uuid": "4bda9e34-8b20-4bb1-9b9c-b8acb8261982", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536938, "uuid": "6305dc8a-41d5-4884-b04f-7ab8393209eb", "value": "Order N\ufffd. ECMF060181 ME Eng. Constr.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e813db4b-4489-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777549452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549452, "uuid": "6ac695e5-7b0b-41d7-817b-35ee4fc3132a", "comment": "Malware payload (AgentTesla)", "value": "5567276f051c13bdae7af7fc44e63a63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549452, "uuid": "79124d2a-c653-4d8a-a0c2-727beb86c0a9", "comment": "Malware payload (AgentTesla)", "value": "b5369b3e51c2da6d2ff3bcdccf519e20c1188f3b136d3f430ee3d9b15a62a821", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549452, "uuid": "542f4167-7db7-4edb-af7f-7adf03372c0e", "comment": "Malware payload (AgentTesla)", "value": "260867e97e098af8abe96f52334c142967bb2105", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777549452, "uuid": "8127641c-f6d6-449d-a1c1-5fdea4c7a4d3", "comment": "Malware payload (AgentTesla)", "value": "e1c0d6a792f217c98ec3f333149e4ebe415df1861856ce5263513aae609b010dae7f6c920237d1a6252ba4bee28af1c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549452, "uuid": "6e852f81-db11-4bf0-9866-889b54d65aa0", "value": "T1C275F21282C43FA48BDB2B2990BEB55EE3A10A8E70655C4FE733FD467FB760151066B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549452, "uuid": "29e49f88-4287-4e78-b80f-72c7e5bab8a8", "value": "24576:X5AiKP9Vz9xV3KiymO4DZzMWvcV2uu3Rxyiu87sydLlpg7LT2:pA97Vh8/AHSy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777549452, "uuid": "a55e19bc-62d2-4fe2-939d-58bce7b53a6d", "value": 1566018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777549452, "uuid": "9841ecba-3aac-4dc9-9f25-2beda377f524", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777549452, "uuid": "108e151d-82e4-4b61-9d46-7ab01db5bc62", "value": "New Order 26OF-03091.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bad73c-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536888, "uuid": "fbc93726-860d-4ff3-aaff-cad7b38c3a98", "comment": "Malware payload (XWorm)", "value": "61026120b91837333c9ce7a45cb8938a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536888, "uuid": "04fab8c9-6709-4250-b5c5-7a7ea689f483", "comment": "Malware payload (XWorm)", "value": "b5acee61193db7f0feb7c289a064af7ec726fe520dbad0cdf32df1c798332437", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536888, "uuid": "0c30cb4d-2b2e-4529-9cae-841beb660722", "comment": "Malware payload (XWorm)", "value": "382357caea03daacf230408053b38648222364e8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536888, "uuid": "6c7c55d0-ab31-4d93-b3df-d1238f97bd4e", "comment": "Malware payload (XWorm)", "value": "a01ac1463db548a4ee0f83a457c0a753d0542aa51a0297bcc58e3adf8d02018a8d8361a8e0067d03904ee1dce0022d6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536888, "uuid": "a6d1f97a-f60c-4995-9d58-0f9eab736ecf", "value": "T13A37233B9FDEDE4D09221A98103F0AEE37E49F448A98D9DC4F5D7C8A8F86B0544A714D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536888, "uuid": "eb753d79-c4c4-41ec-bdc9-a632bf1b7034", "value": "49152:mdrfuQGnm1VshwANbA2RlV0wANbp4EoTXFzFMhraXLwANbHwANbt1CUwANbczBzJ:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536888, "uuid": "de2156e6-9ed3-4d9a-9e6f-f2741b08a3b0", "value": 23424207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536888, "uuid": "ff977975-8716-4534-9e41-c5bc99802f93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536888, "uuid": "f5892c46-12b0-45ba-a990-a9139ccc9770", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87542ac8-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538552, "uuid": "4976c185-8e96-428d-94cf-03aef58bd8ac", "comment": "Malware payload (XWorm)", "value": "31fc4abf419925302139941da747c584", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538552, "uuid": "9f5cb6dd-c212-426c-9eeb-382acf964d3f", "comment": "Malware payload (XWorm)", "value": "b5f513e45547283d3faaa3fbd1f4b870f9ba53e9ddcd24fd1322a3bfc7f653b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538552, "uuid": "a5a8a070-1733-4a07-8905-35505e4bf8cc", "comment": "Malware payload (XWorm)", "value": "2901ca045e9a81bf9c6b257e261be46c7db91696", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538552, "uuid": "5154019e-af63-4984-a176-e50c178065e8", "comment": "Malware payload (XWorm)", "value": "31bf702b0f05c12c0ac7bb24acf80e7ac8596b39151e4c2bbf679b20f6ca565c588b0db7ed6cb2bd9120f4f32bfe4a27", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538552, "uuid": "de32ec64-c1f3-415c-8cc5-bc8ef0347265", "value": "T16737231B4D1F7899D11D33AA3E7C790F15A81CF92804B6C76BF2187AE19DB41238B25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538552, "uuid": "0a346483-f7ad-44e2-944b-adfdd3012c61", "value": "24576:pjfas6Uejfas6Uojfas6UYjfas6UKjfas6Upjfas6Urjfas6UVjfas6UUjfas6US:NQaQeQZQ+QKQKQGQSQAQiQyQgQzQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538552, "uuid": "db709189-8923-424b-8e6e-9f2272d0256b", "value": 23164075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538552, "uuid": "d7f4c1a6-41f9-4a96-89c4-3cba090a7753", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538552, "uuid": "59acec0c-1125-4a43-ae80-5ffe111a5fb0", "value": "invoice-1645080830.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48e5648-4477-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777541607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777541607, "uuid": "7bcfff9b-d113-4878-9bd9-9521123fd4ff", "comment": "Malware payload (AgentTesla)", "value": "20772723e447ee41421875c5d65298a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777541607, "uuid": "9c3c829d-24a0-44b3-a451-ebf3302baabe", "comment": "Malware payload (AgentTesla)", "value": "b68bf218f8c5281b513ededd5f89e7a6391f9ab28a0020d0a1c9e754789dd4a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777541607, "uuid": "80a7f2e6-3ca3-4655-9eec-f7490c300483", "comment": "Malware payload (AgentTesla)", "value": "d1e4b38866ff07f1c9543d31eb2628445bb53b04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777541607, "uuid": "8b88f42c-1859-4364-b477-57e84fbbe2ba", "comment": "Malware payload (AgentTesla)", "value": "68fd2b1d7d98332f7e4f93d17c321ea24e45c4f3878b03d246286c7cc19671f9627a1ac248cc9bc80daefeb972b5b2fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777541607, "uuid": "114526f1-a564-4822-888d-b485ef62842a", "value": "T14FB42321B122D33BC8189F312C7559338D9D9FD8AC51AD3F939C6D1EE9AA381AC1F152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777541607, "uuid": "39a34f86-2d27-40f0-a1f6-606988c5cca6", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777541607, "uuid": "415c1200-0e89-47d0-a3f5-8cc3ded31092", "value": "12288:xbwtUCuxLMbnrsOW9CRoJE7TZdQ0cQJ6SRJ1I4X/Eny:xbwtUqTAxSFHQ0cWRJ1IkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777541607, "uuid": "4f0ca640-5930-44ec-8548-deb52e52d092", "value": 539620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777541607, "uuid": "b999dc68-874c-43ca-b9df-37ba199ea082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777541607, "uuid": "54157880-1e5e-416c-9f54-1608c8a1e3d2", "value": "cosco110093456798765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a4e5a0-4480-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777545315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777545315, "uuid": "02febbbe-0362-49b2-bef2-258d35ffe029", "comment": "Malware payload (AgentTesla)", "value": "ee84a646e0ce98281eedd6e5a60c6386", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777545315, "uuid": "95684162-e2d9-41a1-958c-702dde0f14a7", "comment": "Malware payload (AgentTesla)", "value": "b6f014a30776ee28e4c3aa64e40f0efe74ad29e2a3afd8b052e9bff5024cef9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777545315, "uuid": "ca6f76a7-78d8-43f2-a790-a8cd16972751", "comment": "Malware payload (AgentTesla)", "value": "7283f34b09ef2b617eb5524f3cab057277675ca9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777545315, "uuid": "93991144-7734-44ee-a562-d867446792ef", "comment": "Malware payload (AgentTesla)", "value": "d747d37b9666197f63d52dbb74004d8a2bcf2b8c7d92457e8fae9f042134bf4662526cef192d189936b2d4c062d3c196", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777545315, "uuid": "aa796abd-b5b1-4af1-ae2f-2c6497016ac0", "value": "T16A743AA0DA10017B4F43AB9CFCB50661C6ADD315852705B1FAC98B0DD10A9ECF7BE76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777545315, "uuid": "84316946-c7e4-42ae-a9cb-f46f893939cf", "value": "6144:shhBM+QoPCjrw1Ut/CJhU+HhvQiQr85zq8y1iRxCHXtLi7Q78AennnrZJd1Gsam6:ehBM+HPMCJDJEAhy1axCRoQ78dnVJdcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777545315, "uuid": "110ebcb3-46c0-46ee-a475-3dfd511e9bb4", "value": 367266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777545315, "uuid": "e77e1f55-86a6-46f4-b9a5-191a3cdbf806", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777545315, "uuid": "12d4b849-8fcf-42b8-93a7-fa17126e301c", "value": "20260430-77923.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ce6023-446f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777537900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537900, "uuid": "c989e4b9-7f97-4bef-90af-a451ff500465", "comment": "Malware payload (AgentTesla)", "value": "adcea385bf4bdf4b2b9e2e8eefbae542", "object_relation": "md5", "Tag": [ { "name": "185-29-10-77", "colour": "#4F0291", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537900, "uuid": "ed037264-1ac1-497e-bf85-6c1973262daf", "comment": "Malware payload (AgentTesla)", "value": "b76e2a42b82dbfaba9dcd26cb667f79ff081af97d772495107e4692528fb50f2", "object_relation": "sha256", "Tag": [ { "name": "185-29-10-77", "colour": "#4F0291", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537900, "uuid": "21547e14-0900-45e4-a76a-46523344dc8c", "comment": "Malware payload (AgentTesla)", "value": "ad35f9ce4deee0fb90117bdd92bfbcbe4301c188", "object_relation": "sha1", "Tag": [ { "name": "185-29-10-77", "colour": "#4F0291", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777537900, "uuid": "bb52a873-9447-4039-bb58-52f21c88e8ca", "comment": "Malware payload (AgentTesla)", "value": "2a008cfa255c0b2c0e52818f7ad828f350146d962891470863c0236ef67771cfd14b54a2e74e8acfdb1e24f9fc5e0ccb", "object_relation": "sha3-384", "Tag": [ { "name": "185-29-10-77", "colour": "#4F0291", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537900, "uuid": "7b8bf62a-10c2-4865-8bd1-a4408eb8e587", "value": "T105C42316FA409233DE6453B23E7B5C3BA84B6E5451198D5BA38C2A3FF4F69859D2F300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537900, "uuid": "8a90fbb0-86a4-4641-b1ef-916c0daa07fd", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537900, "uuid": "dad82816-7ab2-453f-9d49-ddf2bbad5cce", "value": "12288:xbwPZLlVOgCh6wozmj5qQoDdph7udQ0cQJ6SRJ1I4X/Eno:xbwPZp08wozcEDdzUQ0cWRJ1Ikf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777537900, "uuid": "b38df25d-83d4-4d23-9bcd-c7d274859f3c", "value": 560008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777537900, "uuid": "139180fa-ed65-4979-9144-9e4a69a58c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777537900, "uuid": "1faf4f7f-322b-4c1e-babd-7ab05ab9ff2b", "value": "PO-10045_2026-04-30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97888db-445e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777531012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531012, "uuid": "dea95c6a-8578-4d67-a98d-882140415f77", "comment": "Malware payload", "value": "c8b10b98ecfe1876e0ea3a2b39edad38", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531012, "uuid": "44d16e49-2833-4645-9861-0089dfb57753", "comment": "Malware payload", "value": "b91e2395f395a94bef98b7702076b8556cc0026cd18e7dd0823850f415d492e6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531012, "uuid": "8b5783ac-a83f-4e97-bcc7-1a9937f59d18", "comment": "Malware payload", "value": "051ca1ac09e6052ec0c1c66a18764cb22daa976f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531012, "uuid": "b365dabd-51d0-422b-90f3-34f92421c4c3", "comment": "Malware payload", "value": "9dfde3bcadb81d0cfa47bc6225de28ea24c00fca543b0bbb1fcfcf480284f93a8f9fc412cab8029f7d1c73e4973410b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531012, "uuid": "e36dd93b-0bd7-41ac-98b2-0c49ec21b913", "value": "T1F0E32A5797A9106AF1B7DAB9C9B20911EB727C550B74D2CF135048BA0F327D0BA3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531012, "uuid": "0d7d1e2f-1b11-4573-9dee-1751310336ee", "value": "fe1529edef766e6c0d25b8ae1722ece5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531012, "uuid": "124dac90-d182-41dc-a895-d19f7b419bfa", "value": "3072:vKNxLkcPV/fK1EDZV8wBmkwhmJTQSaMm5/6YZIU4c0y:vioM5fsGZ3BHpWljeA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531012, "uuid": "f297f2e7-e93d-45c6-bd2c-bf832fd6945d", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531012, "uuid": "03fabea3-e451-4ee3-b46b-5a5b7b5731f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531012, "uuid": "6dad32eb-012d-408f-9bde-1287902bf9b1", "value": "win_audio_svc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13c3d51-44d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581223, "uuid": "44482e4e-f685-4f74-8b0e-a9dec4244d5c", "comment": "Malware payload", "value": "e64709beb5942b58135137f7aaf2f7c5", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581223, "uuid": "6fb54c8c-ef94-4acb-8e63-3baa83070ae6", "comment": "Malware payload", "value": "b99f5312b7355b140544830714481c65f52ed6de9cb3c1d41f1162aaac3a7b09", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581223, "uuid": "474900e9-cf5d-41a3-a117-500c29f0c2a2", "comment": "Malware payload", "value": "36ef5a87dfa24c69fd1acb9e813938e33cac442e", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581223, "uuid": "5718c4d9-2ea8-480d-b41b-5f4203d2ba5f", "comment": "Malware payload", "value": "119c5e1e14ecdd87d233d286be120f6a38db15762798ae300441fc381ab406371a9e50d9043a430732a7c10b9437c9a0", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581223, "uuid": "9a45f4d2-a47f-4145-a682-ea7484807f0c", "value": "T119A28D2F2206356D1AE318678826097BCFB91936CECCBD88910C91569D85E0EF45EFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581223, "uuid": "a5a9128e-02c4-4f26-a439-7438d8400704", "value": "384:4le2SasmjlTlVjG27Uh+BJKJN5DbSAaT6PHEabmvQUk8URAA2/IW8AQCu0v5R:4le2SgVlVfxPKv5PSAtE0m1gThAQCPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581223, "uuid": "df6f3b52-154c-4387-9d48-2ad488151ea3", "value": 21763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581223, "uuid": "f7c14ca8-8380-45ec-bb69-a0dd4648f0d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581223, "uuid": "25d1af1b-17fa-4e21-84eb-e6ffde8006fc", "value": "ufuxe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c158d6d0-44b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777566137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777566137, "uuid": "e6e5ef8d-050b-4f60-bdd5-6ec4871a5ed0", "comment": "Malware payload (Vidar)", "value": "a7d6f1ae1a72802baf5427edcd78d2cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777566137, "uuid": "6278e81d-4cb0-4685-8a98-847252c86699", "comment": "Malware payload (Vidar)", "value": "ba4c04d63985db25bc7bb16b187f009ea58f4a71b8559a28f2f95ff86fb56673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777566137, "uuid": "6e06aca9-d148-4cb4-9810-d9354b9809f9", "comment": "Malware payload (Vidar)", "value": "23a75ff7b4d3a9c44a4133f0fa78470502788649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777566137, "uuid": "f82bf9c7-fb19-4794-82c8-a9b66bdf4d8d", "comment": "Malware payload (Vidar)", "value": "27ad2c8e6ded692171d38bb2189ae3d766055da9f92806a26caf206b5d4e55afea83d97c301b61954327c5b59a8b2f5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777566137, "uuid": "a4e42801-23c5-43f8-8783-e0d96569510a", "value": "T19F365AA0A94414E4EEF8713484BE7B657BA97C295BB213D71BB02C353E3A3C15CB8725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777566137, "uuid": "185ccb36-c7d6-4c4f-bc39-d97af21edef1", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777566137, "uuid": "474f1218-f0e6-406a-9e5e-047df8b9a1a9", "value": "49152:2LgmMF8KpqhCKusOTR2L8RUWm9MU9SnSQIiRcSH3JJ4U:2LRQBq5qMVAzIiRl4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777566137, "uuid": "9dd20394-3e46-4be1-aa9a-3a151b408592", "value": 5143760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777566137, "uuid": "1fd83cfd-0c2b-4dfd-898f-3c3ef64fd4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777566137, "uuid": "d9748d74-6919-45fe-8882-c5d8c0c3382d", "value": "Silent_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbda7065-44a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777563175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777563175, "uuid": "b94fb6bf-23e5-4074-9966-0dbe4843da02", "comment": "Malware payload", "value": "1d5a2e832afd42e78b8f8f16f7d8976b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777563175, "uuid": "4f06871e-9e5f-4e39-b353-1686fc5ab5ec", "comment": "Malware payload", "value": "bc0fd3a2d2acad2e16d6f06f077cada25fa6cd3d65ffe256011c65fac73d53c4", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777563175, "uuid": "82851a06-86df-47ff-8538-410f7992dec8", "comment": "Malware payload", "value": "e6ba2941b0319527d65b92461d71a149e010ff78", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777563175, "uuid": "e71ef280-a660-4a6c-a386-b14196df42d1", "comment": "Malware payload", "value": "d5abdbd4e5fac866d9f945b7fd24ff5aea5e69de8bf4d528d600479ba67a52399fec5fd4e8aaf9d76f658a0cf8313052", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777563175, "uuid": "0e063206-35bf-433f-a5e2-929b8f817543", "value": "T1FE8501DC13B51E12C21E3BB4D8A26F6C773D67C15F2387AB51728BA85F00AE975221D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777563175, "uuid": "12f2162f-d22f-4cbe-83bd-cda8cf9ac028", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777563175, "uuid": "e9dd5592-53e5-4462-b84d-fd69b0df2a6e", "value": "49152:Bj7ARv6QGOYlDNfpomGbHkFqJUeHBz3eYfSwhk0ppm4:F+v6GYlDFGQ0UehaSpm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777563175, "uuid": "6ef7cc27-3edd-40aa-a7f5-eb4b2607cc96", "value": 1812560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777563175, "uuid": "c711390f-3c4b-4f71-8283-1c542317bf81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777563175, "uuid": "9c3fc377-c0bd-4a8d-a991-a7a839b76ee2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcc1009-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535586, "uuid": "0c4c0aaf-b329-4de9-94c9-7f92d4692bf7", "comment": "Malware payload (XWorm)", "value": "1a22e5cf0ca5b8f21688f0ee3613af37", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535586, "uuid": "877b32af-c3da-43ff-b0c9-757c7fdcdf79", "comment": "Malware payload (XWorm)", "value": "bc166e72ed5fd5d2e4de65f25e8bd084541135b2fcc78a81762dd99a8f9b3fbe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535586, "uuid": "fd325ce3-da0b-4c5a-8bda-004231d747f6", "comment": "Malware payload (XWorm)", "value": "49aacbc34c15d7e5871d130a07df108526cdefce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535586, "uuid": "97ca657e-a146-4691-a612-f5f2daa66f48", "comment": "Malware payload (XWorm)", "value": "3626c75fa09b11bc0eca04830d4b8de53d36385803d8d7cfdc5cd97c0d1fc9601ab07298243fafba1fddef4dcb06326e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535586, "uuid": "c7d82334-71b5-42e2-9980-6cac6775aaaa", "value": "T15B37230AEF29CE3F855B93BD3C5F0C074CEA5A660440F549BBE51DCE9AAEF441663908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535586, "uuid": "c86b7c55-a59a-4e22-8a70-f9cdac93e20c", "value": "49152:nvWovWzvWXvWFvWKvWYvWwvWhvWdvWavWnvWf+/WvWWvWGvWzvWrvWE+/JvW+vWW:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535586, "uuid": "00b8c145-9263-496a-b71a-7f740196d808", "value": 23424200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535586, "uuid": "018e3ab2-832f-4d75-9011-58ff877d256e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535586, "uuid": "7de7b1c0-a3c0-4d41-8245-7d202cf6a814", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8ad0a9-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536898, "uuid": "5dfae894-c3c5-4c5a-8c24-db25ca140926", "comment": "Malware payload (XWorm)", "value": "f9a1fb794f0dab4be11bfc1dc1071261", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536898, "uuid": "211075d0-2203-4ac5-b466-8dfcb0adc386", "comment": "Malware payload (XWorm)", "value": "bca9e638957f2666ff6331d4d3e5defeb37017ff65a32a94ce597abe05867075", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536898, "uuid": "f5be37bd-e2d6-4639-a08a-8d8881acd9b5", "comment": "Malware payload (XWorm)", "value": "c7bfc7563de9e9b6d016c96921095feefbc479fc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536898, "uuid": "618e8e4b-1e34-40e1-81fb-3c3f96c3edbe", "comment": "Malware payload (XWorm)", "value": "0ff5f13d4e4fbb46a18afb380b3b437ba4a47646489036e16431c3b7c36ccba22ff66fd27423f73467bfe19b09e45ef0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536898, "uuid": "f7aa6121-b19f-4c80-908c-24652f17d8d4", "value": "T14B372318466FCEA3939C37185CA70B0D17E24E6269DAEFE169DD3CEAF71D014A50728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536898, "uuid": "1704c2bd-56c2-409b-82fd-f23d98a52823", "value": "49152:i1dg1dT1dA1dg1db1dt1dm1di1de1dk1d81dPv1fkE1dh1d41de1dm1dHv1fkt1l:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536898, "uuid": "9cb30b03-d808-45f0-a4ac-1e81fd4dd7f6", "value": 23944478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536898, "uuid": "3faef526-836e-40c8-8260-ffdb3794575a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536898, "uuid": "3dad5000-9e6a-4ec0-97c2-d6ca919a7ff0", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dedc540-4440-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777517786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777517786, "uuid": "5e777e5c-6607-4120-bc0f-db7ef29ed9d0", "comment": "Malware payload (AgentTesla)", "value": "1fdafb2c487afb4d3ab5e51d50b66fbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777517786, "uuid": "3ecd05c5-0d8a-457e-b201-ea654cf1ff93", "comment": "Malware payload (AgentTesla)", "value": "bd819115bc8e6f34335958a8f708a509d9cd31e84423fdb8cba7f34bad5e00c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777517786, "uuid": "c6148889-09c8-4774-a426-88c5a3f60f8c", "comment": "Malware payload (AgentTesla)", "value": "a31dcb15798fe78fe62cab8bb3d4faa155db6756", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777517786, "uuid": "920ac01f-3b3b-41b7-85de-3fc375be1668", "comment": "Malware payload (AgentTesla)", "value": "f1ee6b1b275b24825773bb66b8f3ece19964deca6013c00ebedbac673ab0eca159bb43570ea3c65a2eb6022424588dd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777517786, "uuid": "e581e429-8d21-4b4b-b009-fa3518a1ed35", "value": "T13665BE65B3C876DDE517C939CB51A632D2B278120BB2B1CB1A9A13151FB7FD16B3A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777517786, "uuid": "0ec3f96a-e1bf-4f95-a2b7-cf2980b0d4f7", "value": "247373c33f99aa03dd7020ee4bed1e45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777517786, "uuid": "ae0b8c64-15dc-4f84-9873-dc4569831152", "value": "24576:KbSwxvpROMRo3bnfbz1ghgBslu7F3OdD4/lYY2RVWsl66MwDQ1ocpt:MxvpNRo3UDlu7pOJkYhRMswnwDQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777517786, "uuid": "bb0c0d85-319e-448a-a3f4-fff35243cd90", "value": 1444864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777517786, "uuid": "5fc84224-457c-45e4-98eb-f23a02239dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777517786, "uuid": "a9e877d2-46d9-4d9d-859b-9cd9e602fd7a", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc7d04f-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536875, "uuid": "ab1fc34e-02a4-40e3-9a4d-de284f855b51", "comment": "Malware payload (XWorm)", "value": "9da8b3544e64d2571fce787b763de70e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536875, "uuid": "8ed66d6e-8f15-4c53-8c85-538e858b783c", "comment": "Malware payload (XWorm)", "value": "be32cd6f474b64116c78fc6378e66115867356e6d294b1673e55ebbe7528f88e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536875, "uuid": "29ae3985-0275-4e2d-bb2a-84a362a84946", "comment": "Malware payload (XWorm)", "value": "fb2e32fc00a8c66b78cb5b5aa9fb634f0179638d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536875, "uuid": "94ec7827-702e-495d-b003-1801ef0277d7", "comment": "Malware payload (XWorm)", "value": "a71f45757dcedcb7285f3cd0701178a6c78e285777b9ad37701330bf5ba66c037e1660c89453c534bcbb10bcc83dc44b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536875, "uuid": "e2a0c147-d44c-4fae-b4fa-570e2d94eed7", "value": "T142372399489ADA7F876C726C203F19EF27BA064D1014FD85A3C3ED8DE385E2446D34AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536875, "uuid": "d6123746-5df0-49e2-a916-55e079e4b7d3", "value": "49152:DkJkOkdkFkukUkBkbk/krkBk/Kk+kOkNkRkjjk/kYkMk4kDkCkMkjkWkVkNkhkU7:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536875, "uuid": "091e0bfc-ee8b-4555-8b72-e34c32c52fab", "value": 22383683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536875, "uuid": "f85db920-9c94-4be4-8317-85297ac4cd61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536875, "uuid": "5b4ae37a-5be3-4455-a17a-590fcf91a336", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf7bd77-445d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777530535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530535, "uuid": "cca4b1c6-5dd0-4c21-95a5-ac8d41df04d2", "comment": "Malware payload", "value": "a311b24f469d80bd1ebd6bd71de5e8f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530535, "uuid": "4fcd5933-cf23-4ac3-85ef-30f5e4a1e182", "comment": "Malware payload", "value": "be5c5bdf815f89ec6c6c1adc4c90a4176d6364a9372d1d1310846022d67f1d43", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530535, "uuid": "132932d0-9ddd-4df1-9b0e-0f22a672701e", "comment": "Malware payload", "value": "76cdf6cbff9e53fe4cde8ac138bc1b747cd96d11", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530535, "uuid": "67665e29-4229-4c11-b802-a1a1adbf1999", "comment": "Malware payload", "value": "2d420bf80b225d489917649701b5d6fe8d8cb280ac53ac0ef1e1de54f7ea87b681ccd88d1bf8e92ad6718325a0006f24", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530535, "uuid": "e9d6461b-74ef-4964-a4da-daaf58d87642", "value": "T19D641B243AFA501DB1B3AF55AFF475A6DA2FFB732A06945D1050034E0A23E41DDE273A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530535, "uuid": "dd6caf7f-4afd-468c-a295-b76ae3c2abce", "value": "6144:czVvCdFTYBJiXJa89w9lJ5Xdh3yqC2WPXLgOMrhMre/hkwhCTapP:csdZYBJiXQUw9lJ5dMqbWvLgOM9Mre/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777530535, "uuid": "6daaf33a-0f72-45f1-9676-ad6e0054b622", "value": 318898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777530535, "uuid": "571b14ed-9a8d-48f0-8fad-f60209e3ca55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530535, "uuid": "402f10c5-701c-4b82-ab40-895216098b7d", "value": "P-INV-E40076409.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9bc206-445d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777530454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530454, "uuid": "116ee7b3-530e-408f-915a-82f19531ed8c", "comment": "Malware payload", "value": "95afe906c7dded22210bd749863117cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530454, "uuid": "de80c3fd-2fab-44db-9f43-d9f263e29081", "comment": "Malware payload", "value": "be919c10f1ce4667e7e92ed2defb201911bed0940e71b41757ec176d5faac5d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530454, "uuid": "b21cfc48-dadc-406f-afc5-8d167aa798c2", "comment": "Malware payload", "value": "6492de1df5ee291ddba3b677d9daebcd56810368", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530454, "uuid": "5e1c47af-bdd3-48ee-9c86-58d110455f46", "comment": "Malware payload", "value": "2fb8f247dbc7b50f0b65ad3bbb0762f0c5e38f4cb6ff2aa77d5f84cc5a90f7b2c5b05557bb1e489f6b9f7f297cd5f71a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530454, "uuid": "d996d8e4-722b-487f-b21f-3f63399988b1", "value": "T1ED136D6526953C25AE99883B5C7F2F0CBDA983E1304491DDBFCA3CF18C55A9CE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530454, "uuid": "2719b5de-3aa2-4660-9da9-da6046ccd14c", "value": "768:b6s9NyXsZztCE9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b/HusZAcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777530454, "uuid": "5d8ab1eb-6536-43c8-ac3b-07646bbb41b5", "value": 45445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777530454, "uuid": "69f61481-6c06-49c6-a122-2ee79aafa6bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530454, "uuid": "909b2a5f-c0e5-4874-bb58-9d9b24cc0fc5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbde8f7-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535368, "uuid": "afc742ee-a9bd-45f8-b0e5-ea97dd52b731", "comment": "Malware payload (XWorm)", "value": "ff08846a41f92816a8365903356ac540", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535368, "uuid": "42f879e2-d0f9-4306-b548-5edbd0a1941c", "comment": "Malware payload (XWorm)", "value": "bee57ae62ea47cf56e0a1644d4d5c3b76d6ea2112a67eac890899037f536ea7f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535368, "uuid": "72e358a0-63f1-4279-a0a0-b49a12d5c0db", "comment": "Malware payload (XWorm)", "value": "1b016197bdb318a290ddf69ed638895fd3ed5b8a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535368, "uuid": "62d3fd3c-ff30-464a-9646-d9ed66da17b0", "comment": "Malware payload (XWorm)", "value": "19481d20283517235a2c7274abab4a16d7de2bf99207905d6fccb04e2284bc6a46ab3a4da71c1ff4d639f23a221b3d14", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535368, "uuid": "d08cf12d-8c7d-4c94-984f-b3eedde4e933", "value": "T1FD37230DAD9A89AF83F0930C645C1B8D66F55E04925471CFDFCA784BDD9AFA23B16023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535368, "uuid": "ec9e19db-8e29-4eea-b4a7-d5a2e1cc9ae3", "value": "49152:BS0NhS0NTS0NPS0N+S0N+S0NAS0NhS0NwS0NtS0NfS0NiS0Nq5KS0NGS0NyS0NXW:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535368, "uuid": "56c8ff7e-878b-43d4-af8d-ba2247cbb207", "value": 23424204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535368, "uuid": "19ab280f-2c46-4477-80ea-02663af9502d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535368, "uuid": "13587fde-d8de-45d7-84e5-00f9a203935e", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c4bb86-44e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777586458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777586458, "uuid": "7b6aa371-895d-4634-9d6f-39c2642dcffa", "comment": "Malware payload", "value": "eae4a9d1ddd01387f1139bce8ebd26db", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777586458, "uuid": "222a27ab-2398-4b39-b786-eca116470730", "comment": "Malware payload", "value": "bee8b62453ff94b7398267687b977261d5e6b2651e218c513c8b5593b3206538", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777586458, "uuid": "abf689be-4b15-4a2e-bbe9-a9d0e72f1e6d", "comment": "Malware payload", "value": "433564d494659e03ee90f3e931a35df7189f900b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777586458, "uuid": "a646cbd4-4b03-4ec6-a5da-ba6dfda69294", "comment": "Malware payload", "value": "2f2b3330205c38ef2f062c8dd6bc383ae78c83952628d4a3b405c6ea01ef074c33a588b68bf9ce49561b05a2503c8ccf", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777586458, "uuid": "9faba020-c580-4712-942a-3dfb3e1785db", "value": "T1F8E58E466C9104F8C15BB33488E6B3407B7AB8290B3523DF2A91B5B53E377D19E35B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777586458, "uuid": "9445465c-53cd-4a3f-b313-4a9dcad36f6a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777586458, "uuid": "5842e52b-1165-44f4-a63d-4b238ba70201", "value": "49152:HTT0xFyvNWW0eTTJPV7dcF5Z+LdxBZ8Awf68l7dpPOxwWM/aQ:HkO0ReTTJTSupZ8Tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777586458, "uuid": "5632fdad-e9f1-46cb-9ab3-5b1e2f5c0bb6", "value": 3232416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777586458, "uuid": "97db84a8-971c-4e84-87c4-0bcb23d574a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777586458, "uuid": "9648ef87-fe21-4277-a307-12e9a9c08f6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f229b796-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535295, "uuid": "7b9efad4-89e6-4243-9869-d82208ca1db3", "comment": "Malware payload (XWorm)", "value": "42717ada940ce5a7eeabcc251c9d4d45", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535295, "uuid": "1e9ef048-81ad-4f5d-a477-2d936dc0cebe", "comment": "Malware payload (XWorm)", "value": "befcd127c9ea2f0ebc27491bb42c7b29d461a5426230587664e4775dcfb7e5a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535295, "uuid": "7894405e-2a6a-4edf-a48e-0ec45d9938a1", "comment": "Malware payload (XWorm)", "value": "8795b7f5cc6ead339179ca81479b83e65020d69d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535295, "uuid": "197adfd1-d204-4ac6-aafe-c8245f546693", "comment": "Malware payload (XWorm)", "value": "a2e783bdfc7c87700ddca05efab3e0292c6a5d84169dff76a8f5156446963d15360df3daedfb3f989575cf358e23fe52", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535295, "uuid": "6c5d535b-1b05-4357-b0a4-881ad61570f4", "value": "T14037234FDD7D2ADB9AEE5AE85CBA010B38F217B924C6D5C553D4F86FC809E1426081CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535295, "uuid": "65cde092-1a68-41fd-9192-7b7b08f16d8e", "value": "49152:DedQ2ajedQ2amedQ2amedQ2a3edQ2axedQ2a/edQ2amedQ2ahedQ2a8edQ2aUedr:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535295, "uuid": "375e54ba-2962-47c6-814b-14959a87db17", "value": 23164062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535295, "uuid": "182ec0a0-5f3a-4937-abce-1364792f6a51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535295, "uuid": "c638c0bb-0344-439a-8ba5-f3607e7edeaf", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7770ab-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535559, "uuid": "74a363a2-c43f-47ca-8005-88ed808e3eb8", "comment": "Malware payload (XWorm)", "value": "5779459fd72a10c52b5acd38a39ae041", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535559, "uuid": "be905a44-c08b-47de-ae8a-b61b6cbaa7d6", "comment": "Malware payload (XWorm)", "value": "bf7c717fb64e87e981cae80747035ef5361bfc3dc42b4c3c0637b78f2db75b67", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535559, "uuid": "7cc0fb52-a386-446a-8c43-4fddf538aafe", "comment": "Malware payload (XWorm)", "value": "5e33bdfe4259cc27e88e9624987e5600784ed136", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535559, "uuid": "ceb42043-a591-4ce6-9e46-ad54cbac8e65", "comment": "Malware payload (XWorm)", "value": "6aa2ed65d0eae9508d66cea956eb4c200a1955118c94529b3324d0ab1544473d95c71c5d9c6b8e3c7c972613839d22cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535559, "uuid": "8a2c4cd8-bec3-43d8-a553-fd7a9b834d65", "value": "T18337121346DF4E2D4F7C112A26BD0C4EEFA98F840058FDA6D7DD19D8CA9E71C661E822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535559, "uuid": "dcf01de5-4e1c-4060-b823-2c93cbf36a36", "value": "49152:TDYjDY4DY0DYxDYvDYBDY2DYuDYSDYUDYYDYP2QoBQFDYTDYwDYoDYYDY/2QoBQi:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535559, "uuid": "0c6bb03a-41be-44f7-a0b1-9d5254d31256", "value": 23424210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535559, "uuid": "af47c1fb-907a-4185-9874-7e6311930765", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535559, "uuid": "becf004d-24bd-472d-9d2d-715f19a602bb", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3b2a79-4432-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777512117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777512117, "uuid": "1d0ad27b-da95-4ae3-b86e-686ec82b0376", "comment": "Malware payload", "value": "893638e3a4a3d75ee0604b2b1ba19999", "object_relation": "md5", "Tag": [ { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "MiningDropper", "colour": "#2E2CCE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777512117, "uuid": "5dc74981-a85b-42ac-a2f9-fb06373a5707", "comment": "Malware payload", "value": "c038fb9ee8a4cb9cc1c7cb4b5383135380ac02ba040c00e97c100f697513d100", "object_relation": "sha256", "Tag": [ { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "MiningDropper", "colour": "#2E2CCE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777512117, "uuid": "59a32d26-ec70-45ec-8b21-e1bddbd59563", "comment": "Malware payload", "value": "c33284416e4a566b4167ea4dcb92f4a4fdf6edc6", "object_relation": "sha1", "Tag": [ { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "MiningDropper", "colour": "#2E2CCE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777512117, "uuid": "6d962e2e-1459-4a36-83e9-84b46673cbb9", "comment": "Malware payload", "value": "a3d56929bd248cca5faf373b035f8521b3e1f5effa03daac8aeae9c0cfdee9fd657d13b26287212a85440832304e9a67", "object_relation": "sha3-384", "Tag": [ { "name": "BeatBanker", "colour": "#D030EC", "exportable": true, "hide_tag": false }, { "name": "MiningDropper", "colour": "#2E2CCE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777512117, "uuid": "0af81b0d-d6f5-46f2-b8b6-f67fdb0eacdb", "value": "T154B62306F21DAC32DCF76238BD754B4724262CA45722C16B1961B23D9DFBFC0DA5A7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777512117, "uuid": "aaed2f02-a8fe-4c05-8051-abb6b41b191e", "value": "196608:Wyi5z8XFOSuC2I9xMnXU2jINv2jK2Psm3tnVT2exjZUfluoazuJ:WyimAM9x0kSINv2jK2EynVrdGfa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777512117, "uuid": "e1fed65d-386d-4bbf-b467-88b9c801da85", "value": 10467430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777512117, "uuid": "2b9b7135-de1e-40a6-a70c-ef2b74360b74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777512117, "uuid": "5054fbbe-d797-420b-9af9-ffb086930f95", "value": "c038fb9ee8a4cb9cc1c7cb4b5383135380ac02ba040c00e97c100f697513d100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2ce97e-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514909, "uuid": "cd745a4e-34dd-4940-8007-c11fe49f5ab4", "comment": "Malware payload (Mirai)", "value": "fb7bf016691426180307a6b528db9f58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514909, "uuid": "a6c6755b-290c-47b0-9e90-9f5f6e089c16", "comment": "Malware payload (Mirai)", "value": "c100177c2929e8a6f91846da6836adff1755811a7d13fc64c758209a1ca4dd0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514909, "uuid": "08cf45de-f4d6-434c-8137-417eb7a24173", "comment": "Malware payload (Mirai)", "value": "aadf7b5b51e682ef63a9af34411cade00f57a958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514909, "uuid": "cbc00948-baaa-43d9-aa31-b1ed84cc4a9e", "comment": "Malware payload (Mirai)", "value": "8f854db98c8fa958d2e88c8cf45e7f9fc9324bd0f5ff642936d0028aeee5998ff158657b82c56b3b8c6c53f44421e50d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514909, "uuid": "4fb6dc55-77b3-4016-9192-b423a8c660d8", "value": "T1F6144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514909, "uuid": "cc786e24-72e7-4828-b2a7-6af04cb9e6a5", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstkVUat:o5H5BT48rYq1wjY21Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514909, "uuid": "3d227b43-9703-423e-95a9-a8b7e3587e2c", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514909, "uuid": "8b13f11e-f84e-4981-a734-dac0365bd0ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514909, "uuid": "eff27577-2130-4fc7-8bd8-655cd15972dd", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da15c08-448d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777550910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550910, "uuid": "b7a2a3c8-b583-4216-8142-9093c4718baa", "comment": "Malware payload", "value": "e8a4ecf6feaf82c656490be018e88b07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550910, "uuid": "5f891c48-14e6-4d83-905b-bd375ee8ccc4", "comment": "Malware payload", "value": "c118a596f4ce569ab1a56c4eda818cb76fc2bc03a38bd263e01d6cef4f22e225", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550910, "uuid": "a1382158-7197-4640-b332-5f9c4607df5c", "comment": "Malware payload", "value": "065816d5fbe056f16e7818b792bba0701fea6cce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550910, "uuid": "de4e713c-a2fd-4350-b42b-76d01b5f045a", "comment": "Malware payload", "value": "8aab6a043fad2c8ad8de19d5e2793de16642feab965416c5a6362721d84966fa6089c463d117d35c99609aebb80fc45c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550910, "uuid": "581c0b57-2b40-41b4-8478-3ec6b58272af", "value": "T1F1256B233B21CF65E355C63009F3CA655AE621A20BE25089B27CC3287E6165D6D5FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550910, "uuid": "14f80975-a047-4ca0-895e-6535e4b88daf", "value": "24576:K4rTQsN0o+/QylBumbekbT9B2wyWSeW71NZs2a/ROrXr:K4rQ/1lBuQbTawyWE7LZFa/RS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550910, "uuid": "fa8ab0f3-4834-496f-ae5f-9dfd3477a4f7", "value": 975160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550910, "uuid": "ae9ba5cd-79f6-480a-b538-7325cdece262", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550910, "uuid": "7b66d5f0-5a2e-4e47-a357-49fdfffed90e", "value": "x.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfe9abb-445d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777530347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530347, "uuid": "5f8b2d16-412b-4b5e-a2d3-6f9683dcf0cd", "comment": "Malware payload (RemcosRAT)", "value": "7492ad4296dee75b726b5f263911eddb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530347, "uuid": "30a93e88-4683-4e14-a8f4-45beec6eb428", "comment": "Malware payload (RemcosRAT)", "value": "c17774ba0a24b0dc4ada2e23f345d820dbb1b13bcb25913ce0fe788d4f27499c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530347, "uuid": "e20e494f-e4c6-4f30-8ee0-e5ee59c9f8d9", "comment": "Malware payload (RemcosRAT)", "value": "e64ad8eaa6f1c1b0fd968686b67829941ef6776d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530347, "uuid": "9ab5cf2f-b755-45cf-95b3-305752ef473c", "comment": "Malware payload (RemcosRAT)", "value": "ee78b8d1357c07ecedd41bd287b5a4bc596391f5d698aa636f9f04feb5ff381e0264f580d767c3592b5ced52f04278bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530347, "uuid": "3a2cd560-cf0a-46d9-ab3f-7736c2a75fd3", "value": "T104167B4810A27B9BD4FCDB504F3E9BD81D9D858FF864C8833125D6B88B09FE52686277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530347, "uuid": "15002644-6a09-4893-8d12-decd447b5654", "value": "98304:gEBJEQCdqLPoL6AtvuW4H/9jhq/GfcTooitMEXKcILCmj1Mr7+n0yzktxoydCBz6:Djbxol1uW4flhaGfUitMwK3LCfrSgxf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777530347, "uuid": "26a35050-3516-4181-9e46-8e8f0d8b9c79", "value": 4097129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777530347, "uuid": "831c42a6-1936-463a-90e8-0ad64a3ffd2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530347, "uuid": "7efafcfa-1d4b-4127-bde8-e99eb8515927", "value": "RFQ Specs.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee69663-44d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777582105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582105, "uuid": "5a797f34-58b4-40bd-9da3-a15c45266ecb", "comment": "Malware payload", "value": "08f2bb8e7e3be1fca497995b13f83067", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582105, "uuid": "36627b14-f48b-4ba9-a2a8-2d0b48737fce", "comment": "Malware payload", "value": "c1edd92ceaf5cd6383e953344c8fad95233298b5e60244765f9c15582a94f05c", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582105, "uuid": "83538e60-4063-402f-9b5c-e80c3404725a", "comment": "Malware payload", "value": "c0ed0ed67b869e1c15789d748bc22f4b05b03ce3", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582105, "uuid": "1422ab70-7e71-4501-969e-ad2589e29641", "comment": "Malware payload", "value": "fdd850509fd1e2612ad266fa6a4ecc328a534bc9e1fa6db99790a4883cad5f64051792f19023d20e8d33542cae028112", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582105, "uuid": "7c1872e2-fc6a-4887-a490-b9e9b581259e", "value": "T14103AF203607A3BE6BDEEB71D0AB04695DA434435CC1658DD2ED284728CED48E5F9ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582105, "uuid": "8aa1cea5-e238-438d-bad4-9776f7d67b2b", "value": "768:OWyWsurvxX2Bw47wd49GI7M1gSIMQZEv/R4YhaOLAKNg8tQvABLLV9Mf4:OjuTxmBp9QI4KVE32Ya4ZNgOFLc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777582105, "uuid": "52596b91-1df1-49a0-8ffc-b5039ebc1f9f", "value": 40679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777582105, "uuid": "6dc562f7-6fae-466b-810b-fe9cfd7d51b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582105, "uuid": "9d0bf0b2-b9dd-4c3f-9240-386f1dcf9af8", "value": "izayi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b1608a-4466-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777534314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777534314, "uuid": "d458f20c-9cf5-44d8-abcf-c3876b55b855", "comment": "Malware payload", "value": "75abfa32d01e9f7450ec5ab0e845fd61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777534314, "uuid": "7599bb87-59bf-4dd3-b6c5-222b25502230", "comment": "Malware payload", "value": "c22b6015f506f9c35965cd848dde34f1b6c51046aa54845626146bb7404bb736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777534314, "uuid": "aa0ad121-ebb1-4265-b347-90a8cbe914ff", "comment": "Malware payload", "value": "755b76c95f98cc41199071df05c1edbb8dfcaaf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777534314, "uuid": "d637e739-546e-45e8-a893-0e3dc754ab2e", "comment": "Malware payload", "value": "1f3075b3dbc7d7afa8289a21ecb2c98411a6cf4f2afc619e79012bc810bed5d40409e157bd04e1d999e4b3c6a3f0ed79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777534314, "uuid": "38391f68-3114-4229-ac66-128fbb545164", "value": "T18A424AB5A19E08EBF63784BA8095172AE6B2F224775316CF053380196F57FF07A3E611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777534314, "uuid": "22cbf026-0fe3-4c28-abb2-766be9e20b73", "value": "dc9cd1fb28c1828887594b85ee1eafb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777534314, "uuid": "ada6ca13-aee7-4cab-8dd8-b24ced21c3d0", "value": "192:BbLakEi1dcQR1rOYOCv6nv9eTQ4Y3SSTvAiYc1IdzcutplX2g8BtgGnP:1NH1d9R1dHpYCSTvl5UlXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777534314, "uuid": "716d67d3-320d-421d-b249-929415d224a6", "value": 12936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777534314, "uuid": "0ce8d8ad-da1b-47a6-b3f8-714e7c34f6b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777534314, "uuid": "453b788a-0ec9-437e-a661-56d2379bcfe5", "value": "SecuriteInfo.com.Variant.Tedy.452714.52397339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92af74e-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514261, "uuid": "c934a01d-994e-4ae8-ad57-48d02dd3d158", "comment": "Malware payload (Mirai)", "value": "e3bad03842a69fdb1c826fcbb04ce5bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514261, "uuid": "d5dd4b94-2815-4f4d-92e4-6e64ad89a960", "comment": "Malware payload (Mirai)", "value": "c2a18aa6bc7c130cba97b02b96f47b3b3e71f08e4b4b48fe678ab70ac2aa21d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514261, "uuid": "02cf7b1e-accc-4bc9-85a5-ff8322bf14df", "comment": "Malware payload (Mirai)", "value": "0d5d0e35c3e9d2e113f2fe87c9428f2a9da37f14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514261, "uuid": "4e684a11-9010-4480-aaf4-70298e4a3646", "comment": "Malware payload (Mirai)", "value": "e71bd495ce9e47bfd4646525022130831d9ee68e0ce81009171a57b0925079840a8dadc696e9be43be0995c2e7b38928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514261, "uuid": "35f77e76-a2e4-43f8-af67-94a8bfa7ff74", "value": "T13EF339037AC289FEC497D1F44BFB95359D32F81E1531728A6794BEA62F48EE02A1C750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514261, "uuid": "772f1d4d-7665-42b0-bd90-92fdb238a717", "value": "3072:AOIlwO5WGRZD96iqCLzM1J1vhoYpllDCZpEfkLTsY8OVno7ZEX:0lwC6/LJ/+zpAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514261, "uuid": "727ce3f0-72d9-433a-9d15-0d248f8eb17f", "value": 165240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514261, "uuid": "06b5aba6-9256-4433-9d1a-f530dde2bc8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514261, "uuid": "8edf9910-c211-4e15-b021-12730a634d22", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78043418-44d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777582764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582764, "uuid": "cfe8ac06-5ff7-4af9-96f6-650c97f5b15b", "comment": "Malware payload", "value": "9ba6c2a75c287c6f91d10aa5c172aa56", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582764, "uuid": "5768d046-00a0-45ba-9bc6-410aeae757cc", "comment": "Malware payload", "value": "c2dca361e080f569c43b0f97ac9fabd4dd47bbd7fb94b8a425c735910419fa01", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582764, "uuid": "b4b00bb9-b1b6-41bf-a1ee-9026f44c82af", "comment": "Malware payload", "value": "a193cf00e7e1011dc90983713b6c6a042ac1c717", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777582764, "uuid": "218c0969-8350-4850-948e-7a7992e787b1", "comment": "Malware payload", "value": "b101199ef5f302016f1cb9586f60628c8a74f05a9df7e07839f30a41caa23fe3bede8253fff30eeefb4539c10b96d438", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582764, "uuid": "a750d331-28c0-4d78-ae58-cb442cc52813", "value": "T1A1F2E6583E3AB21555F3E7726A9B9901ED2A113783A63454B2DCC3C01FB49E4CB7ADC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582764, "uuid": "ae347c3f-d40d-490d-b928-60523529ae3a", "value": "384:M3Z0yUNKhzhtGt2qAQcgBj2Fm0up3p68rTBfrU+AqoWF0d0DjpZC1C:EdI2qAZcj+upRXBTBAqd/ZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777582764, "uuid": "0dc35558-4156-4cf8-8aeb-29226dc04185", "value": 36128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777582764, "uuid": "f09315da-15ee-4924-b1d1-a68e2aa1c278", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777582764, "uuid": "4e50cea0-2168-4f49-ba7f-489564d4799f", "value": "agent_1777310055.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8cf4c3-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514264, "uuid": "00a8b7e5-8357-4ed4-83f8-43e3b6d3c2a6", "comment": "Malware payload (Mirai)", "value": "8b56382a4f76286803fc12f281959428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514264, "uuid": "6deb685f-e7c4-448f-83ce-8aed82c69fec", "comment": "Malware payload (Mirai)", "value": "c37e3aca30374f24897fa2c653be8d3d5e872fcee65c0662c21ca04a65ab84e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514264, "uuid": "f002d3db-1b70-4bce-a503-3e7b425f33fb", "comment": "Malware payload (Mirai)", "value": "19d36e91c406d92c50f78734cf878600dbcc0642", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514264, "uuid": "a94eb063-1fd6-45fe-85d1-51393eac5737", "comment": "Malware payload (Mirai)", "value": "9bd0c2313c3a135e84c12af41c5ffa63a31448a844f5a0fcb30e11c78736596eb0188ae2693048fa4a758e56f302e787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514264, "uuid": "b08e0474-0db1-4946-89ed-a505207c521e", "value": "T164242A027B0D0A07D1432DF4267B07E14B9BBD6138FAE681750AFEC957B1DB2644AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514264, "uuid": "93ab7dc2-8a97-4729-af56-9ca4f8a53ce5", "value": "3072:NWREpYSVfIJ8jsMvlvNuRexFOfTzy/SDLr0edl9tgjX4nGr0:NVVfhjxv+4xkfTzKSD33d2jX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514264, "uuid": "2df21bc4-9af2-402c-9014-349b912da51e", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514264, "uuid": "2ffe8038-965e-4795-bb62-149286ffa3f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514264, "uuid": "d582c620-19b5-4631-b4e5-b35df851b9cd", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cca5b19-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514831, "uuid": "06c7216d-3ba7-4834-a871-6911dadbf030", "comment": "Malware payload (Mirai)", "value": "df894df358ed1fb8d644acb97092e156", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514831, "uuid": "bdf3284c-a818-4e29-bc1f-12705e4d6485", "comment": "Malware payload (Mirai)", "value": "c506891a506da2a166e7bf1450c6e32a31c49d84438f4e91b0eb51272f38efa4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514831, "uuid": "69b80288-0d0f-4cee-ae4e-d9249b398355", "comment": "Malware payload (Mirai)", "value": "731d26066be369e62e4a65a5d98cc7fa0da2bdcd", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514831, "uuid": "01a07a62-7879-44d7-ab6c-7e1a9a2b24f1", "comment": "Malware payload (Mirai)", "value": "fcb0c7850fd3344dbe35a99874ab88095250a812be226705facceac2abd9d0cffdf489aca18143121c17c71eb9da1bb2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514831, "uuid": "1b30d5f6-f7da-45fb-9ace-64d884b8aaa1", "value": "T1D5D3CF32E0086DA0DD2116B4347659BC0340DEB40BD59243EFBEE59E28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514831, "uuid": "bea58a79-8273-4447-b2aa-443805d49171", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0Zfa:yulo2ubIVv3sXL5NZmOfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514831, "uuid": "cd6a276a-54c0-4638-a808-8d0e29771087", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514831, "uuid": "1e3502d1-d77c-43e4-9366-592f6f136754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514831, "uuid": "0b659519-6057-435c-b593-5fe40f23e5a6", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b924ff4a-4498-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777555815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777555815, "uuid": "3b257b41-c4c2-4ce5-a4ec-361d2ddb0e4d", "comment": "Malware payload (NanoCore)", "value": "2d886bd6c4854117530b6b6f95404e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777555815, "uuid": "b8eb1f89-1a73-4abd-b9e3-6fd7f8939c90", "comment": "Malware payload (NanoCore)", "value": "c839071beb2c6e1b7987da8cf992bd23b6b753489b7baffe132fe9951221d1b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777555815, "uuid": "83f29bc3-774f-43c7-8a2d-53053d3d21eb", "comment": "Malware payload (NanoCore)", "value": "56df8dd9baef2594cd2b77211b32b2cf2f716ebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777555815, "uuid": "7772b494-2668-4744-80f3-647e52e6c768", "comment": "Malware payload (NanoCore)", "value": "78537288daea277e4bb6c3452b142ed0acd80db609fccd3b8bc0a1857e9ca5c075cf0711c5fc4bb235d9c25731737848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777555815, "uuid": "cc3ac891-0da5-4cb0-80a0-a58d4f259dde", "value": "T13814CF6A37A88A3FD2DE8679611202539379C2E399C3F3DE28D455B74B627E00B171D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777555815, "uuid": "2d1a37c7-942e-41e9-b7cc-c03c7d03738e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777555815, "uuid": "98a5cd3c-ffb5-4d29-bf21-fd15db7d5f55", "value": "6144:sLV6Bta6dtJmakIM5hNLiVdjyTMyIdWus:sLV6BtpmkkkjyIfMus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777555815, "uuid": "a322f354-9f50-4a3c-92fb-013e423ae0cc", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777555815, "uuid": "ac89c2ad-5830-4e6d-a589-2f568bbc3303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777555815, "uuid": "137cf38e-5747-47ec-9fba-67c8854d3de8", "value": "nimbananoliaw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e00f9e4-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538402, "uuid": "dac2174a-d7fb-470f-baa3-3dff90fe71e6", "comment": "Malware payload (XWorm)", "value": "1aef20e5dde03f29551f14c99486e2b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538402, "uuid": "7186d79f-10ef-4c50-9c27-1f7fca1803cf", "comment": "Malware payload (XWorm)", "value": "c8b3a8e756e54870b9a3482cef9e92249877098bf7669fad219aa123d0ee0114", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538402, "uuid": "c2f9d56a-47ca-4707-8189-01b6d26258b2", "comment": "Malware payload (XWorm)", "value": "2047266327630478509fdf66cf0c59f4f2319593", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538402, "uuid": "e9ba0f94-89b4-43df-ad6e-3245c3f8e947", "comment": "Malware payload (XWorm)", "value": "54b9a63c4703fb9fd564850c22f92f2d1f360c4933428e1f979c4f8b4192f34109b3e5706adc576b169f1f6427421459", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538402, "uuid": "6d988b68-c21f-4744-9669-bc520a910ce9", "value": "T1973723878D1F4B4F04F91799453A2E871E3D0F109441A3A2BF8A9BEBF56CF286353199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538402, "uuid": "56b68d8b-3e32-41aa-a819-912d35518446", "value": "49152:ndRJ0PdRJ0KdRJ0udRJ0QdRJ03dRJ0tdRJ0bdRJ0ldRJ0gdRJ0hdRJ0DdRJ020dw:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538402, "uuid": "bd0b18eb-0b2b-4bf4-92c7-0d33fc5086f3", "value": 23164068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538402, "uuid": "d51b9bf8-02cb-4f75-8536-fa930beb9c19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538402, "uuid": "c690042a-6e84-4789-af42-28d52c84e4cd", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3146c722-443e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777516933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777516933, "uuid": "230f348e-931d-441b-95e3-13182401fc54", "comment": "Malware payload (Formbook)", "value": "8a99caaa2db77388ca5705180c0efc67", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777516933, "uuid": "a5ec9965-eced-4e76-a316-37fdf68cf33c", "comment": "Malware payload (Formbook)", "value": "c9836c468e48400f1ecfe0c4e5154572fbc73dbee92b92d6702a6e36f42dc433", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777516933, "uuid": "7733f155-974f-441c-9e9c-19e248e165c6", "comment": "Malware payload (Formbook)", "value": "05eba92fcded89a64ab16afd28ecadbdf3dd4484", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777516933, "uuid": "4055fe61-d888-4d9e-8c4a-34b1e3dc5c5e", "comment": "Malware payload (Formbook)", "value": "14a9928402ab89e2e8dc17ccbfa56507e21221df27562002a6b047caa3887b110037501cd0b85dd9a7c97b8a042a5237", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777516933, "uuid": "de8afa75-82af-4728-8748-9b229e339adc", "value": "T1F8941138AAFA4019B1B3EF54AEE47453D96FBB633B0E985D1081034A0633945EDE573E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777516933, "uuid": "7c6fb710-fc80-4a1f-b42a-c9fd51c48076", "value": "12288:90gkn35eSnY7ciqeuCqyq64XQjFq9BaetPi+9LuBxL/UoNTx:kE0ojp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777516933, "uuid": "d96d3f65-b68c-4873-ac7a-7e27c6b8d3c8", "value": 439882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777516933, "uuid": "a3f8905c-a5d7-48d6-ace5-883681b1e732", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777516933, "uuid": "37e10dda-aa81-4703-a38e-2319febc8a54", "value": "D494203 __ RFQ __ 208384779388 PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e6d21b-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538422, "uuid": "756931d1-cac6-486b-8562-4c70d7fdc2ca", "comment": "Malware payload (XWorm)", "value": "df61956ba61a2739f39e7184c2b69e35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538422, "uuid": "cb818dcc-8af7-4e09-8384-2a2b8fac29d7", "comment": "Malware payload (XWorm)", "value": "cac2007a644ea423fcb4e17044407302a7ca54c14cb37d8831e8ebb1cf131b5a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538422, "uuid": "630391ed-e486-4b30-8ea1-ac60b224f366", "comment": "Malware payload (XWorm)", "value": "1b8b875a74d7c7f2833e4a656831331d6222d190", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538422, "uuid": "d4a56b81-7b34-4104-9cef-1c06a79528dc", "comment": "Malware payload (XWorm)", "value": "9da6ff665a2889de4e28e8330f86767f7b5d4e65acf83bd4e5f7d362a161419e3c22516447424fb3204418f7c881fee6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538422, "uuid": "c9591014-f7e5-4c00-b805-d42e22282cbc", "value": "T103272374F9382BAE81B456A4256B365FECE04292D4578CF983EACACD904FE3530536F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538422, "uuid": "84e99fd3-71da-499d-bf32-9ec0214dd9ab", "value": "49152:yFscMseFFscMsevFscMseVFscMseRFscMsesFscMsemFscMseRFscMsewFscMseU:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538422, "uuid": "beab6d95-1d0a-48d8-af54-c57503f04eb3", "value": 21863415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538422, "uuid": "6fa2bfac-b7bd-4d1b-8075-45f4d5a57f65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538422, "uuid": "9f12d145-bc26-4244-96b1-d11ce4bd9ec1", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a5965f-448d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777550785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550785, "uuid": "78145447-4ff9-4369-88be-495c50cd6ea9", "comment": "Malware payload (Gafgyt)", "value": "f52e1c48819abf04f1f22e0fc44cdc5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550785, "uuid": "4a46a3b9-78b7-45b2-9878-4db51d703268", "comment": "Malware payload (Gafgyt)", "value": "cb6de9d21935d30876c9d62a4557b160854115af9b6dab8a781d4e192c8f3559", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550785, "uuid": "4eadc93c-526e-4c40-b38b-6c15a252f1c8", "comment": "Malware payload (Gafgyt)", "value": "e76688f86ca670b0b1818029f94c9a52a891754d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550785, "uuid": "a70d3aaf-a793-4367-bdab-c0659772e071", "comment": "Malware payload (Gafgyt)", "value": "530f4142b90e62a7284bf15b75870423bd8b55ff8d9e141bc0714245b34084e2a39bbb7575e82191ac2c250e958dbab5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550785, "uuid": "3f0d8537-7c26-432f-8586-3586dd372241", "value": "T1BD456C5AF2F370BCD067C030439BDB62A835F47501226E7B65C4DA352E66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550785, "uuid": "dc794749-5257-4207-8f5c-8e0fd3b7de34", "value": "24576:qyCAK6yZQUGU9XoVuOxJ6wgKV4L/zVj+D:q5AfmQUGUZoQOxJ6wRm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550785, "uuid": "28706a47-1eb0-4bb4-a78c-622a7807588f", "value": 1164680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550785, "uuid": "11365aa4-666d-4176-96c9-5a7fa6039c57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550785, "uuid": "03acfade-c431-4f70-9dc3-3486473ecb0b", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633d86ab-44d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581441, "uuid": "77253f93-8928-4f6a-bc42-71d5dbcb38cf", "comment": "Malware payload", "value": "8a6e61f2f65c9daf6025891ce7c55813", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581441, "uuid": "fa447160-13bc-4a22-8185-86018a371434", "comment": "Malware payload", "value": "ce295711b24c90deda12bfa08bd7ba8d52a37115980674cb2980466b8395ad0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581441, "uuid": "7f6c63d5-89bd-4f7f-bef4-6deb17751f2a", "comment": "Malware payload", "value": "a2a078babd67e2f4b82e35da34e6874db26dffc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581441, "uuid": "7d969bbd-d183-4de9-8a30-f0f043630f07", "comment": "Malware payload", "value": "de4603b0e7a7bdb29672f92b356919c67472585f838b609f651a5a534821c31db0521e6cc9d6e9a68798e0838fe5ee23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581441, "uuid": "184fe9a0-3aa1-4512-8852-f354afcd9b43", "value": "T173931A0A37318FA0C268953105738F77B695269356E29882F79CDD812D7036EAC1FFE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581441, "uuid": "ce0eb3b3-773a-43e7-91d8-55216f4a700f", "value": "1536:AAdqz0VXZBrWill7A2ELyY3C+bMiaOypyoFa6wvVmIMn7lUIA+3QhyxCs74K:AAds0VXrN/Y3zGbpyow6uVnslg9hWCFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581441, "uuid": "5cc14e2b-5c12-44a6-9e88-ff7bbfd8904e", "value": 96536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581441, "uuid": "a1b051c7-5cfb-4281-8cab-d4e34dfbc8c5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581441, "uuid": "ce0394c2-bf3b-4529-8d4c-f2022664dc50", "value": "Isv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cc8478-44d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581438, "uuid": "ff7b8376-6b59-4cb2-92a3-81c10e58c8f6", "comment": "Malware payload", "value": "dba48e416faee2405669701f563a84d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581438, "uuid": "42ff188b-7b61-460c-aa3b-0b449e381790", "comment": "Malware payload", "value": "ce99a22462e6d2f5e6ebce04254f4ec4aefa24a8f679179bdfb9600c5af30df9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581438, "uuid": "b6089cc8-cf85-4b17-aaee-4da460dddb19", "comment": "Malware payload", "value": "ebf7c407846b8ec9256c14a62a375ceb9e4e4b22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581438, "uuid": "412b8622-e162-4a87-b5f7-ff3b3989065b", "comment": "Malware payload", "value": "c60e7af699b4a675c6346af2d4ded30af7075dbdeb87774bc8979b8fd91584bd028b4e45f5ef7f83cdece887e580affc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581438, "uuid": "10666cb5-634a-4a11-a631-e2dcbb66cd2e", "value": "T1A163FA5FFC82D521C690A2B9B90D86CC33375F78D2EB32059F24BA3476EE59A0D79406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581438, "uuid": "35e3e3d2-f35b-4f8f-8317-b9619b78730b", "value": "1536:g5yU2+CY45vpi2mmc/3rgpACveJFrVtPOBer6n0wI9DCs7+T:gfmEVfrgpACI8Ber60HDCzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581438, "uuid": "802da39a-1a66-4060-bbf1-4479bc3863dc", "value": 71000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581438, "uuid": "0775a288-3747-4f40-932b-f0021162347e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581438, "uuid": "5e2e61d4-5ac5-4693-9cf9-63c371d35b64", "value": "MIP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11961306-44c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777575720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575720, "uuid": "69a2edb0-d1b9-4c99-af19-7ce61e671bc2", "comment": "Malware payload", "value": "71dd2fec89e10494df41c52a62d33723", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575720, "uuid": "4c85a4d6-34a6-4dd8-8b33-f9e5ad20b6fb", "comment": "Malware payload", "value": "cf3665eb838c5af11aaee3f57babd373ced7787905155e14c80fb9f50a32d558", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575720, "uuid": "5449b1da-ab89-49ab-9b8b-0293d7666bfc", "comment": "Malware payload", "value": "c5892339378b7be1add531ae28ae6c514e4f95e5", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777575720, "uuid": "97fcb59a-11e5-4cf9-8c71-8fe228fdb06c", "comment": "Malware payload", "value": "035c1cfdf27b6b0bf61a961c2f141c3271d8b416c9dd36b5c77f691388cd207d96bf9bd2c1fcef86594c180ca26f8b18", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575720, "uuid": "f97af0c9-5375-4970-9a0e-526c2a19a51e", "value": "T192A29D91222385CCA902E43A649DC4A147596DE809F0E9DC9B01FDCE518CF6F9DA3AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575720, "uuid": "041a3232-d129-49c1-918f-76f199b15446", "value": "384:Xl0MASnCEZp7+W0fuMRFxmbvqWHbgp8njnC0lA5PXy7J7x7v9qycyaAlDAYf7:Xl0MpnC3DRFxmbbbgp8jn+YjV3rl8Yf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777575720, "uuid": "70a3c735-fa3b-447a-90c7-b82e3f1c5d1a", "value": 21771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777575720, "uuid": "c69b5a20-0941-4035-badd-f693e7d4d6a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777575720, "uuid": "6157abb2-8e76-4bf2-8da8-bb2c905c0e82", "value": "agosi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a94ba1-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514276, "uuid": "25ee53d9-a32a-4cf7-86bd-3a0e8010e4b4", "comment": "Malware payload (Mirai)", "value": "015cc1084b5c54ab3a030cc137f9aa9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514276, "uuid": "962b1a3a-a299-4419-a4f0-f0cb298d392e", "comment": "Malware payload (Mirai)", "value": "d0dfe0d2ccd7de5118b72d783797695089562608041eae1407371d34cb76cd04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514276, "uuid": "731d8d31-52f2-4701-835a-7addac4f85aa", "comment": "Malware payload (Mirai)", "value": "4a9048acaa0ba6af358d38fd7697924db5e30cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514276, "uuid": "889d887a-bb1d-4836-bae1-583eeb0e6851", "comment": "Malware payload (Mirai)", "value": "7efbde7d840fe3074ce8df2b1c3a1c8a336051924069a1d870a2a8cf7b58bd8926fe461f2abe862a5cb34c6943978608", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514276, "uuid": "7f3d6e37-2c42-4534-8e18-efa6cd591b69", "value": "T117142B45B643CEF3E51304F011B7963E0B30ED364826D555EBA8FEB5DA23AC166163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514276, "uuid": "3d9817c5-2313-4ae4-9e3b-3b2ed9fcb185", "value": "3072:6/GsfHX0xVqadJ3M8x2ZB0GlpwhiPxKTUeDtGTfaAGlp8if:6/5fHabDGBrP5kufa58i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514276, "uuid": "f136b0f3-0dae-4f4d-af59-4a11ff4d9324", "value": 192996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514276, "uuid": "22eaaf95-1351-4030-aadf-467f0f6c9f73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514276, "uuid": "78aea4b6-8be7-4e98-9421-fb936ac07266", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dace4938-44c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777573481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573481, "uuid": "688f3fd1-1b32-4637-a30e-5107abeaf681", "comment": "Malware payload (Mirai)", "value": "0e7ef237315491c363eb374048161ce8", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573481, "uuid": "83488086-5e1c-42db-95a6-d1547dc8f734", "comment": "Malware payload (Mirai)", "value": "d0e0a149b4a2acb3355bd40a94a0340bfda490e752709c2a58ec2132fbe49d18", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573481, "uuid": "3a2dd110-ff36-4fa4-b77e-00ee14c2f296", "comment": "Malware payload (Mirai)", "value": "5e30f5422aca2a526ed9502dc39f7f0d27471bfe", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573481, "uuid": "e097855d-0c1c-446e-8394-6ae1609851c5", "comment": "Malware payload (Mirai)", "value": "448202ae6332c8a460c900c8b2e90012a7495bc2584242c8ca0fc4234cba1004b27a0b1f48f090ff142e37ebe65bb24e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573481, "uuid": "c1f03f1a-c36d-4d9d-99be-85661c14066a", "value": "T11BF32B56E6418B13C0D627BAFB9F424533239B64D7EB33059A28BFB43F8279D4E26105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573481, "uuid": "b075577b-0420-432b-bc52-7110cbbfb8c0", "value": "3072:0x+EaBa0O5qtgZnbqyZI5DD6rwDXvrwyZ4hjGC2DHM/9hrr7hSmzwI9jxiFO:1BBa0AqtgZnxZI5CruXvrwyZaKC2LM/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777573481, "uuid": "02c1466f-0a8f-498c-89e1-474b2265e7f2", "value": 171904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777573481, "uuid": "dc06c5fc-3a4a-4482-9783-d976ecca7728", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573481, "uuid": "77647887-3b05-4ab5-b758-aae498d47c30", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cddd20-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777574166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574166, "uuid": "fc48d2fa-75f4-4b91-8fe2-66efc1a022d6", "comment": "Malware payload (Mirai)", "value": "bc37ec7ee14296a507698f2a7cf70319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574166, "uuid": "c6372a9a-ecf7-435c-9eff-5cf61e554f15", "comment": "Malware payload (Mirai)", "value": "d12a920272bf4da09fe16aece746c7248914f72e7fc16bbe95496134cd67ce5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574166, "uuid": "f57592e6-4651-4d86-9afd-8dee7211f55e", "comment": "Malware payload (Mirai)", "value": "2fb5e16d61c5be3799a603b8411c3c45c86b0516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574166, "uuid": "9bd204be-b48f-48b4-89a5-bf806e17df6e", "comment": "Malware payload (Mirai)", "value": "13d1cf2a3880b3910d9c3e7617453de75811449ac876d5d15de9ccbeb8ad9aafa93156af309e3620779984d46db09619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574166, "uuid": "38ad9296-2f14-4972-8a49-afebd7c85163", "value": "T1C863F8D5FD429B12C6C265B7FB5E438C772B4368E2EA32039E255F2037CB95A0E2B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574166, "uuid": "5f817e6a-d7df-4c60-bc42-2d83e25b4983", "value": "1536:2GkDy2TORk8EyzGwOTAqgjQiQeWH848q95ozJF:2zrO+WzJdPWcqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574166, "uuid": "53e35bea-8c43-4d97-aa95-535d57f2e19f", "value": 72104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574166, "uuid": "3c583bc5-0296-4151-aabd-ef1e20e4534f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574166, "uuid": "775c0bae-d61b-49d8-a0de-f29db1a8fb80", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac0e2dd-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514291, "uuid": "deb908ae-c750-4f87-adc8-1e5ce76b1516", "comment": "Malware payload (Mirai)", "value": "3a11c2571087fca5520274c614db8a33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514291, "uuid": "a8286cdd-08f8-4b41-8d7f-2469a966a2eb", "comment": "Malware payload (Mirai)", "value": "d13be1b0704a68fa2a9ab3a5e6dd9d618d003949e1844548e747b4f1fe6af861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514291, "uuid": "c68d68e0-aa73-4047-92c6-3ef778b634a0", "comment": "Malware payload (Mirai)", "value": "faf4a818b3ebfbfaba9d6f8b8d91722cccb6b800", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514291, "uuid": "08bfd55c-2a16-4ce6-bdb5-97cd058a1b9a", "comment": "Malware payload (Mirai)", "value": "90e1e08f2dc22a0eb664fcb4598a5c836ed611c3a97a930a87033e97db866a46552af5bae12a9afbfcbc68a2290c427f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514291, "uuid": "87b399aa-c45e-4131-a51e-ae3926790918", "value": "T12F935D86F793E0F0DD4606B0116FB77E8634EE114024DE6ADB94BEB2AD32702A55B71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514291, "uuid": "67eca632-59f7-487c-9a0b-f5bd09c3c834", "value": "1536:mEerN4YH+doEGf2V2Vu2RnL6zUhAWDXLpj2kmY+IVBCDUt31IzPCyjrh:mBrgoEGeV244nL6zUOgdmXWrSzZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514291, "uuid": "aa84562b-6fe9-4a1c-b975-1db82c95df9d", "value": 97132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514291, "uuid": "8b037084-f907-41b0-89f6-b0715f463335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514291, "uuid": "028fe074-026a-4762-ba94-381b9d8c4b6a", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd893b6-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538373, "uuid": "279b0b9a-6907-4305-857b-86237ffdc4f7", "comment": "Malware payload (XWorm)", "value": "cdc22678be11a73dcb06bf39d0925dd2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538373, "uuid": "082fc72a-b746-4164-be4c-e8dc1ddfff3e", "comment": "Malware payload (XWorm)", "value": "d26621b9e5094d913bc268a129f00ef9da9938fdfaf6b6127a461feaa2dba458", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538373, "uuid": "dbc886f1-f59a-4f3e-8d2d-5c7a8011944a", "comment": "Malware payload (XWorm)", "value": "4b17dd65e00227c38a88631e75ee9fbe704dac21", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538373, "uuid": "df69128c-f977-45ae-b786-d71f01bd977f", "comment": "Malware payload (XWorm)", "value": "87213893d4c1850e50f31064fd866da8ee8237025eec489d83e7e15ad64223bca5943eaa1b284e138b6b1288076f2d6a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538373, "uuid": "4e8d4c9a-fd38-497f-b198-db6cb11a79fa", "value": "T1B03723014A06DF6E47BC15B860FA0F0F887DCC6486156AD2B6B1B883975D7E8B06F4BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538373, "uuid": "38e414bd-04f0-4e89-909a-30ab71989e75", "value": "49152:tnPIPgunPIPgknPIPgonPIPgOnPIPgXnPIPgxnPIPgInPIPgjnPIPginPIPganPc:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538373, "uuid": "ddb20d65-c1f1-4cce-9ccd-1d74eaee6a51", "value": 22643815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538373, "uuid": "ff2b7aa2-177c-48ad-a6dc-ce92b31d72a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538373, "uuid": "a489c5df-6bfb-414c-9980-be5a5e347944", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fc7e3b-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514275, "uuid": "198a958e-cb5e-4909-ab11-2e9bca60f37a", "comment": "Malware payload (Mirai)", "value": "32ea477364ad7104a31eda6c5585292f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514275, "uuid": "6022469b-f70e-459b-b93f-1990296d9669", "comment": "Malware payload (Mirai)", "value": "d2c8e1a2757a9456717b60ef002392ba6454f90ac9bd49f5682d287764316c0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514275, "uuid": "2feaa99b-9ff0-409b-a573-82de05e64f0d", "comment": "Malware payload (Mirai)", "value": "15c0a1048bc5090b77614e86a74acbc93a59a6a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514275, "uuid": "c90839fc-ad13-419f-8b93-3faaa0a18536", "comment": "Malware payload (Mirai)", "value": "31d8994969f88d5d9e27ed6a4b51f2cfdd193a34a9a717614f2d359cbfd77292736058bae9a2536749ad90a77ed572e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514275, "uuid": "d9c24559-b1d1-47ba-baec-591946a0bac1", "value": "T184243A027B0D0E03D1532DF0263B1BE04BEFFDA128B5E685755EBEC59271DF22489A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514275, "uuid": "5a0a8bdc-b9d1-46b2-bdaf-4c99d7b6324d", "value": "3072:j8oDiZIgC1u4GnpsZyzvmxrSzB2NjOE32EZQ76j/EnGrq1:Q4gCcnGivmxYB2NjOEGEvjzq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514275, "uuid": "d0ce0ceb-88ad-4560-a9d5-bdfe27a0f1a9", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514275, "uuid": "0fd493c3-b17b-4c7c-bd50-b26968b7150f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514275, "uuid": "2855665c-a4ee-4419-bbc6-55fe017ccf88", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961b0a92-4445-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777520108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520108, "uuid": "f90d83e0-e8a2-4fb2-abd6-ce7845731261", "comment": "Malware payload (NanoCore)", "value": "1f918412a0b5542687a1b2c253abd896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520108, "uuid": "b198c18d-48ef-4bc9-9145-656e1d7be9ce", "comment": "Malware payload (NanoCore)", "value": "d3d4bc92ba1312a003999ebfe8b9b8b35a2ad4242b2b18b3449407398eab61d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520108, "uuid": "6c6af5c9-32eb-4491-b689-e26313c5c29a", "comment": "Malware payload (NanoCore)", "value": "141d5d7392eeebc2adbd389597d5f38aaeebddb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520108, "uuid": "015641c1-e264-42cd-bbc1-d75685562cbe", "comment": "Malware payload (NanoCore)", "value": "32b7b41f7fcd64b53ec1c69ec560ae6d20fb77090bb0163c0f77b861fc09c23415225c49bbcaf905a0281716accd374f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520108, "uuid": "785eccc6-a2d7-45ef-aea8-7c0cc60ae349", "value": "T17A14CF167BA84A2FE2CE86BD712252168378C2E79CC3F3DA1CD455B68F167E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520108, "uuid": "8f05bc1d-d744-4651-817e-00a307c154fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520108, "uuid": "f8df75b5-4811-4c20-9d9d-162ec6a00312", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI+7iT05t4Ziu8hBVv4TPcXQZqL:MLV6Bta6dtJmakIM5UGtMMnEcXs7hmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777520108, "uuid": "d1f36399-9e1e-44d2-970c-f391e7dcfac9", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777520108, "uuid": "92d35936-3ade-458c-b316-f31d038349cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520108, "uuid": "ff1f052d-4799-4406-8a9f-b66a728bece7", "value": "1f918412a0b5542687a1b2c253abd896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1a6fa5-4437-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514266, "uuid": "c973132e-4b8a-4392-b5f9-416ba2228c8c", "comment": "Malware payload (Mirai)", "value": "4ac7b84aee10d04539174f85046cac9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514266, "uuid": "71d0bb2b-95a7-44d0-a4e5-d9010efb22ad", "comment": "Malware payload (Mirai)", "value": "d3ffce49fd6a0bd2e63253b722dd48420116c5ce73a8894b4afe73afd3732db1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514266, "uuid": "9fe6fb60-1b18-4748-a067-96071d09e20c", "comment": "Malware payload (Mirai)", "value": "4760568a022844910d8de3917d5bcfcf8f823cfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514266, "uuid": "4d5f9fbd-d5b4-428c-971e-df38360db42b", "comment": "Malware payload (Mirai)", "value": "a3f3e6e954e6ffd48bee327e21c6adaa8e866d18ee16be45f79b7e47ad63186faf503099a937c0efcadd8562dbb2b8e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514266, "uuid": "e6187729-385b-4d36-8cdb-d752e69fa434", "value": "T19CD30649BD419B00D5D636FAFE4F428933530B6CE3FA7112DE205B2127CAA6B0F7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514266, "uuid": "003be003-2251-4f55-b935-abd1f1299977", "value": "3072:fHqdWjZhk5Qvfp0awcATq5gCqYkqOZaBcwq1S9gEHDETooDzDWPMc5qv:/qdWjZyQvfp0awggCqVvZaB/q1S9gEHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514266, "uuid": "b1f9308f-15a6-4cce-8cc0-80a224150186", "value": 141032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514266, "uuid": "5932642c-8509-4c60-bb7d-0a0085a894b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514266, "uuid": "49e8bd9d-b826-4f54-b6bb-937b90cb9ec3", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989dd596-44bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777571223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571223, "uuid": "95b294aa-5530-41b8-b0de-47d34d768834", "comment": "Malware payload (Mirai)", "value": "1b28c63cac4896e1027cefd246e6530a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571223, "uuid": "43cd546b-4276-4eff-9308-95d10b0ab0cd", "comment": "Malware payload (Mirai)", "value": "d4d35962fc115b0e81de807ecea7db02c01b24edc9ff9a39228df765026cb7fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571223, "uuid": "722025ab-47dd-43f8-b9e7-a023721f1247", "comment": "Malware payload (Mirai)", "value": "0ac50440cee5c38a0c120875dc57fac16449a509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571223, "uuid": "bdd4a034-782c-4b33-9661-ec956d7face9", "comment": "Malware payload (Mirai)", "value": "0a56131978a572948bed89e1e9833e9de7955f4c889af824dcf16490dfac61ea26eb980ade3aedc39449ea7c1392684a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571223, "uuid": "9d8dfb0d-8d7d-4e90-8731-03e9241c2715", "value": "T1F2A3E70AAF510EFBDC6FDE3746A90B4235CC594722A43B3A3674C928F64A54F4AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571223, "uuid": "796d77fa-9efc-4f7e-887c-5d57f535c2fe", "value": "1536:N/XFg8oghKNhyOJyp0hS3BWZg3Whqti7ZMM0K5x6ezJHSHAC:4VJxhSwVPRJHSgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777571223, "uuid": "e96c1600-f651-449f-8503-b66ac29bebc4", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777571223, "uuid": "5b5627be-0031-4829-a256-272cb09a91d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571223, "uuid": "e9a92e49-da97-4df2-b102-e3b7373fa56e", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a658e6-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514814, "uuid": "99cdcf84-fc49-42de-8976-a24fea7aa77a", "comment": "Malware payload (Mirai)", "value": "c1d7970d101536b47c8855394537a770", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514814, "uuid": "407a6a6f-5a22-4995-9b2f-8d6b04f18c02", "comment": "Malware payload (Mirai)", "value": "d550eef48d130eaecab1fd852c760cb6ba22eb4c3c57ef3cc333dd928c060142", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514814, "uuid": "d2dfebba-e99e-49b2-9197-8e96768e1748", "comment": "Malware payload (Mirai)", "value": "5ca35a317730d34cb62ac660f897d8f232303bc1", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514814, "uuid": "8700bdcb-0407-4870-92cd-053aab030922", "comment": "Malware payload (Mirai)", "value": "cb5bb1d8cca00165f2ea36f0da2a283a7798e394e33ecc622a5150038318da01b58a5bb046dd64f25002ef6e2d6e9b2a", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514814, "uuid": "483993e3-685e-4730-8278-6bf826b4291b", "value": "T1946301AC36EF8430F0DCE922264E21307331DB65A43B53DD2D99B5EDE2665A80913E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514814, "uuid": "479f8095-06e6-4da4-ab70-6a3d5f93a66b", "value": "1536:OltrI7mDmde7Lletk8cghgLFPjihgulh6DoIcxwrPt:Ol+YmdkLMk8c5PdulIxrPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514814, "uuid": "777b3d53-b1c5-4014-8d61-097ddeaf5e59", "value": 70840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514814, "uuid": "ce991235-2753-49e5-90c4-4ae675098901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514814, "uuid": "d95ca4e3-0f71-439f-9922-dfc323eec560", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ff15e4-445e-11f1-a769-42010a9c0008", "comment": "Malware payload (SiriusRAT)", "timestamp": 1777530740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530740, "uuid": "1be56235-57d2-4a7c-82c8-3f0a400e11c2", "comment": "Malware payload (SiriusRAT)", "value": "258a1422bf0609365b836b758c9ce867", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530740, "uuid": "fbb4a46f-02ce-4f70-b16a-516491baed0f", "comment": "Malware payload (SiriusRAT)", "value": "d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530740, "uuid": "fd721510-fdda-44e6-97ff-95452a5855bf", "comment": "Malware payload (SiriusRAT)", "value": "c5c75a065e0468dc272b42c97c692343bf13510a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777530740, "uuid": "b6ed78b3-8e23-4737-84de-011a83ba969a", "comment": "Malware payload (SiriusRAT)", "value": "570f2f79cda0e04e5f9bb6369a668cea98d483a303a46e6e623e06867df7c1e73894bf5e35099ea2222eba574190fd7e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530740, "uuid": "7de454f3-637b-4939-be12-08cd9d2f9ef3", "value": "T11874EC202AFE500DB1B3AF556FF475A68A6FFA632E26905D1050034E4B73E41DDE273A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530740, "uuid": "a4db85af-888a-493b-acf3-8fcbff26d8a6", "value": "6144:gyNhfNBhHthrLnpeG044Nfi9c+7jV6CEsV4HCpZ/B7GIhtoDHlqaN3qLe+Vmv:vNNHthrLnp3044Nq9cGVPEsV4ipZJ7G5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777530740, "uuid": "e52463f8-a1d7-4591-9305-892cef2c15cd", "value": 348538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777530740, "uuid": "8df02a79-d40a-4ed3-996a-e85947dcaa08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777530740, "uuid": "fd9b1e15-1497-43ca-a2c5-5a787bd8ab53", "value": "Pago entrante $980,465,87.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b0fd5a-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514811, "uuid": "850871e3-7764-448b-9aeb-a4dcb92f5710", "comment": "Malware payload (Mirai)", "value": "2390b10f62a82fb34d75402a7064ce21", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514811, "uuid": "1ecc3e23-a801-49b0-8071-c764f6361e2e", "comment": "Malware payload (Mirai)", "value": "d656e79dfea0369230cf03b1ac6caf3f70e80ead258ae885d9397253976ea097", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514811, "uuid": "261db099-cf45-46fe-99d1-2c6cce869a0b", "comment": "Malware payload (Mirai)", "value": "8c9568b01bc9c59ecde7e9c34b07d79d756b73c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514811, "uuid": "39811607-86c5-41f7-a77e-17017675f86e", "comment": "Malware payload (Mirai)", "value": "5eb0f5ab91dec6f287e64a03034e6885576288dac91b0d4c5c524e7906a17c178d7bdaba6ed38460e6c7e44546601eb1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514811, "uuid": "9363b8bf-b6f9-4cca-bc2f-3abef2eef1ff", "value": "T1D4146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514811, "uuid": "12493708-3145-49d1-b4cf-fa6ca71b91a5", "value": "6144:zNROm5155gL6mTX7zRR1Lwt8Al7IKTtw:XgLnLzt0ll7IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514811, "uuid": "4fb80a61-d151-438e-9806-6505622cdc82", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514811, "uuid": "21ee19d4-b256-444e-a0a1-f2769fcd4d71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514811, "uuid": "d3c33e65-7d36-45cb-a9c5-01953dec37eb", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba672917-44a4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777560971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560971, "uuid": "93c8ebde-f9bd-4dee-946e-3f4ea4cbf6fc", "comment": "Malware payload (AgentTesla)", "value": "8ebb8994478efee21a4a65f2b3838f37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560971, "uuid": "3c02a0d2-4693-4849-9ad9-cc4bc951d5a1", "comment": "Malware payload (AgentTesla)", "value": "d7708b90c0cbdb51cdcefb0611814025ef38bcd328adcf6e71f7800941368b3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560971, "uuid": "f78a0335-1dd7-4137-871c-1b271d442916", "comment": "Malware payload (AgentTesla)", "value": "107adc086a033953759c59c50326c5038a78114c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560971, "uuid": "ad06f46f-bd63-47ac-a3b2-3e01be35c490", "comment": "Malware payload (AgentTesla)", "value": "8205f056f1384a54c1cc7c4fad029239bbc2685429028efa41e1e24fa8cd096025cf251abd9558100fdfbea0d9937ab9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560971, "uuid": "cebd2cba-68b6-41ef-bd66-a5d11b30f253", "value": "T168253332BA587857D4C8F53D82BA0D849D45AAFF4160EF1DB2D2989E482D406EC8D3F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560971, "uuid": "f3e8ee81-e128-49c3-b5ed-374d7256606a", "value": "24576:IgTFcIOeXXz/bpNfg00sqAX2mbLw7ObNlUMWWR:ImFLrQ58mm3MObHMWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777560971, "uuid": "88623f8d-99a0-45ab-96ec-8b1fbeb2e4fd", "value": 1044119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777560971, "uuid": "72d436b8-400c-4c29-b218-8e732e98614a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560971, "uuid": "66d01997-4172-4cbc-b947-26911dc6c01e", "value": "d7708b90c0cbdb51cdcefb0611814025ef38bcd328adcf6e71f7800941368b3b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7793d9-44ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777570179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570179, "uuid": "c8a22c9d-84b9-4847-886b-dcd6cc3b3c94", "comment": "Malware payload (Mirai)", "value": "2cf1235206fcd2287c2b400447275597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570179, "uuid": "e69e1a8f-7747-4065-be05-53ac67245458", "comment": "Malware payload (Mirai)", "value": "d7f6d28664a20dfc273e52998f706573e247bc19a21c7884f720bd6f9fd1aa10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570179, "uuid": "1f1d8ad6-c5d9-4655-ada3-a36595745075", "comment": "Malware payload (Mirai)", "value": "9e3c1b7c34e01d916e26f765885a5eac5f701cb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570179, "uuid": "81d5ce9a-b248-4dd2-bf93-93a32a680184", "comment": "Malware payload (Mirai)", "value": "65a273b808787bf2bd1c14bcf6fb24fa2db7badc5145d493f6d39b648e57a72d5dea9be0d3038ed7819d2e62787081af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570179, "uuid": "3b65bf1e-e2bd-429f-a8fe-afa7b3132886", "value": "T1FF538D0BE783D8B5D8630171617BA7329632ED351025DB43DB69AD31EC12B12EB2B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570179, "uuid": "33fc9529-29ee-4f32-80cd-3596d9535a73", "value": "1536:qM0OI80WMTZPLsj5PYdjZfP1C1rYlYYXvg4pdg:qMd0T4tOlnIYeYXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570179, "uuid": "053e3fa9-7a70-4a8c-9f86-ce9caed93d17", "value": 62632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570179, "uuid": "3fd7354a-cf30-41e6-9cab-9df59e2a41b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570179, "uuid": "1f816cea-7262-409d-b957-d9021d79c4a6", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db88b777-44d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581213, "uuid": "74725cf6-4e09-4547-b642-c6712426c04e", "comment": "Malware payload", "value": "c5742de05f3bbb9baf062a8ba0673a1e", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581213, "uuid": "1f1dd3b5-6943-401f-aca8-4edb88d9b3b7", "comment": "Malware payload", "value": "d857bdece1900fbc08333f699e9c7dcc32ade3fdcb07f1ab2ca49c1cb0abc77b", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581213, "uuid": "13184d43-3c50-4002-a23f-d67d4af51cd7", "comment": "Malware payload", "value": "786a5d814a67aa7b97785ab7c2da6f775039f712", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581213, "uuid": "d49d2b54-b889-4bb2-944a-e95cbd18543b", "comment": "Malware payload", "value": "bc95abd77fd771017e72e2c167c47bb7d3050c410b0275da4332d2c5e1ac0e29cbf31f2fc9167a1e85232affb66ddce0", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581213, "uuid": "4452588b-03bf-4ecd-8414-a0d72b7c56cf", "value": "T12303AF63A3C097FA58EC523694B924C883AC463DA1701FAF6F25C5150FD948E71BF1B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581213, "uuid": "c17a73e7-d1eb-423a-9ee0-84720547423f", "value": "768:aMVvmxn642lXwuw0ultfspEflLf+uMhvFQJf7a2KLb2mWZxraGsz9n+nlM5kqR8r:aKuOgH1pflLf+uxJf7a2Kf2VjWfzIllt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581213, "uuid": "734ed11e-b6c1-4cf7-9c85-663f7eb6375c", "value": 41119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581213, "uuid": "83200709-4d25-447f-9d82-885b9eeb5eee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581213, "uuid": "e08d5642-007b-4906-be2a-2fb76f72b6dd", "value": "olepo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3b06ed-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538349, "uuid": "43920dd8-2d3c-4293-8807-2c44785b0948", "comment": "Malware payload (XWorm)", "value": "b592842bc8feeff85b210bf38ebd3dfc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538349, "uuid": "a0627cde-ffa8-413d-aca2-a2d3581d96f0", "comment": "Malware payload (XWorm)", "value": "d88c10a4d321a8aef3271f488e347773d5767b078df5ac5617472714d8448208", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538349, "uuid": "8183b2e2-2c28-4441-8bab-6bc4d391cff2", "comment": "Malware payload (XWorm)", "value": "30453725a5ecab474395087b256aa5a6525c9643", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538349, "uuid": "72ef4685-35b2-4a70-be07-c0f1bb1b75b8", "comment": "Malware payload (XWorm)", "value": "aebf70433e579200f2afe7f4bae30cf35c5cc826c3691198a843bf0f6ee01c91b555ae4eecee2f91bae8ae8313d673d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538349, "uuid": "17d3bf3e-c461-4f28-a1f7-bc1b5356cc92", "value": "T12137234309754EBA8EBE8F2C30BD0F7C1588C66508E69C6B57442ADD9E8DE16234D3ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538349, "uuid": "8b519947-6c4a-498a-a444-ea5a3fcb35bd", "value": "49152:itstXtytxthtvtRthtAtDtTtvvoJBtJtYtatqtjvoJgt4tstztTtYtWtUt8tNtGd:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538349, "uuid": "e5757d5e-aea1-47cd-87d6-bf6d43c62352", "value": 22903945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538349, "uuid": "27206a37-b14f-4a16-8ed2-3344918d73e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538349, "uuid": "eba88630-7166-42c6-8d9c-a681b7b6cc88", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac82749-4487-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777548624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548624, "uuid": "fb9b38bb-2880-422b-a625-017bc512ccac", "comment": "Malware payload (Mirai)", "value": "12e6772115118a76ecadbf6303afd84c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548624, "uuid": "7f6e3053-930c-4830-8c2c-673cdde0d40a", "comment": "Malware payload (Mirai)", "value": "d90d6c68ff910c51d6a94d353f5fc7d93f2be7a916adf565adc856596e5a5087", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548624, "uuid": "3550411e-34bd-45f5-b534-196a7474753f", "comment": "Malware payload (Mirai)", "value": "18c14365d24c86aec3aafd3a127c3a3b2bbb3012", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777548624, "uuid": "fd87628c-c7bb-40fa-ac70-a1eeec1dba37", "comment": "Malware payload (Mirai)", "value": "ce6c4496f5a6b8a9227f2dbdccd305804f8af9e7ec055d7bcc2124be5e1e7c333ed2fb81abbb89406b8c3929688a2b46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548624, "uuid": "de202e69-02cf-4a73-aa96-6503f4c84342", "value": "T19D73FA52BD428F13C6C321F7FB9E42587716676DD6FB3203EA21AF6027874DA0D2A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548624, "uuid": "a32a9fe1-761a-45b9-b0e4-3438b77c0bb0", "value": "1536:rSJ1ckTX9XIhtM5POUi5QHJ+aqQiv2g5vRHniomK:2J1ckz9XiMwupuhJmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777548624, "uuid": "fba3ca74-e7f1-4b48-a39d-1a053453a1c8", "value": 78536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777548624, "uuid": "69521e84-6040-4531-bd06-522ac553f02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777548624, "uuid": "fa71a60f-6a8d-464e-ae99-8159d9b8c893", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed6a73d-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538430, "uuid": "2973d9ea-4fb9-48be-9f9c-36f4c2fcec11", "comment": "Malware payload (XWorm)", "value": "bc9b176eca177c03b482141ec49848ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538430, "uuid": "827256f2-392c-4ec7-8679-659458a47fb9", "comment": "Malware payload (XWorm)", "value": "d914d72f54c8fe09b12be94ab8b320e68eb1361f2081b91656bdf7fcf16cbbc2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538430, "uuid": "fea40208-eb86-4dd4-b80c-f7c486bb8173", "comment": "Malware payload (XWorm)", "value": "2533296251acd08c8e7ff82b3c06a0e02a9ba552", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538430, "uuid": "2cb006e9-e0aa-46c7-8913-d18570ee7fe6", "comment": "Malware payload (XWorm)", "value": "a69154959704eccf6267620024bf3ecaf1fb45b30b3b403a1c3802f01cf04beb28ddf516cb1e4955c5946390caa4266a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538430, "uuid": "36900e5d-e182-45e8-9003-620c7f3b83c2", "value": "T13E37233B10CDEF1AD178872CA076AF1F8AEA0E541151A0FC90EFEC9DDB15E59659B02C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538430, "uuid": "dabef28c-dc61-40ab-ba9d-4588580b0d09", "value": "49152:umcmNmDmomsmmmhmHmFm7mtmxW+kfm/m9momsmWW+kmmKmZmhmRm+mBmCm5mEmUh:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538430, "uuid": "03301156-4418-4744-9703-741cf37401f0", "value": 22383676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538430, "uuid": "8072a89d-9667-45ea-9486-ab16ece99d91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538430, "uuid": "009f1e72-a71c-40fa-9c3e-06ead5895aad", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15aed50-44c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777573089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573089, "uuid": "913f6298-0a86-4209-8933-64aefea91d2a", "comment": "Malware payload (Mirai)", "value": "59680ae6cd61b65b663458aef1b31e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573089, "uuid": "62b1522c-c04b-4efb-a32a-6e7b7d9b957a", "comment": "Malware payload (Mirai)", "value": "d9cc3b4237bf69a93cfe7827394dbf852c196bab86abd9ceee249450aa3edf34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573089, "uuid": "2d4910cd-6056-4b04-9431-699ce3c29d38", "comment": "Malware payload (Mirai)", "value": "f960c6e90cc0d67b6e95f56f84aed3ac3f2a20e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573089, "uuid": "51499376-4827-49b5-b157-98f29c71c868", "comment": "Malware payload (Mirai)", "value": "3526d2072d6fe99ff840e40c0c551e530febbdf1edbb53a857603cb1c8c27ffcbbeb31c5fc551d9d0d9b0f3938282256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573089, "uuid": "aca63ebd-aba7-4cfe-a8c2-2ab21e280add", "value": "T136733B32BA720827C4C4A57A62E34335F2F7878A14BC8B1B3DA14D8DAF75A4036577E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573089, "uuid": "e6ef435e-26b6-4d9f-9ba1-b05c0e70ce9b", "value": "768:gjTHd1eFr7CdB9Mf0wtlmxiGO+N95V0NO1eh5Lv4zongY/JohUt0MBH5cTikpxIE:gjzd1edCut43N95cHngEJJt03px7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777573089, "uuid": "be5b6730-8216-4f09-b115-64246ce6c654", "value": 80692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777573089, "uuid": "f3af9b31-42ca-413c-b117-283f85fddb35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573089, "uuid": "be5ee75b-b755-45c9-8390-8389d5d506b3", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181496d8-44ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777578738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578738, "uuid": "93967529-7edc-4386-90be-8fd58cd376b6", "comment": "Malware payload (Mirai)", "value": "595651b24a20c9faeb57695182b700b7", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578738, "uuid": "b50d3856-2865-401d-b565-5ebe57b0b3be", "comment": "Malware payload (Mirai)", "value": "da6b482991f7adca439cc9208321e0e05fafcf3dcfd41a299cb0b667256ac276", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578738, "uuid": "db1428de-62e3-41ad-a357-8830eca4d95d", "comment": "Malware payload (Mirai)", "value": "74645b52cb24d3b57c5e5f2956359a89e862dd79", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777578738, "uuid": "b2ebd34a-b66b-4e2c-abe7-6826b53be784", "comment": "Malware payload (Mirai)", "value": "ec83f789339ca7b93bb8b525c4045bea153754bb9e0a3bd75e7bf3cbcf07452d4855128fc2f9f74de62093c20b9e2a97", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777578738, "uuid": "bdb01ebc-a348-422f-bcbd-5c4db8172329", "value": "T1D9C3D606BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777578738, "uuid": "7762b3ea-1375-4d5e-96fb-0774a1f3b822", "value": "1536:D4w4zW/h4SZsqEzYcLsiDSAPj/OojaXbzzZj6fPNXi/yRKkkI3SGC:UxW/rZsqPcP/3jarzzneqGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777578738, "uuid": "2b61d2a4-4c85-4d4b-a539-9e3b55129b8d", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777578738, "uuid": "65c4ace7-7b8f-4977-b660-cdd6c4f67859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777578738, "uuid": "64c40e3a-6f27-4286-8e61-1e2b1edd3137", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048a7625-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514281, "uuid": "c28e384e-6851-46b4-8905-e309c0650d7d", "comment": "Malware payload (Mirai)", "value": "4b9721b653101a962c1be91c8df2070c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514281, "uuid": "0b580660-ace2-4988-b7cd-47c925bf9587", "comment": "Malware payload (Mirai)", "value": "db2272ccd055b6524c8360d0c8fa126670a8e1c2f783091436e2adf002a026c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514281, "uuid": "2f0cb368-5c8f-4a91-928a-ab8ce2d6984f", "comment": "Malware payload (Mirai)", "value": "593217f487aabdc6f41a1dc665a29a64997c30c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514281, "uuid": "03eed6c7-6b81-48ce-a1fe-1082b8f2aa27", "comment": "Malware payload (Mirai)", "value": "c5cc94a8b37e7831726a2f49b9f7c6024aaf68aacf46c7accf96c9d40fedc00774316dea5b3553ad500bd0771baf01f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514281, "uuid": "e69825a4-a40e-4d22-9ab9-c4693fd809fa", "value": "T134032B3289B6670BCAC4737701974362D0FA1F851244164FBD1A0C9EFEBA3412E6B796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514281, "uuid": "3e662d78-09a3-4acd-8241-634a0d1e477e", "value": "768:ZSclHJm8quABy5B56ndaTH/dirNX3b6U+xADq6:ZSc9jL5B56daTfd+NXuU+4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514281, "uuid": "ee28869e-2dae-47f7-80dc-08a85ae60be4", "value": 39368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514281, "uuid": "e80b0a38-7488-4211-ba08-fac1fe02b9bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514281, "uuid": "9604c10b-ab7d-4032-b8e1-fc01eec43fb3", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c9aea6-44e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777589934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777589934, "uuid": "96149534-b3a6-4001-9842-be679f092b76", "comment": "Malware payload", "value": "6cc5b0227d93b8e0ad51e67344e35b0b", "object_relation": "md5", "Tag": [ { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777589934, "uuid": "ce9127ea-c2a4-422d-98fe-cc95a4386cab", "comment": "Malware payload", "value": "dbc8f17b03a11ce3c8e4b5a07a0e7dd69e7f0dc35a5867afa99f0c65c25ced61", "object_relation": "sha256", "Tag": [ { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777589934, "uuid": "65445698-970f-45ed-b7e2-cb2a2efa0ea0", "comment": "Malware payload", "value": "c72ec5d38a1136ae256770d5b4962342cc2a964a", "object_relation": "sha1", "Tag": [ { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777589934, "uuid": "e9b874d6-83c4-4701-8d67-1c3521792eee", "comment": "Malware payload", "value": "a6985bfe871a08e9068db3909b5a00df66bdb2a143ad923601129abca6a6301d73890446bb4fad82b891ed6283278f46", "object_relation": "sha3-384", "Tag": [ { "name": "EtherRAT", "colour": "#E8BF79", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777589934, "uuid": "53fb12b8-a93e-461c-ad7b-b5982ef14df1", "value": "T1F9A1AF53838512BDF68C0ECC994A209F34F1FD6A7D241288AB736DE7BC3BA945438675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777589934, "uuid": "109dd5d9-a451-442f-8707-971e04bbb8af", "value": "96:HG5Q0wFFBDnetKjBye1rjOyOyf+xDrFl2RtHhjLNaCIV19hhGn:HG5Zw9fFJOr0+xFl2XhjLNaCIVDho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777589934, "uuid": "bb41d12c-ede1-40f3-870f-5e912317cf43", "value": 4686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777589934, "uuid": "7ad8c3e6-2781-4de6-9f4c-bf2276f8127b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777589934, "uuid": "ab5ac750-3a8a-47ee-a2f6-0e1feb128b40", "value": "0edwHxEc2e.cfg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ee54b6-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535563, "uuid": "f89dfdb8-6095-4259-ba68-9752d86420e9", "comment": "Malware payload (XWorm)", "value": "70fefbd35c9caaf7d980134df48970f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535563, "uuid": "33df96bc-d78e-4231-8421-4a1f3b5561e1", "comment": "Malware payload (XWorm)", "value": "dcf94e6543a3853a7389cbc1add50cc42449a7869390cb28df140bc487ac6eb5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535563, "uuid": "26ff70ed-1ed5-4857-adf2-b5d39a074220", "comment": "Malware payload (XWorm)", "value": "75b97aeb10be0fbc8a3373fa659d7e984c9c91d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535563, "uuid": "31981c59-b480-48b1-b24f-e7c78bdd2724", "comment": "Malware payload (XWorm)", "value": "8f80113674ff02688575cca88066d0f3c38207c4bf0c6632edd9ee0e307f97719997d1576aa0475664893b1daec4454d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535563, "uuid": "9d20819e-dd0e-4245-96dd-6991942a5120", "value": "T13437235F9E0E79D8C1FC8090B1E69FF735DACD04C9E94166B163280EA18FF1946874AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535563, "uuid": "cf7537fc-ebff-445e-a678-0df6abbe16d0", "value": "49152:rvthRvthhvthlvthevthuvthIvthqvthSvthzvthcvthovthSvthnvth1vthIvt/:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535563, "uuid": "0aa0c903-f0d2-4534-ae17-b578413305ea", "value": 23424213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535563, "uuid": "b93a818c-6aab-4df8-b896-93bb7ebe75e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535563, "uuid": "6b9d47e3-e9dc-4ea2-b699-4f74395cc3e8", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d552865-4492-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1777553084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553084, "uuid": "e7eb0c0e-f1e1-44d8-b12b-b08e8c6e8b85", "comment": "Malware payload (Phorpiex)", "value": "9f8fdb6faad1969026429e5aae147a8a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553084, "uuid": "2b23b6e3-ca4c-4168-8c8f-cc2133b59fe9", "comment": "Malware payload (Phorpiex)", "value": "dd2150b2e7d6b54e6520003fb31d329dbbaea9065c375bf7cab4867f96921f49", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553084, "uuid": "00e251f3-47d4-458e-a6cf-e4728602cc8f", "comment": "Malware payload (Phorpiex)", "value": "6468132fed197293ec0a12deaff2eecc9be71deb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777553084, "uuid": "80ae4c93-13c2-406c-81f9-2b47243db101", "comment": "Malware payload (Phorpiex)", "value": "301d7ea96d397f531f6fd520f931208b34d3ea3defb36da4b3f594c54745deb03362dd08d27e85fc997fe92d62c78cd3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553084, "uuid": "8a507e18-a19d-4b5e-8f2a-7e7b9e3b3976", "value": "T1C7825B0FB8024226E1D120788263473BE97DA4B5378464D7F7D88ADD4AAC6D1F83B15F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553084, "uuid": "53de44ac-c2a2-4252-a075-9e5ce8abd20b", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553084, "uuid": "0202a55a-d5a6-4c6e-be6a-e612a431de56", "value": "192:voIAASCngTBvHVP3aueAb6JUrQQE+OL3LvleQtLQKUSfPzwSgcsLmJxTmv8U9ctH:vJIHVP3MUGPQE17v0YPF7av8U9cL+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777553084, "uuid": "f0a94259-9236-46fc-b78f-8aaaca575d65", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777553084, "uuid": "a6911500-dc16-4010-84d3-7b56030ad117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777553084, "uuid": "7407cbd2-b2df-46e1-9b3b-3ed85f34e1e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1f8ee8-44ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777592010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592010, "uuid": "2f5117a0-f68f-467a-b3e4-2c9e8ae4107d", "comment": "Malware payload", "value": "0c5e5a36bf282bc6233c48029f59fbc2", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592010, "uuid": "0854f769-19fc-4539-aa7d-cf8dc2e6c0b8", "comment": "Malware payload", "value": "debd44e30fbe40483cbb8203e5f319e163e6886ce4c63ce90eb2025a42c1d14b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592010, "uuid": "351a12dd-fbc8-4680-aa87-992c75f3fa4d", "comment": "Malware payload", "value": "eba43d25a78ea69e196f99ebaedb7662fb1fe5f1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777592010, "uuid": "ec85600b-9a67-46ef-a872-65487c8f517c", "comment": "Malware payload", "value": "5f14231f7d59aa127e7e6262b5f3e46ee9437131db7bfd2d4719a0617ba309ac86144644d37205e6263618e8c46d75b9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592010, "uuid": "a8c846be-9256-4c30-8af1-cf0fdd56ddd9", "value": "T148D311C95DDD88E49B6F242C095F5D47CA8EA123061DC9807FEE9E44BF169B131AF8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592010, "uuid": "f2cbdce1-f1b0-4983-9e39-f48efe50580f", "value": "1536:heXhv6CByetOdi9F8EoqxdN37xdN3qL/diz2kDw5tCNhWdqkbFG8:yhxtOXV+6qkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777592010, "uuid": "edf37387-4e75-4729-99ee-2c4973221bf7", "value": 137368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777592010, "uuid": "64ddd522-6ca6-4f17-b1bd-9d6d6c0cd4fa", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777592010, "uuid": "236d4247-e9ff-4914-8e9b-d9de9436fe6b", "value": "Sales_Build_Alpha_3168.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06085048-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514283, "uuid": "a0b2ab9c-b40a-4051-a18b-e88ea28b6954", "comment": "Malware payload (Mirai)", "value": "64804c59b37cacc313faffe433e2dd7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514283, "uuid": "4ad0a3d5-1765-4b16-8d65-10988949308c", "comment": "Malware payload (Mirai)", "value": "df1c079f0ad67a58dc1ddfacea40b2414c3123d52b7a866c58c6ffa23e3c95ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514283, "uuid": "608838b3-3734-43e6-be6f-8d68e84ef7f7", "comment": "Malware payload (Mirai)", "value": "079993a8d55dce0e1ea1a4c49f66f900be0ad9c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514283, "uuid": "37f90cb0-3e07-4c50-a529-a9436e8f6b85", "comment": "Malware payload (Mirai)", "value": "64a8f967eb2e4b11a0720488caf3a128485d6c65f62b9a66745512f7d158916e9846a5a32c23dee192b172cbb4f53e64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514283, "uuid": "b8d24423-7e32-454b-8bab-b1a0fdbab732", "value": "T19D54A91A2E22DF7FF66D867047B38930569872D63AE1D544F16CE60C1F6028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514283, "uuid": "e0ed60c3-bd2d-42e5-8323-b67fbf5faacc", "value": "6144:DLLoBCIvqCKmmkHuW5wo9MCVPVEb7hRARgjzks:MqCKsOI9DCljzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514283, "uuid": "0e505dc4-f261-44ca-b0b0-7733afdaa296", "value": 304680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514283, "uuid": "860ff172-f37f-4dfa-804f-d53dcf5aed11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514283, "uuid": "161bc089-ffcb-475d-acf6-294a492129a1", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2fc667-4430-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777511153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777511153, "uuid": "01df81f3-7532-4194-aa60-6af650f5375a", "comment": "Malware payload", "value": "b1a8e483d06f88294b11fd9bb77ed2b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777511153, "uuid": "7a19f0c6-c876-4ed3-9f27-ca3701eff28a", "comment": "Malware payload", "value": "e06e46d24342407c6b491440b33a7d68c5424c5e92c07906488389d347bdf8db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777511153, "uuid": "388885e4-d1ef-4a35-8084-bd4f7c385db5", "comment": "Malware payload", "value": "961805b3ac68f1d6c9674e0c46ad8c284bbb9a3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777511153, "uuid": "263588b2-26f4-4104-89c0-ac435c87870b", "comment": "Malware payload", "value": "e906d82d4aa59724067d840c4ffb6d96cd863876e1687ef920daf6af8e3025efcce37e9b1d6bdaf0d6e5fea0e21ae9d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777511153, "uuid": "e7040bae-b19b-47cd-8274-85f123b90f9b", "value": "T154347C1BB2D5697CE156C03C931B8673BA72B88A0621FDBF12E497302E57E521F2C719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777511153, "uuid": "df13c54f-eda4-4549-afc9-9a6635e891e8", "value": "5ddf479a8706f0d202a09eee865e8c7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777511153, "uuid": "2be3a25a-fd27-43d4-bc94-a1d42cf6b4b0", "value": "6144:xGOLPun8Wl5ajr9b7zRl5R+R4pxUcPN/iQdRxvvYqCaolCXJ:junfu5RQ4px5/iQdRxIqCHlCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777511153, "uuid": "0bf780e5-166f-4f9e-8409-b2e0715d4a5c", "value": 244456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777511153, "uuid": "36496ca7-e70f-49e8-9e76-c69a15976836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777511153, "uuid": "a9032dc5-1a83-483b-a46b-15d13d54694b", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d07b197-44c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777574532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574532, "uuid": "0e0d412f-9c6d-44a7-abf0-7d24d3fe5345", "comment": "Malware payload (Mirai)", "value": "de13fc7512d5d654c5a9f6d1e3691446", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574532, "uuid": "90c8e7c7-6835-4610-8f31-5023917fc208", "comment": "Malware payload (Mirai)", "value": "e08728084af4d3b151e3a8b3a459c3de927d96ba66861f4cb2ae5d0f0a78e77e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574532, "uuid": "d6acf71c-6741-41cf-a396-d2bcede09bfd", "comment": "Malware payload (Mirai)", "value": "8352a9f08615c4df6959fcb2f83f7515b164690b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574532, "uuid": "3b950c88-0145-4374-868f-42bb9d6e69e0", "comment": "Malware payload (Mirai)", "value": "3cae66304408130ec09d6879e9cf6802f2e9ceef227346c5245ec3d57c0887111b006ecc0c4af9efcb71c4e79a700e3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574532, "uuid": "fda04dd6-46d8-47ab-bde0-9d0e99e7064a", "value": "T1FF637D27C9612E29C0A9D9F0B071DFB95B23559042871FBB96A6C67C9083ECDF5063BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574532, "uuid": "e6cabfc3-5705-45b4-a0a3-228a0980e7a4", "value": "1536:8DL542WKbAzNmMhSspaGd33v5WuaCkJWl:m9RbDMhSkaGdRNaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574532, "uuid": "5c4c86d7-4e2e-498d-aab6-025a3640b253", "value": 67024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574532, "uuid": "de1a0d13-f981-4f5b-ac3d-536b7b02e5e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574532, "uuid": "1843a629-c132-4f4a-a47f-d12899fab72c", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f024998c-44b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777569651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777569651, "uuid": "94e4fbdc-55c1-41c1-b949-3d2001901fc4", "comment": "Malware payload (Mirai)", "value": "5158999e0a32719d550f62f8973760e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777569651, "uuid": "af5ac234-9921-4545-a68d-297c1f9418e8", "comment": "Malware payload (Mirai)", "value": "e257bb1a1abffc75a55e9efbc7a22d36e91b76fff686f6932cc7806a8358d30e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777569651, "uuid": "bf891879-7d4b-4b15-8199-ebe652a268f1", "comment": "Malware payload (Mirai)", "value": "eab44c912203471026d0e344c215fc41c19352e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777569651, "uuid": "fc2a4ee9-9099-49ba-875b-606592843528", "comment": "Malware payload (Mirai)", "value": "f30763bbec7c238c0fdc65895cfd59a97080a6f4c93117b86b928807614beeabf8a6885e767aacd25cbf3481be97f8db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777569651, "uuid": "561b60ad-a606-4e6d-9de3-17b1bbd91061", "value": "T1D99308C7F810EDB6F809D73B4493490AB630E3A14A821B76734B356BED7A1951837F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777569651, "uuid": "edccad05-9f4f-49d0-a377-009328132a03", "value": "1536:JD4FexmpkB6BJw88FOvZChQiyg7pjXuwF2mvzG83PAtaSRybXR+Gofh1WBgy:x4OaBJwqZZiyg7pTImr3mRybXR+GoZQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777569651, "uuid": "aee70f92-9495-46de-a18c-47c19c69b0d6", "value": 92192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777569651, "uuid": "e02cc94f-4118-40b6-b344-144d178e28a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777569651, "uuid": "6d0b1cb9-fb87-4dd4-b93e-6dea960918e5", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247dbe9a-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777531514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531514, "uuid": "dc7cd27c-a6bb-49c2-9579-25c41622201e", "comment": "Malware payload (Mirai)", "value": "310a9af81db26a0d1d789e8a406e2b84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531514, "uuid": "b39a84a6-0a4c-4dde-9ef2-fc00e5354df4", "comment": "Malware payload (Mirai)", "value": "e28f03e6915b8af6db9961e8382aa7a6ea872f40fb29d5001abe8cd1cf877894", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531514, "uuid": "a9f5be8b-2654-4a8f-9da7-c019c0efa406", "comment": "Malware payload (Mirai)", "value": "fa22924c0d951e54570c6c4d679f22ae48659f5a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531514, "uuid": "98e194b4-3104-4f21-b9fd-419eae63547a", "comment": "Malware payload (Mirai)", "value": "219a4afa5e8711d700072291710f5e87e100d5c5fac34dc82b96ac67aa54ca9caa5e62cb9ee8c9c85b59a66612651c70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531514, "uuid": "b1b4e1ba-92d4-4d51-bf53-5fbc58c09a2d", "value": "T1B7356C5AF2B370BCD167C030439FCB63A835F47A01216D7B65C4AA352D62EA01B5AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531514, "uuid": "3ef957e7-a105-4a29-a259-ff50707fbd36", "value": "24576:FsZi00dmTTVMGAtqPqsKfmUG67YtYAkF7:e000dATVMVAPqsKJGRtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531514, "uuid": "076c16ae-6757-481d-8f18-3fd51e713eb0", "value": 1074736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531514, "uuid": "d0de8777-a82c-413a-8c61-ae0b7166da76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531514, "uuid": "d2a2b5e2-768e-4f9f-947a-2db621732eef", "value": "agent-x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebfdb03-44ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777570401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570401, "uuid": "253de434-d612-43cb-b9cc-1fbf37055fb9", "comment": "Malware payload (Mirai)", "value": "f2098101cbf7463ca0e72e48bbaaa1ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570401, "uuid": "80d98aad-4c8e-485c-bec8-1eff878f6eb1", "comment": "Malware payload (Mirai)", "value": "e30808e66508295d77f4a77124853175ffdd94acede023c37ea91f5fb004fdba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570401, "uuid": "984d7cf5-bc24-4654-abff-5e66baa87608", "comment": "Malware payload (Mirai)", "value": "4201762d9d30ef2c63befdbdd559bb03b2d495f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570401, "uuid": "08d663ae-f495-4690-b593-7592a670b9d6", "comment": "Malware payload (Mirai)", "value": "fa0c72069def7f0f209659e2ca031540501c7fc341a706df1922624dead902ceda920fa33c35e34cf5224a963860419b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570401, "uuid": "ad384fc9-f91b-43fb-b5e3-8ae505395168", "value": "T16E733B22FA720C2BC4D1A57A61E30335F2F7878A24AC8A1B3DA14DDCAF7564036577E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570401, "uuid": "2c79cf1e-d23a-4809-8653-a4312fab9bf6", "value": "768:tTTkZSxYF78RIe3t5wwdGGO+N95VXDZ58tXt0/PmERk6/2R+nt0pBo2KNIgbUIEB:OgZHt6UBN95GBERkC24t00Urew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570401, "uuid": "7cb55824-4a5b-44c8-8dde-eacade97f9ff", "value": 80204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570401, "uuid": "19d0e9e9-17a9-4ad0-b09e-b91476a4dad0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570401, "uuid": "25e4b832-7ba6-482a-ab89-cb557b107a27", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363c3692-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538416, "uuid": "6f03e074-ff17-4d17-8b22-14c42d162cf8", "comment": "Malware payload (XWorm)", "value": "b5fcc306cdcc6c26c0b9df403bdbd3d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538416, "uuid": "6df89d5b-3fba-4129-a5a8-675397e87067", "comment": "Malware payload (XWorm)", "value": "e33e9e62766e79930aebf9c18e7df3dd4dc7d23558b4fb58c433bdf371654ad9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538416, "uuid": "ccffbb80-4366-4fe8-89f8-e748eac8d793", "comment": "Malware payload (XWorm)", "value": "0106c797fc736a27fdf4c14a0479e002814ef1e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538416, "uuid": "fa88d32a-841c-4800-aeed-32cc61841805", "comment": "Malware payload (XWorm)", "value": "0fcc7d833cc4a2bc8fc5b0474a73314f5d4d54238c240780ea83a7c75e56f5f1ce46b223053369e4d2901e82f863420e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538416, "uuid": "c55aabbb-52ac-43d3-a271-994299867dcb", "value": "T1EE3723208F690C7B8E2C0F38207E1E4E95E10F14319869D5D3CB3D46DBAB69B61D7B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538416, "uuid": "e45315dc-357a-40ad-9979-35282964eb04", "value": "49152:/2Jk2J22Jd2J42J22JM2JH2JG2J/2Jh2Jg2Jggj2Jd2JN2J22Ji2JRgG2J02J+2C:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538416, "uuid": "4bfff6e6-d840-488c-aaf9-4220f681f969", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538416, "uuid": "007e6121-6248-4b14-9573-d6362af242ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538416, "uuid": "99e218bf-cbb8-4782-8f80-aecb24919340", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd5ca85-4491-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777552927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777552927, "uuid": "4974efb4-cec7-4ddb-9896-8913fdd25b17", "comment": "Malware payload", "value": "791892bb584040882d06da63f344a22c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777552927, "uuid": "a577a4a5-2db6-4d88-ab57-2af1e8a095bc", "comment": "Malware payload", "value": "e41f46802dfb3a38973d3b11eb19d333184e3d396128219daedb70dd517b9daa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777552927, "uuid": "ae867443-b99f-40e9-be1e-128e073223c2", "comment": "Malware payload", "value": "7eab79a36abc3503963e8aac8390fff78402d194", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777552927, "uuid": "8a28df4d-276e-47f7-9789-fb3e1afe665e", "comment": "Malware payload", "value": "ea6d5356d55cbad0b6303f4bb5b73d096ede7fe72cc1938334e0b69eb96fdd2a21d246afa1d1ef48fe511942b8476f9c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777552927, "uuid": "9196eb1b-161e-4584-94d0-7dd5c81bcc36", "value": "T1CA138D6966817C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C596DCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777552927, "uuid": "cc5efd0e-4987-4895-a7d2-d641cd5164f9", "value": "768:br+G9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:br+jcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777552927, "uuid": "b00d5baf-3135-4b57-99db-4e69324b1153", "value": 45417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777552927, "uuid": "2032184d-dfe4-445d-9065-e7472f9b9cb8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777552927, "uuid": "37b55f18-c530-4c6f-a269-5d79638ed15e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5702c6b5-4469-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535464, "uuid": "a0546725-6645-4feb-812c-5c8d771d0bcf", "comment": "Malware payload (XWorm)", "value": "36261ab89880795775080a71d3192f31", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535464, "uuid": "d0bbd1aa-c353-4fcf-9cb4-98384df67f7f", "comment": "Malware payload (XWorm)", "value": "e5549072900a22321c499f9fef73cbc9409f5ace1f8113de9e72ca7f5208912d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535464, "uuid": "2ffef303-740f-4756-b26c-c461c9c32ce9", "comment": "Malware payload (XWorm)", "value": "e01e3c45a3e7831c18791b793b5212f45fb5d034", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535464, "uuid": "5e34affe-eb7a-4a3b-bece-e9656bf48d77", "comment": "Malware payload (XWorm)", "value": "48103c8f5fe115bad7ffd658214d3f5af22525a1331e018b493ad43607b139c930eab11ef0c8166f6e3f39d1fff654db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535464, "uuid": "3f855c4b-7c91-4202-b2fc-b8dce321cdd6", "value": "T1053723509F39C36E01FD887D76393E63692E3E4E920532B295A0D93AC43F76602257BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535464, "uuid": "d0ed6e99-3ec7-4ad0-985b-bcd592f12fd2", "value": "49152:ybgkJS6ibgkJS6abgkJS6XbgkJS6RbgkJS6YbgkJS6mbgkJS6TbgkJS6cbgkJS6h:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535464, "uuid": "71af7d2c-e9d0-4b24-a256-985290a1931f", "value": 22383679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535464, "uuid": "6389616a-7382-4b77-b60b-0409435466e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535464, "uuid": "3bbb409f-474a-4d2d-95f6-c428a6c15ecc", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da6f341-4440-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777517893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777517893, "uuid": "0b018b69-6fec-4b2b-878f-1de6c49c65cb", "comment": "Malware payload (VIPKeylogger)", "value": "b306899b906f52080ec934e01a9f7c56", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777517893, "uuid": "542b4cee-06ce-42be-95ec-518998b3445c", "comment": "Malware payload (VIPKeylogger)", "value": "e642085fbaa5df8167e9de2131cb11c13598839fdfd3480f9d668a259c0cfe12", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777517893, "uuid": "bb2d88a0-0833-48af-868b-dacb129a8e8e", "comment": "Malware payload (VIPKeylogger)", "value": "66bfdd658bf677023804dfda1900055702c3f443", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777517893, "uuid": "4de203b9-5c6e-4874-a2cf-2f7c70cc21b7", "comment": "Malware payload (VIPKeylogger)", "value": "277346c8e23453d43327145c237a33d026a267571318ef01247faa147165aa9a8905a73a19e9006bef94c44140543cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777517893, "uuid": "a05da843-c4e8-4ecf-b124-5f36345c860c", "value": "T1B8E2C5D93BDA727A032630631C1FB556F8BE9885B50D4010FAE5B8B9F86530CD16AFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777517893, "uuid": "e55cd128-4070-4875-a38c-d2167831f6c7", "value": "768:2zgFWe5dEb9qYFj0dP4zNPno53f98zP85UCNPFL/nhAGEuZw:2UFH5Cb9hOP4e5v7KCnL/iGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777517893, "uuid": "527feb32-0c2a-4d24-9745-942f82986af8", "value": 32610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777517893, "uuid": "33187afc-2dcb-4378-ac46-90948755ff23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777517893, "uuid": "2735a130-85ff-4787-b33f-934c483aa3d9", "value": "file30.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20d4f6f-44ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777564796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564796, "uuid": "5821426f-33fe-48f6-aeca-44140a4b9895", "comment": "Malware payload", "value": "b4725bd8b922a8c07f94a9d498af1a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564796, "uuid": "1a19f56e-829c-4a7c-9705-26fade667d62", "comment": "Malware payload", "value": "e78de49fdee7b4b4ff7dad796718caf15b7f82961be4d3b6db9e4fb3efb0a689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564796, "uuid": "1f5060b4-f2b3-46bd-86c9-a5af5680a074", "comment": "Malware payload", "value": "bbfbec3e3996fd1465b4c475bf2fa13dd561974a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777564796, "uuid": "163bc921-8e5c-4759-9d81-71bd7201796c", "comment": "Malware payload", "value": "c0e23ca5c14e599ddcb298e02a0fe4d8fe60b34653835a227284001e1022df8bf074baba92b183e707bcd8cf96a6431d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564796, "uuid": "a55d4a4f-8c2b-4a18-841c-426868af5c6c", "value": "T1AB4633C327AD6F38DC4F25F16A510136A9F3CC286D524D4F0F96F9273DB6A468428A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564796, "uuid": "1e2630e0-7415-44a5-a0bc-08f4499b467b", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564796, "uuid": "de893b39-7b96-4180-b46a-fcb19939cc98", "value": "98304:wZFZCrPi/qILlw+J2SLEAvAIX4/u/GpFO7aRBk+b+GH02S+sCkgS1iJ:wBfyI3cSLsFG/1m2+sCkX1iJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777564796, "uuid": "15670148-6a30-4d14-9655-8a1c3496d2f0", "value": 5741081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777564796, "uuid": "9abebdb8-2f86-4cb8-b6c4-701fcb040b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777564796, "uuid": "cad6cc13-0c69-4e51-a9e9-7d44a2243589", "value": "\u5185\u5bb9setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0051b0ab-4438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514273, "uuid": "629620d9-838b-4d1d-850b-bb92c1d3566b", "comment": "Malware payload (Mirai)", "value": "307280918c88cdb1d7c798d692798cdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514273, "uuid": "aaf3ff33-8017-4b9b-8afc-5fbc35282899", "comment": "Malware payload (Mirai)", "value": "e874bcc5611b2542867976b21562a5af81958513f3f62db1a21f98d79105f5d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514273, "uuid": "dd17ca9b-768a-4dd1-b662-038a0a45a907", "comment": "Malware payload (Mirai)", "value": "3db9ce03cf158c430034917204209cfe65543e7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514273, "uuid": "3a1c8fe4-91db-4a45-9cae-12f3464430f6", "comment": "Malware payload (Mirai)", "value": "4907ad61f542bc3fac363e087804c9c22fa45319a9c067ffb44feee69944db15f47061f166203c902619ffeafd3eae68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514273, "uuid": "9ddb6553-3a8d-45f9-93a8-8217ea6950e1", "value": "T1FE241990BA59EC32C05D1D36A7FBDB593B0329D18EA69100C460EBCCFB8B5C0BB64576", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514273, "uuid": "4b879ccc-985b-48f9-9164-06d42ed88428", "value": "3072:3bMHX/h7Qxl1SXnxkKMmdXWueb3J8VbhtAMlts6X8hgjB7nGMq/y:YHtQb+nxkKldXW3J8VHltsfOj9q/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514273, "uuid": "196cfd61-b034-4d03-b805-a1eb97bc9488", "value": 213064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514273, "uuid": "235a8a00-fc0c-4a7c-8098-83c393dd68a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514273, "uuid": "73274e4b-aa3e-44d5-b33d-beee62eaaa4b", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471ab5d9-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514822, "uuid": "a282f754-6a7d-4457-8b58-f8910424236e", "comment": "Malware payload (Mirai)", "value": "4601c5138d92e20ef3e058eac77a176b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514822, "uuid": "dff5aa9d-a9ee-40b0-b725-dab5655f5b99", "comment": "Malware payload (Mirai)", "value": "e8b75bd9e451c226a0d8b39abe63df8d31146143cde1456ba026a129241a5ffc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514822, "uuid": "c8774795-a19a-466c-84b2-510828edd709", "comment": "Malware payload (Mirai)", "value": "a5e31775e5faa1d5b5b990efe5b2622ddd01e1e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514822, "uuid": "d7037ee0-cdf1-4079-a0aa-a538077c4d6a", "comment": "Malware payload (Mirai)", "value": "da030c544b2846f02455470eb8e02e6b70971d7d96afd426bc71b78db4078482cf8703e61d7c01e97d7f0476dcccdd49", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514822, "uuid": "9b77b33b-e202-44e4-a287-7604f51cecb3", "value": "T1655194DF2300DB31960E9A4EFBF0B6B4660AB4C65ADF8E0CE980085C0EDED4C3695E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514822, "uuid": "101e5986-6661-42ba-950f-2a5cc2a1b5be", "value": "24:A12JMEWbiBkNuZvEeEnE2EhEe68bw1YJUfPwhM3e:A12JMEWbiBkNuZvvcvy48bwpwhM3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514822, "uuid": "46d546a9-1a18-4b9b-a8d6-9f1d3c932428", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514822, "uuid": "21936ca9-290a-463b-851c-f29d30614ebd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514822, "uuid": "25f20bdc-d445-4360-9a6a-fca892107453", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd9698f-44bb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777570644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570644, "uuid": "caeb03eb-880f-41c0-b898-402c9fa3bab2", "comment": "Malware payload (Mirai)", "value": "d6f91d04a6d5fd4a5bf9cdb680ad6489", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570644, "uuid": "486c0d39-ae58-49c3-bfab-7a41acfa6f70", "comment": "Malware payload (Mirai)", "value": "e8c9bffd2b89b87485e0710e931794837b33c79eeff4582f0efa41af3287af30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570644, "uuid": "d061a3f4-1f87-4cb7-ab75-7d940cfff2f3", "comment": "Malware payload (Mirai)", "value": "70086c831a7117343d42725c56c8bdbc66ae4046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570644, "uuid": "64bcb643-8aaf-4cff-91d6-0eb9ec240179", "comment": "Malware payload (Mirai)", "value": "27e08dee2399c966bb556947dfc63d1dbe4b9b8a1ff5c3470342c6cbe014dfd15e38f577641147e381ecd29512287b30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570644, "uuid": "5f881461-0183-4fb3-896b-68a2f4b36b7b", "value": "T155539E33E921AE58C95995B0B070CF749763588482871EBA59B6C3BC8087ECDF6463FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570644, "uuid": "756d7574-bfd9-47ed-b377-b566696de3e4", "value": "768:RxZVkAcAOPF1cvBKgKCTrlaI7or79LjWdZa0NdafgCoDbxo3Ot6fJwsjldFXCXaV:R+AfNKgKCgbrRjB/PnfWsjBCXa53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570644, "uuid": "708f2b60-8526-4b94-bfbe-30a2718b440f", "value": 64632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570644, "uuid": "a54f0090-6a3d-40c3-ae94-3c2ee0aef525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570644, "uuid": "d6e5571f-7ec5-444c-b95e-7f946c1b9c77", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28acc90c-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777531521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531521, "uuid": "af94b03f-01da-43eb-ad1e-904ea90dfe17", "comment": "Malware payload (Mirai)", "value": "ab57aa927b7b227bf42d64b23c01f29d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531521, "uuid": "254fea16-a608-49f3-985a-ff5fd62cb3cf", "comment": "Malware payload (Mirai)", "value": "e97e4f24ce2c18b889c795d281f06be19286581ab260800089d4c507b5549239", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531521, "uuid": "1c85b338-8bc5-4df9-b5d1-a60278dc1022", "comment": "Malware payload (Mirai)", "value": "6dce9e32ed435d2d462e9625104f80f07f1423ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531521, "uuid": "edde54e7-c167-4ad8-89f7-9eaa314f1935", "comment": "Malware payload (Mirai)", "value": "4e6cd0908856f03c5ac82f71e5c7ff29113682c5676d0bf434905209affb5c85f466bc19cdf860a2c549f1f2bfb2b12b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531521, "uuid": "26d57c47-4b64-438e-86a5-6e44db3f9d8f", "value": "T1E9F48C99EB82D4E1F56300F1024EDBF21934A02A6093FAF7FB852A1774727917F56329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531521, "uuid": "090c6e88-667a-4a63-a99f-47470657e745", "value": "12288:ozUUWEjZmEgholhp0FWPSoln2+blgECMbr4lKTtgym455EmLLWKSWGSZX:oRtHgholh2y2igECMbrX1bLWKSWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531521, "uuid": "e3ddc847-3ebc-4b28-b9bb-2a02c8a3c345", "value": 789092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531521, "uuid": "8cca9ae6-d5fc-4035-85b8-db13d3097be3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531521, "uuid": "c4de561f-37ce-4844-af05-2444b9426f18", "value": "agent-x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7132ec37-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538515, "uuid": "909858ff-e079-4201-8b3e-c5d8a4f3c966", "comment": "Malware payload (XWorm)", "value": "35538510f5e0c13fe2bee604c1e88e9b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538515, "uuid": "a9a6175a-9808-4fb1-8ab6-670a0fc9acc5", "comment": "Malware payload (XWorm)", "value": "eae6db2c14df7801cc3896b6e5411b1db680d00f4bcf290f63caa35a8e890375", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538515, "uuid": "5b4073f9-1002-4ba1-b83d-ee48136577ed", "comment": "Malware payload (XWorm)", "value": "52c700129f6333eaaabd879d5da1cfec3e9fa4d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538515, "uuid": "d7b9a904-eaa8-4280-a3d6-cb9d7a260841", "comment": "Malware payload (XWorm)", "value": "b3e5b56389d1aa34092619f31059342d75097a29d0a6f8640814281483716a5f849af0be6449cbda25fc428901d7de3e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538515, "uuid": "56f8a8e7-f10c-4e5b-9a3a-77420fbb59f9", "value": "T1622723434B36A80F4F7D334580F70A8EE5D65FC801896CDBA968F8A9B5DDF8910D24AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538515, "uuid": "99ebef38-6f59-44ad-a6ce-f5c497711cfa", "value": "49152:uqMLqRcIqMLqRcFqMLqRczqMLqRc7qMLqRcsqMLqRcKqMLqRchqMLqRcbqMLqRcL:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538515, "uuid": "b8620d7f-c619-431c-b026-23825103489c", "value": 22123556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538515, "uuid": "4b81c237-ea54-4df5-82f0-d8d055dbf23e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538515, "uuid": "6808bc23-9ba1-48d3-a796-da9667bde9ab", "value": "invoice-1645080830.pdf (53).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c278e5fd-44d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777581171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581171, "uuid": "abc2c995-bb62-4ed0-9dfa-1df15ad44be9", "comment": "Malware payload", "value": "df2c9e6751a6890a57c28ea9fba74097", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581171, "uuid": "d5f17d6f-f5c6-4f66-a1a4-2aa4ec0976ea", "comment": "Malware payload", "value": "eb48eb02bbb1fd89b1a541bdcfbfca53365a09a13c12547263c26cdc6675d875", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581171, "uuid": "d090662b-837d-45ce-9802-3ea2164b4765", "comment": "Malware payload", "value": "04c0778678bf613aad48b0e988c07993b80dcf33", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777581171, "uuid": "1dedd0ba-37ea-455b-9f49-7b6e7fc66cd0", "comment": "Malware payload", "value": "cf6e727c2bf7c68864b7ac805f1f87ea5d83d15daef6d4a2f01eda07b6727736689926331a738a437ee0b075d2277cc3", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581171, "uuid": "4e9be042-c03b-4fcb-a6b1-64089f75ffeb", "value": "T116A27C60D046439B9EA7AA43143B50947418B3C967C63C0C1BAE6B77794CD9CEC7A4FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581171, "uuid": "e7cac73d-40ca-4a46-ae7b-3db36b010768", "value": "384:lUMQgsDNU/hwjd63L/p1T86pIkUAil3PAB0QI9Nhe1WD1xogb4xqj9Tl:lUSsDNfhy/XT86wAi5IuQI14bgLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777581171, "uuid": "26a5a60a-0e93-44d1-a4d7-901c692ad426", "value": 21807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777581171, "uuid": "7ecbfbe1-a074-4c8b-bfd9-cd28b7a6c16d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777581171, "uuid": "ac2195eb-1aaa-4208-8b21-06548122c45c", "value": "agosi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef42ae1f-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535290, "uuid": "5c87259d-c8e6-411b-9cc0-64a33e772b3c", "comment": "Malware payload (XWorm)", "value": "288d8d1605ef76aa5febb37fb22393a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535290, "uuid": "d642f73f-c18f-4a5f-b65b-64f2de97d144", "comment": "Malware payload (XWorm)", "value": "eca373827334b78853b2ea4bb1b27e2767fa53259a842e685c88c8234de87620", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535290, "uuid": "497b3a22-be44-4260-9a14-75ac5b2b2999", "comment": "Malware payload (XWorm)", "value": "0254eb23f49633195aeeeabb6461bd7fd0ac8cb4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535290, "uuid": "599651dd-a58f-4984-91d0-f08d0fd128bb", "comment": "Malware payload (XWorm)", "value": "45d04f4fe6d0140476ea73168cd4438dfb29f7220235f430abc9cb8930204372efde004e526e0642112443a21c35d9d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535290, "uuid": "d2de855d-f9f1-439a-8df7-81abd0764a21", "value": "T1443723021F76B80A4E5C3E8C15BF08D568D6ABDC8D95763ABBE6FCC4A50BB40705F588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535290, "uuid": "3267a25a-cbb7-4c19-a3d9-850c52b3dc2e", "value": "49152:cm5Fkavm5FkaOm5Fkafm5FkaZm5Fkaum5Fkawm5FkaXm5Fkaem5FkaRm5Fkahm54:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535290, "uuid": "04425d40-3f95-4c9b-aa91-80c0b5673376", "value": 23164066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535290, "uuid": "819e84bf-f791-44c8-88e7-f2db52c705f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535290, "uuid": "05dcf3b7-8123-463f-a594-4cf62b39400a", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4816210-44a4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777560988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560988, "uuid": "ba1e5f3d-d78c-4ad4-9fbe-fce028771c76", "comment": "Malware payload (AgentTesla)", "value": "6e9fb74eb43a7854ade9ba8d6128e952", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560988, "uuid": "59416d30-5a40-4472-b84b-041d312a0272", "comment": "Malware payload (AgentTesla)", "value": "ecf3df65f1cedcfb6f99eec87b5182b1f3a83cf0c68427cd3a99cf45e4c42c12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560988, "uuid": "553306b1-4e59-4324-805a-8d200ca79da6", "comment": "Malware payload (AgentTesla)", "value": "3deb281d6aba26f177d30bd8654301c6953541dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777560988, "uuid": "896a8557-e9e6-4ff3-8137-e3b3ff0dc983", "comment": "Malware payload (AgentTesla)", "value": "0bae5149bb576fe7a3b888b4c589b0c6db1b44c2736827dcf992d2df69a3444c56f1ca0a7ee067593b4adcb6c09712bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560988, "uuid": "88146dca-438b-4d87-a8cc-8edc9b79e591", "value": "T19F352380AFAA9F7FCD31C31AF2FB950447794302DC8DAC8713AB55829FB2759641487A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560988, "uuid": "075c056e-a627-4940-9b67-e17937a9f827", "value": "24576:oJaxM6r0QjdCN7octo3OswEDy0v1DCJbL4FifnACpj:wPdjtMOumGgoI/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777560988, "uuid": "199de1e2-b9eb-4e7f-99b8-f84ffdb902b8", "value": 1061056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777560988, "uuid": "a902bb11-9a6c-4d91-bbbe-668c1bc5e72d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777560988, "uuid": "67456df4-39c0-4412-a6ef-5e70c94cd765", "value": "ps_hOPsODWIDoNG_1777557350732.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8126f3fd-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514919, "uuid": "45722acf-2a4f-4117-b02b-61f21ee77fde", "comment": "Malware payload (Mirai)", "value": "1abdce6d837ca9fe6d7135cf0cb1946f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514919, "uuid": "acd8830a-18ad-4aa0-9fd5-af4c65044c29", "comment": "Malware payload (Mirai)", "value": "edaa0a1753aa63333b05dcf5915b03111af53e4e10895c663f0bac9026c6cd95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514919, "uuid": "db07dec7-2c31-46be-9c8a-a4defd110021", "comment": "Malware payload (Mirai)", "value": "1c96cbf4af839c856fe4118b8ee7eff6273a2f19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514919, "uuid": "88d7e8b9-9a3d-42ba-96d9-f7e1674800e6", "comment": "Malware payload (Mirai)", "value": "33a06da1687a989aeb92e1f3b5d3829cab9db86449f6d6c11e024ceb7ce5e5118a95b45380a78a4fdb0c80e571ef46fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514919, "uuid": "f024d4e7-2167-420e-9233-bbe2fa7d3642", "value": "T181D35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514919, "uuid": "185102d6-b0b0-4994-a822-9aa25c935035", "value": "3072:lAFWsh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YTc:yssqf/3iPcgrerAl8fEtHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514919, "uuid": "01fa0cf0-f2f3-410a-9170-4ad815293aaf", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514919, "uuid": "acf3be31-c6de-47b5-a6cf-97df23cddeb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514919, "uuid": "82886dfc-e33c-4714-a708-319c7233b4aa", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487e8e0b-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514824, "uuid": "653b372f-e1e2-4d6f-b762-3dc2b9ac9e75", "comment": "Malware payload (Mirai)", "value": "39d920149a62880b65edf085f4bd7959", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514824, "uuid": "53d7e35f-9448-497d-a71c-fdd091dbb2f5", "comment": "Malware payload (Mirai)", "value": "edd1b8c46dc9326f732f640ac1f678d15a3072ad2a0f90b3811759509072ae92", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514824, "uuid": "5319f0dc-9f62-4648-b8cc-a80c13271cc1", "comment": "Malware payload (Mirai)", "value": "ddaff567aaed957ee1387c37c396ee9fbaeaa78c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514824, "uuid": "00b5d3b9-afb2-47f6-86c4-fbf3c2ebc943", "comment": "Malware payload (Mirai)", "value": "ebd8a9f0386dd1fc54d5cefa35c5ef11fcc3775877a07bd6197f8f08c76defc790b8e3caadc70e118cd51f021192fb19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514824, "uuid": "12722d84-02d5-4420-91db-bbcf03951468", "value": "T1683185DE3304A734910D5A4DB7DD75706F0BE5C1AAED8F09978808AA4ECEE0C69E4F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514824, "uuid": "ba1af9b3-aec7-46bc-b207-b63369a72287", "value": "12:Zd4v+8d7RmRFZRc+8dq5RcI+8dmiAo+8dJEfEa7EIEH+8dUn+8dDXAwE+8duMH+F:cUJh5iRiDEfE2E5uXFXU4fMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514824, "uuid": "e54ac048-46de-45af-9b2b-6153cebf4c45", "value": 1745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514824, "uuid": "c71ad7f2-134f-4e30-9144-07ccf67ac521", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514824, "uuid": "897387be-270e-4ad2-8b5d-70b06b0aa6f0", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a624be-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565097, "uuid": "f65f8bcf-6b2e-4c9b-9170-84ebac075a2e", "comment": "Malware payload (Mirai)", "value": "c74701eaa2e092f7ff88c4327849d884", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565097, "uuid": "289dd872-1107-432f-b3f4-0a207c9f1051", "comment": "Malware payload (Mirai)", "value": "ee44706afa0441f567e95a7984e72cb1143d87e3936b21b56150bb1933dedeaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565097, "uuid": "eb91f6d6-0ee5-42ca-99f0-bc827533e117", "comment": "Malware payload (Mirai)", "value": "1396003f381f0245c01967ae2acd2b700ec07bb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565097, "uuid": "a9ce9964-c499-4d1e-afe4-be19a539baa3", "comment": "Malware payload (Mirai)", "value": "625864861e4a12ce8c66d1a84d0a49d8e45fd054a73b278a375c2342d7eda500de483f48856cca60788182171620a287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565097, "uuid": "4d23d94f-9e4f-47c2-a1b5-18aca3e5f18a", "value": "T198D43955F880DFA2C6C12976F65D86A873174B79C3EB720689254B343BE786B0F3B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565097, "uuid": "1d6663d8-d7ab-4137-b1de-f8f532079032", "value": "12288:BDpY9o4Xztaco6Xtkm+gO92AIVynW+4gpkltah:XY9o4htZ+gK2AIonW5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565097, "uuid": "a52f9833-d5e4-44b2-a058-607ecdd99be9", "value": 607568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565097, "uuid": "519a2296-53c7-472c-b3ed-98a289677827", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565097, "uuid": "dbb2398f-d597-4a28-a70f-8be06a152733", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc51ab0f-44c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777574289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574289, "uuid": "9323d759-ea15-456e-ac5b-d8586f110293", "comment": "Malware payload (Mirai)", "value": "2a5e15b76b42bf758c3af7c7da26e959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574289, "uuid": "01379a5a-bfc7-4b7a-af7b-4b7208aa7c74", "comment": "Malware payload (Mirai)", "value": "f04aad790e7fb7b3cb006f30f74862e0045f12705721db8f044099356b2cb84a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574289, "uuid": "f695cb5b-2bbb-4297-98df-c4ab55b494be", "comment": "Malware payload (Mirai)", "value": "b466229374326c493eb64dcc1a7ec8845979e419", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777574289, "uuid": "42b69e18-b205-406b-82e5-117bec5d54a9", "comment": "Malware payload (Mirai)", "value": "9d8edeb63aacd4bd32eab1a5fba46fd7651b3ba75acf3cb77f3f3c2865641859e1619d71a63c3f9509c02bfeff21d77f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574289, "uuid": "76c97cf8-34f0-4677-a287-0f1eeea47ffd", "value": "T118636E03F68090FDC8D6C1B49BAFA229E933F56E5174B25E17C8ED222E2DE116E5D700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574289, "uuid": "55d21a77-d3ba-4395-ac25-3130d4c708b5", "value": "1536:B/YS0yMAdSvEehDhDmxJW3LGGm8LP34D5d6SAqq3ypYRu:VYPyH4dh9qxY3L9HPU5sqGtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777574289, "uuid": "9bede977-b986-4c25-9d4f-3bba01349201", "value": 72456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777574289, "uuid": "b2548da2-f77d-41d7-97af-15a3a06946ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777574289, "uuid": "9041c9bf-3b7a-411f-884d-4c59a822deb8", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c61ff8-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535274, "uuid": "049a6336-22f0-48be-a0c0-7a88143b03ff", "comment": "Malware payload (XWorm)", "value": "abb72474d9162e12fef9507e3ef960a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535274, "uuid": "5283f5bc-a721-4b2f-802a-4a94b46e1c3e", "comment": "Malware payload (XWorm)", "value": "f064c1d673fab2a370852a7cd8992f4ef936e13db0ded595c976b98d3e7fd543", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535274, "uuid": "b79851a1-ff8a-4272-9775-b16ea045b808", "comment": "Malware payload (XWorm)", "value": "f35f03b4c397ab431cd6fbb1c4adde96d1551b54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535274, "uuid": "ac9adcf1-e8c2-4b24-985b-eb8922ed6775", "comment": "Malware payload (XWorm)", "value": "3388861c1ea3bc1f22db4e655c5b60270568fd09871aaf1328a7be6492c4310da8b21d0e9acf04ccb39b8f04ae95daa7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535274, "uuid": "c85d19c0-25e1-4517-8881-13a3b8d39281", "value": "T1152723818F6E3B8795BD389518650F8A3F91CD4000A42A5423A5FD8FDBDBA27217F4DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535274, "uuid": "19f1b2da-90c9-4bb5-b432-37515afadbd1", "value": "49152:JDxfT6Avthp7y8Lm/0TRB88LmMzWKyK07vI0+K278Lmg8LmY7SU8LmbwnqPcEp5I:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535274, "uuid": "f1bb673c-2906-4051-aa5d-42002b329e9d", "value": 21863415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535274, "uuid": "da7cdbb3-d396-40aa-a7b3-1d0cdee31836", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535274, "uuid": "6d14c640-5fd0-4789-b42a-088ef1162ee5", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff72bf5d-4468-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777535317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535317, "uuid": "3fd0db1e-696a-495c-8be2-1fc3b47a6768", "comment": "Malware payload (XWorm)", "value": "2245553f07cd0cdbb0ed53d910182897", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535317, "uuid": "a96f4055-0837-4f40-bd05-8e23159dd209", "comment": "Malware payload (XWorm)", "value": "f08819ba34ecc882000c18ad244887b116f5ea46d7b8f56835f21c96e45f18c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535317, "uuid": "2e017812-d4e5-449d-bf2a-6d90efc53ff9", "comment": "Malware payload (XWorm)", "value": "71172ce87aab90b415e97e3893b62c6041460ef5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777535317, "uuid": "899e3889-de2f-46e1-8dc2-bd8b2dc39003", "comment": "Malware payload (XWorm)", "value": "1616af963c40182e9b771d9cc834df69d9d7483f4fdc6b31f3b2165fc010d4bb3a5ab4ea521b6abec5c0e18ed66be771", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535317, "uuid": "5e0ca7e8-dcfb-4a2b-b23c-deb107aee358", "value": "T10A37234B5AAD5E7F92182F50093D9FAF35668CB08519F8CD3F99FCD40BE1720207A689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535317, "uuid": "4adf9cab-8cd5-4d62-8851-33c9adb17d5a", "value": "49152:/WJnLVWJnL+WJnLwWJnLkWJnLXWJnLFWJnLrWJnL+WJnL6WJnLpWJnLUWJnLO0Ys:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777535317, "uuid": "62206258-d3f7-4825-8bbd-b7bc6e55f494", "value": 23424208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777535317, "uuid": "99b20978-85de-4b9a-a6da-f3100a529547", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777535317, "uuid": "34fc207d-2196-4ada-8876-db3b8bdd9de9", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58461d34-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538473, "uuid": "816fd58e-d568-4f4f-823c-ff9bc320eca5", "comment": "Malware payload (XWorm)", "value": "e210754a601986d1d459b41ef572594c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538473, "uuid": "d2ed8886-fc93-4dc3-bf92-ad6773f461a4", "comment": "Malware payload (XWorm)", "value": "f1ff6f3159229527e78f58287197875132332a407a3eb8bebb056a63896c56cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538473, "uuid": "43c76e67-4662-4636-9db7-1927e5cb5f74", "comment": "Malware payload (XWorm)", "value": "bac704e1ec15a7dcafbaf876fe945761c6f4cd2e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538473, "uuid": "7ca05332-cdf0-4425-b748-724fbea1c45d", "comment": "Malware payload (XWorm)", "value": "e84c4bcf15beb43b851d38dfa028594e44a6596b500089135eb5c9dd4a988f1b6fae65b1035122cd2f209c127a672d47", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538473, "uuid": "a712449e-6d3e-427e-b40e-57fcb6f849a5", "value": "T18437230207E8AEAC4CD9706820FD07DEA6A9C7CB04BE59CF92AB55153E4FC5DA01356F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538473, "uuid": "e17e4b79-dc3e-4b33-b43e-3453ece0328c", "value": "49152:JFCFmFNFcF0FGFqFBF3F4FXFdz3fHpNFfFPF+FyFiz3fHpuFYFNFBFXFHFZF1FI9:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538473, "uuid": "bb368a6a-fcb2-47f5-bbab-adb69fae889e", "value": 22903942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538473, "uuid": "6b710b1d-4a6e-4674-9b4a-b34eab46d519", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538473, "uuid": "da31cc47-a3c4-4012-8d89-47f89ec323ab", "value": "invoice-1645080830.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe5c7db-44bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777571342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571342, "uuid": "663145e7-d4d2-493b-b657-a687cabfe933", "comment": "Malware payload", "value": "53da8e7c00b9988b7a721d8d4d10b25b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571342, "uuid": "7c0059cf-d6b6-4c0f-9c54-9c2a4be2c08f", "comment": "Malware payload", "value": "f22693623eb7dcfe1143d010803f50ed0ec085728ad3a35c695a744c378caf6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571342, "uuid": "ee64cc0b-d20f-4e6a-bcde-9d7133a629b2", "comment": "Malware payload", "value": "a576c0ed3d1a9d14b1eeea2f9a4f46d72d6ff760", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777571342, "uuid": "91501f55-716c-473c-ba7e-b9c6b03e2049", "comment": "Malware payload", "value": "0f570a208cae19989c974ba88ecf615665cdc1a0f672b06a5ac74bbd7923c3aefbb9410eeb6ab374e6a29c3b4f821d62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571342, "uuid": "3f6bb169-7c1e-48cb-ab0c-656bdd609b05", "value": "T1A3730996BD429B12C6C2557BFB6E438C772B0368E2FA3203DE259F21378755A0E3B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571342, "uuid": "619201a6-0bdf-4f47-97f1-c4b1e6181600", "value": "1536:qjIClAyu6emzxhOveiGZqQATpWvc6/pvGTP:q8vyuezTbzIGUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777571342, "uuid": "7e450bda-1d1f-4731-b54b-059de9e94660", "value": 75160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777571342, "uuid": "5f68c30e-87a9-401c-807c-95d1d4403656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777571342, "uuid": "8651afad-1cfa-435b-a4e9-a6056bb84500", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00f5fb4-448c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777550700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550700, "uuid": "730b0b02-fb2e-4e13-8bd1-0833c26c801e", "comment": "Malware payload", "value": "35a1fdec61e9bf7beb47e16980a9e801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550700, "uuid": "0c96efca-d2f4-4b93-b225-ae438f25295f", "comment": "Malware payload", "value": "f28bf394280cd1e7785fa5721d0bf49b79184587379a460b77e907d41d65afb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550700, "uuid": "f846d9e6-9624-418d-8ec9-b89139155bd1", "comment": "Malware payload", "value": "7cde2fa325a475989abd3adc08df7f03e84fde35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550700, "uuid": "9750fe68-896a-44ff-893c-09fac54173d1", "comment": "Malware payload", "value": "86cc05ead6867dfd38539113f47ea8725b1845194416b3554e27853dc2e1c2401f16c93108079856c4c76408a3b25fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550700, "uuid": "05fb5874-e388-4f5b-9f93-4ac0f6da8703", "value": "T120843238AEEA4019B1B3EF14AFE47493E96FBB63370E985C10D1034A4623945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550700, "uuid": "f75c321a-b0ee-4a38-a149-3ddaf6806a87", "value": "12288:eX6uTAGswMc9qlU2CPqOmfNCgVBEeWYuXlWkk0ir:l69W/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550700, "uuid": "858967e0-714d-4f1b-bd40-c098afb06ab2", "value": 405918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550700, "uuid": "01282c94-9fc0-4015-bb5d-30ec79887c50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550700, "uuid": "167daef4-bde3-4fde-afa1-5de81046087a", "value": "shipping docs 343210949.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5342c410-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538464, "uuid": "4445ac86-4e13-4607-9098-2e2e97dfb599", "comment": "Malware payload (XWorm)", "value": "31a14e2e927e34f2c9301d1b97029006", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538464, "uuid": "7c7fb683-3c62-4b69-93d9-87fdc008cf8e", "comment": "Malware payload (XWorm)", "value": "f4837f730cee26e62fec24ba75246616519320a990c4116e1e5055e8724a7a18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538464, "uuid": "2bb7430b-9edb-4a81-96a0-559b4e543842", "comment": "Malware payload (XWorm)", "value": "977bc6ad09b5a0ac973609912ad29a24e4d6af6b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538464, "uuid": "16b32fdb-f5a6-4ad8-8bad-9ff3ca1b61ca", "comment": "Malware payload (XWorm)", "value": "92f5bf9518ebbf9b3f8c33c0067b4ec022f0f3fe150e3469de97361bde0b6909c5f3a6f3ef7cc12cc316d55d9a8c4be6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538464, "uuid": "c17e42de-f98b-4d94-95a3-b2b7e26353b2", "value": "T19537235D4FBA0CFA61749389CDDD0E1AA7DA9C110124A1D16FCE38DEC98CF1D620FA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538464, "uuid": "e07f3eaf-7231-4381-bb29-26e583599b5b", "value": "49152:3IC4ICCICrICbICaICUICtIC2ICtIC/ICsICdHAUxICXICBIC2ICmICzHAUiICIj:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538464, "uuid": "b97eb427-3383-47a0-8d51-d7bf9170819a", "value": 23684323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538464, "uuid": "2b1ee6bf-b83b-47db-8012-0bcc9ae7864d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538464, "uuid": "14bdadf8-1281-4667-b6d8-da9b655f9d16", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a575be96-446c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777536884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536884, "uuid": "52e5caa7-d353-41a3-ab6d-81b3acaa6fb3", "comment": "Malware payload (XWorm)", "value": "57ca62c38976b668b46c1bd686912aa3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536884, "uuid": "7aca3b53-d299-4d23-a53e-1af1d92009e9", "comment": "Malware payload (XWorm)", "value": "f6bc1f2180fef645035e39593f0126ccbb2a11bcd9b8e6a85406956fbacbfb3f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536884, "uuid": "7aa8ca49-3084-4955-894e-f89787fe96a4", "comment": "Malware payload (XWorm)", "value": "4249f9e34bd7a039236d3bbdf83a2224828307b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777536884, "uuid": "50742c08-48b7-4278-8ce7-9de1976c20f8", "comment": "Malware payload (XWorm)", "value": "c6985254052bd0ce9e9893af44f11537e7db8cbabb649635c36c07cdfbd4b0a7e793379005d827ae68da8931a25e88f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536884, "uuid": "41756081-35c8-4fef-b77a-c2a46069c22d", "value": "T1D43723079F341BAD090A116409AD0F4B4EF9CF44C830B78A7EE665EEE685C4F95F724A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536884, "uuid": "5b0147c4-3e14-408e-86a8-41bcf5fab8a8", "value": "49152:IgHOL8ygHOL8WgHOL8hgHOL8hgHOL8igHOL8wgHOL8igHOL8ugHOL8ngHOL8UgHl:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777536884, "uuid": "466d00bf-b73f-45d1-adeb-dee108156329", "value": 22643809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777536884, "uuid": "2dfabcf4-e47c-4dd7-b44f-906b7c350f01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777536884, "uuid": "911b8284-2b0a-4123-a4f4-671b9c15d02a", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d99ab5-4447-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777520727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520727, "uuid": "5d178755-830d-48f4-aa7f-bbaca10d6b72", "comment": "Malware payload (DCRat)", "value": "1cf1bc252959bd49856439423f1fb17e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520727, "uuid": "d7a16fc6-022b-4bed-a9ee-8fa7196b4ec7", "comment": "Malware payload (DCRat)", "value": "f6c1c1181b5c2f5a0f55544b9252c7ebe9102456c8307ef883cd201b0f840711", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520727, "uuid": "5ee6e1ed-fa73-4255-8cc4-6a9e872f7147", "comment": "Malware payload (DCRat)", "value": "b432403a8129cdf5b579e56fa744479683581a29", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520727, "uuid": "7b4410e5-9093-45a9-878a-1a64cd2d0cc4", "comment": "Malware payload (DCRat)", "value": "bbd41dbe202780fc5125cfd0e8be81c6300b66349445d6e1895e46a92c0a0abb82e36958cec6fd0fe7338ad26b7c221d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520727, "uuid": "ab9dced4-f55f-4db7-97d3-5e54925f3c60", "value": "T144D47D5637F86521F1BF5B39E4F569A987B1B8527AA2EB0F448103D91E23B00DC80B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520727, "uuid": "d33f8e45-0ccb-4887-8a22-91e264d8786d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520727, "uuid": "1a5a8ce2-029b-4ab3-b44e-d9f24fb72a9b", "value": "12288:TqnOm3Yx8DHoPDZKGdXdsXEJiY6L6/prI+WKH:T+OmRoPwJ0JiF+/51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777520727, "uuid": "a6168a0d-c43e-451e-bc11-4aa592ced7a6", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777520727, "uuid": "62c10334-13bf-4bf9-b047-fd7136d5beb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520727, "uuid": "7a14f4b0-af6c-4fa9-8d7c-d5d22a537eba", "value": "1cf1bc252959bd49856439423f1fb17e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b999887-4470-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777538452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538452, "uuid": "00d15120-0af2-420b-b8e7-11bb45642e6e", "comment": "Malware payload (XWorm)", "value": "f26dab46564ff20ac19087b357cc36f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538452, "uuid": "99fba38a-1efb-4723-b884-a3919ef0ebef", "comment": "Malware payload (XWorm)", "value": "f6f790d58a6239c1a43d28c8a4c5ba597d247debaa9a7a977ec2bf31ab7cac5c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538452, "uuid": "2a5c0fd3-1c26-4e6b-acb2-37baa5e2155f", "comment": "Malware payload (XWorm)", "value": "d73040169f2628c30ac8a167b4bde5a821781f16", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777538452, "uuid": "45e8d0d6-f58a-49e8-8559-5c9bebc8ff00", "comment": "Malware payload (XWorm)", "value": "7fa94bb06ab16bf4e29585d3f9cad3baf7d648c1f322f3af6bd38929c6b69e39a417a45b60896181ba17b25e5e6c2f23", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538452, "uuid": "1ef213dd-917a-4dcd-b7f6-2d94fbf8811e", "value": "T168372343DF0C4B3AAB5DB96C35665F4D298D5E80A0483E81536DDE2F8768F1337AA09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538452, "uuid": "c9c12b1b-281d-42d3-9cc0-3bc5b097e517", "value": "24576:zi4bf4GhuFi4bf4GhuTi4bf4GhuPi4bf4Ghuii4bf4Ghuwi4bf4GhuWi4bf4Ghu7:ZMA8Dgp0qpY/7YD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777538452, "uuid": "45e72b49-3be9-4979-bff5-35d749a99ded", "value": 22903947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777538452, "uuid": "cb51230a-3c94-4b5d-a7cf-89b17b88d3a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777538452, "uuid": "93bb865e-a764-448f-a0fb-fc2648692cf7", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247cc27d-4460-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777531514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531514, "uuid": "848b50f3-1a72-4617-9baf-0de56d49a56e", "comment": "Malware payload", "value": "41a83713f28523de30aede5a047c8daa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531514, "uuid": "13ad78ef-bfd0-4435-9452-349c57a866fc", "comment": "Malware payload", "value": "f8cbacc7056db1d30ac0a0f35197c8eb5757b2960bbb9c6e33b2801a6bddba88", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531514, "uuid": "daf29df3-ac1f-41cf-8d76-5dcb478d0713", "comment": "Malware payload", "value": "cee11d4440f6e20ac1ea744f121ce632dcd53ea8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531514, "uuid": "19d75e69-cfc6-44a1-82a4-65300c4c8fc3", "comment": "Malware payload", "value": "52a214f29188defd11251d814000df2c22d524dc7063b6f3c448e315a74842e4070a0ea58076912172b6ee4e313f1810", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531514, "uuid": "e3a964fb-c4e9-4e29-956c-a708b1d87d85", "value": "T14303F81BF291DC7DC4C4DB31CB9FD2229230B094A632152F3F44677A2D96B750A7EA26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531514, "uuid": "64a02030-6c98-46e2-90ab-4d766a3fe459", "value": "768:2QV1lLD7zrjbTLD7zrjbpBLDuGe2Om+WuGe2Om+WuGe2Om+WuGe2Om+WZhJR5Bp2:JXWG/tbL12zzs4C5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531514, "uuid": "da83331b-90b9-44bb-a6aa-6a5cff69f4d0", "value": 39056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531514, "uuid": "c0079eea-092d-479b-a234-3368d7b3818e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531514, "uuid": "10032d1f-67aa-42bc-b4bc-a6857fc9a0d6", "value": "agent-x64-test2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258124ef-4460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777531516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531516, "uuid": "0d346e0f-9bad-4a7c-ae30-3586d9aee320", "comment": "Malware payload (Mirai)", "value": "81726e1e9575b95ccbb448fc6cc564e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531516, "uuid": "f51a94ab-83d7-4774-a085-0261b9bfb58d", "comment": "Malware payload (Mirai)", "value": "fa558840edbfba0e9dce730623c01ddb37d3fd720199d1b172a6186c1c1bc8f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531516, "uuid": "6b2e0d88-7c97-40a5-a835-a4c7bcf052da", "comment": "Malware payload (Mirai)", "value": "2affa55aad152461fab122302d5ff61c6149b344", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777531516, "uuid": "997071e3-54f8-4437-a5e5-4de9dce1834b", "comment": "Malware payload (Mirai)", "value": "c330244384aab31b04768d5786dc8d142e5b1fb41df93f0a99adc6291bab624601bd670a61c55c4440e62a3e371f6a62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531516, "uuid": "5a648c99-fd79-4ef7-9966-d8ee864b7049", "value": "T1795412D65D38C0A85C7066B012044CAB15F9374FEA2650C53AFFF0139ABEDEAD5636C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531516, "uuid": "69976fe2-56e1-40a3-bb2a-5530711de8de", "value": "6144:HQZh2ZDnRMTMD+DB4YXg0ojnrSm4xNIX3xLFjl9Pjjz/wjcZnUNh1DMG8B:NwDBvmjenxNYrlsju0Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777531516, "uuid": "8ec9434a-bfc0-4515-8719-a4efe8cd9040", "value": 302964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777531516, "uuid": "e9ac6cf4-60fc-4c15-9ed2-ea938036199a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777531516, "uuid": "bdd07d20-4232-41e6-9148-134d84235096", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f460665-44ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777570160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570160, "uuid": "05144f83-4030-46e1-b767-efe24fc52194", "comment": "Malware payload (Mirai)", "value": "8a9df5d993292326c5a9816bdf7468dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570160, "uuid": "ba6228e2-7a4b-4b38-bc74-c3530e8cf5c2", "comment": "Malware payload (Mirai)", "value": "fa78ec177f1a4df84481b652d1bc01c5b4b86d798f1bda4a6eb350ef803ad230", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570160, "uuid": "d8422b57-69d5-4edc-ac98-305ce873898e", "comment": "Malware payload (Mirai)", "value": "2959778565cb7486164424ad2ea1acd6f7feb7a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570160, "uuid": "50696c0b-109c-4904-9fa4-292db8185461", "comment": "Malware payload (Mirai)", "value": "9a7476ee9b575f935420af63cca1b17fc81095be7962102a1faf517a7101ae5ef56474f08f0deeb41a9296c5c082f5f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570160, "uuid": "b2ed71e1-2a8e-4443-9de5-6d1299ef8d2c", "value": "T14BF2F1502198E47FD188C73E0CFBCF2E62A274BD4857949B3762BA8BC58512097F468D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570160, "uuid": "b6c99263-0473-435b-8737-d0aead0c0831", "value": "768:ROjv5IeV2FHAd1W/ELvrVJwfbTvTT44VlYhcoqHUOXiOrOGbDV:RG5zcF92DVJ6TrTdYhaUOr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570160, "uuid": "9c0a01b6-be2d-40fc-ba52-2ed710f1e1a0", "value": 36036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570160, "uuid": "271e5d6e-f1a9-491b-bb7a-750ed71668a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570160, "uuid": "b19b13fa-b6c4-4ff9-9975-0f7569e6e499", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d822bf98-44b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777570041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570041, "uuid": "c30003a9-a735-49b1-a462-d11e7ef55914", "comment": "Malware payload (Mirai)", "value": "fa9711ad7005005b4586ee22a86c12e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570041, "uuid": "13afabcc-cf6a-4cfd-bf0b-0a32c1f71563", "comment": "Malware payload (Mirai)", "value": "fa922e502c135351ec085fade015147596c505e520682e431f33505ca3692116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570041, "uuid": "04084d9b-9589-4732-bb28-fc570380a766", "comment": "Malware payload (Mirai)", "value": "737d8fa647c6508cd8f143207fae0ce591ddef46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777570041, "uuid": "d7bdfa71-f3d7-4c07-88e3-3fe6aa9722f9", "comment": "Malware payload (Mirai)", "value": "d1703bcc3d74916f0f6989463c10fc9c30adccfa4d218e6c9f2d24ce199404d180a3369920205edf779b5f4a1096122d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570041, "uuid": "3f10c7f9-a63b-4898-9d7b-1920514aee4e", "value": "T1055302AF08E488D6D69EC7770C1E7A85C518C40EE77CC26AAD417B5BE55AD2CBB802D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570041, "uuid": "3daa8e04-b728-4286-b594-6ffd18fffd10", "value": "1536:4ajbmzZApHWRc0CR4hoHsWsplnouy8GykO:KZApU/CAGsp9outp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777570041, "uuid": "502eedf4-bf8f-4cbe-865a-cbe1e083d83a", "value": 65128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777570041, "uuid": "617a4601-fa54-40e4-8ff1-7337171fb0f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777570041, "uuid": "50363329-9fc4-4d51-bc43-18cc0011a5cd", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e4509a-4439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777514813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514813, "uuid": "15fc6371-b5a0-4a83-b185-19889cd7fa9b", "comment": "Malware payload (Mirai)", "value": "8455a1bd8931ca26764fe5872dbc6fbf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514813, "uuid": "1eb8af2d-ed2d-4955-b220-71d8fb715679", "comment": "Malware payload (Mirai)", "value": "fb1d850282bf32890e024b8664964c0fd3ae9d3446950e32a3b17382436ba656", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514813, "uuid": "7971092e-8cec-4b3a-8d33-0f76489204ee", "comment": "Malware payload (Mirai)", "value": "d413d4d6999b82f2b8eb00a0ed5039482f7b1966", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777514813, "uuid": "bfd6176e-01c7-45ab-b556-19f1423c5b1a", "comment": "Malware payload (Mirai)", "value": "6fc745de37deae90971e161209d840cb470e2b5c4769f29833c070e2af42fb7992993f3b81a3be38c687a0b627b8ecc5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514813, "uuid": "41307dee-07b7-4561-a55a-3ad46a82a700", "value": "T1DE73021B904F4AB3C1F99D33B0177B349B68E023E8F52B05F8919045EA1DEB72148A7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514813, "uuid": "4c0115dc-b220-4bdb-8c9f-5f43f415b08f", "value": "1536:kOlDJ9nqHLw+ZQeuFvQfPbYGiNw7VI/rW0wvnEJ3gzE94e/ohr4XForm:vpn40+ZsvaTYbeO/VwP/zE99/ohIFSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777514813, "uuid": "7e5b396c-67f9-4e23-9856-6ad9a316cc71", "value": 74732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777514813, "uuid": "0a94a61e-89b6-44c0-a922-7353e6cd200c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777514813, "uuid": "0958083f-78e8-442e-8077-2b73c5cd18f8", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a023dc-44ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777565092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565092, "uuid": "fd41f586-8ee9-4249-8287-def4056ea2c5", "comment": "Malware payload (Mirai)", "value": "3754a784ecacef46bf80d4b0f25cd129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565092, "uuid": "4885a4f9-90c4-4283-b9f9-78d4c6023e62", "comment": "Malware payload (Mirai)", "value": "fc14bd6f4413788409925057928ad1c1d74a3233543267254ff01407ee0da6d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565092, "uuid": "428288f2-cec9-403f-9de3-e24bcc73a7a6", "comment": "Malware payload (Mirai)", "value": "bf8e1bb0bf7bed4ec5b5f0bbed269304dc35f3d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777565092, "uuid": "4a08d3df-0e9e-4fac-aff2-f19967d7968c", "comment": "Malware payload (Mirai)", "value": "a47661106ebe5920c18608e501d2fb2e7f37d19a0915172c26e9d12887522e39c43c4304effd6336d8a422dd1174a338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565092, "uuid": "fcd79bc1-68fe-4df2-8e44-efd9d70d8afa", "value": "T1B8C4CF93F6705ED5C01D4AB454BED2308B89E29713877581F6FE82002C6B56ABF9FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565092, "uuid": "3e6cd986-7d0e-4f75-907a-69ac23b387bf", "value": "12288:wmqG3UsALedu3sB9quj1xLpm121VYoLRkZQpIztso:mYYLeQeqAlKoE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777565092, "uuid": "1e07ce69-d42d-4585-a4db-ce5bd1263c22", "value": 594600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777565092, "uuid": "d9cf3d4a-1fcf-4cf5-8682-1f59211cfdcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777565092, "uuid": "e8e6e2c7-5d96-43cb-82d5-4b9042d87e32", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232d6d08-448d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777550839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550839, "uuid": "c822619d-62b6-483b-b78c-b1c41ce79681", "comment": "Malware payload", "value": "0f942efb8a65fe9c39d88b292b49cb28", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550839, "uuid": "97ad720c-d989-4e35-a219-697be366cbac", "comment": "Malware payload", "value": "fc47597ee55cfb64ccd5f2fb68d21f7f089bcc2a6d72fb696cd33b89650ec4d3", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550839, "uuid": "b97b48ac-6b33-46c8-9447-b5477c883e1e", "comment": "Malware payload", "value": "8ef337a7a35ed5393ab7e727dc145ae9836d7873", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777550839, "uuid": "d2177064-0e27-4822-ba49-9c10226e8be9", "comment": "Malware payload", "value": "c8939409b8f7aed0f0ea5f6d691192aa2e68a2bbfef9c28216d6baf7668df4321c422864d8315f390cfc864d52e5397f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550839, "uuid": "fd547ac5-69ce-49b1-8ef6-b12968f793b1", "value": "T1317501D7A6D93FAAC061543A582154E3DA33AC13533639339194E53FC9231A1A62BF3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550839, "uuid": "a408ae37-4fbe-4c10-9de7-3e7114976a7d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550839, "uuid": "8f939e33-2352-4575-bc76-ef62453f3f01", "value": "49152:Kj6HHHHHHKgOxdEjHSTcpZoo2itjjzm9iomJ02NZ6l:IdEPzzmKJ02P6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777550839, "uuid": "853eb8ca-b97e-415d-8c8f-1d432b4f2887", "value": 1681680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777550839, "uuid": "a160ef9b-256b-4e98-90d5-892cea29ec55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777550839, "uuid": "2c773ed6-16c2-4138-bf99-c2becd8dd3f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af19806-44c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777573213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573213, "uuid": "8db79eea-da74-4886-8b9f-07c4735a16be", "comment": "Malware payload (Mirai)", "value": "304281e530194f270ce5451e7d3e6b90", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573213, "uuid": "26c4fb19-481f-40f9-a140-a12e6816c908", "comment": "Malware payload (Mirai)", "value": "fc6537a24d8f116e2c8da2e2b7eb50c9cd21f0480514a6a3b2ee5c6359d1779e", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573213, "uuid": "d9e35032-e02b-4f98-9f84-5d9ed46f9fdf", "comment": "Malware payload (Mirai)", "value": "be53d1a89dc90b652bc35aa5898c23a6be00528e", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777573213, "uuid": "0b016b2c-af66-4324-b11d-53c7cef37e00", "comment": "Malware payload (Mirai)", "value": "4f28c6dd07e3322ff08794eab987e08263a38506905fa99d0be302805e731bc006491af6c931473c7b6c3249baa7b9d2", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573213, "uuid": "ab805c19-a0de-4e79-b0dc-60853ed87e83", "value": "T1B8833A49F783E0F0E91605B1116BB77D9731DE116020DA2BEBD5BE76EC32A12A11B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573213, "uuid": "4f1ee8db-9047-492f-aeed-fcff4cf24cde", "value": "1536:9MHOyKY4YwGtv5ObfUt310MQrp5AdMYNRYfW+056LjcJmr:yu3PYwGtssihAzYfu56Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777573213, "uuid": "c6d2a5c8-b9cc-4f38-874b-558c468ae400", "value": 82780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777573213, "uuid": "f173e70b-e0a9-421e-bee0-4217d6ffcd48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777573213, "uuid": "f1aa6a7a-92b1-4eff-bb82-4475d8795658", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dfc9b8-448e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777551386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551386, "uuid": "f9bc0622-2122-49d5-8f85-23155fe1ca99", "comment": "Malware payload (AgentTesla)", "value": "ea04b7a7d925c6e0ef6db851977cfe99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551386, "uuid": "2d2e2bae-21a8-4614-bd4c-70c68600e772", "comment": "Malware payload (AgentTesla)", "value": "fcdc9dc5e06111118fd258963ad09191849a2033da2e892fd7b47b77325eacb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551386, "uuid": "457f83f9-e21a-449e-8692-8ce6e756cea9", "comment": "Malware payload (AgentTesla)", "value": "e17a35a66a796e16115abcfcf49e9c6ca77c447d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777551386, "uuid": "424d8135-2f49-4fb3-b6ae-219fc6b4d9ec", "comment": "Malware payload (AgentTesla)", "value": "95e26d3a27dfa7f9660b5c846d6ede81e97839832b00fbf31a873a47d11a211422d5ad562c412ffb25bf7caa54b319e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551386, "uuid": "a2e9cf3a-87d3-4396-8290-d313c76daa87", "value": "T1413533668CE9ECBEE7A4412C203ADD9D49270F6B6D0692CF75C512D21E4A34E1A07F7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551386, "uuid": "72b96e24-13a6-423a-beda-850cc75a8325", "value": "24576:iYkNiajpxaZr7o2psfXVAHGDOj9MSYxdwCogfX5:iNZQlo2p7+XlX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777551386, "uuid": "b99c5498-4975-4f43-ba13-850b524a1152", "value": 1080556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777551386, "uuid": "c158e6e8-8eaa-4c9f-8bcd-b612ccbc668d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777551386, "uuid": "196ab167-a156-417a-b5d0-a22e28ac4ace", "value": "ps_jtyDeIATCYsX_1777549472909.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a68d8f-4447-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777520721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520721, "uuid": "eecf7320-66ea-458b-a5a0-8cc3fb196608", "comment": "Malware payload (njrat)", "value": "549eed1343c9c5fe802cd263ad0f011c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520721, "uuid": "c7873ebc-9eef-483f-9613-1ccf69cdce53", "comment": "Malware payload (njrat)", "value": "fda7cc5947c3366f5156bb3ae6e1fb71977b934099c9b0ec9d762c94d94fdd8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520721, "uuid": "751c6e89-0d69-4bf4-8d6a-fa09b28666e2", "comment": "Malware payload (njrat)", "value": "e0d96221b0c3928cbefa07807e742d9f1bb64c0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777520721, "uuid": "8b50953c-bbae-4ab7-bad4-f8dc3a8a702a", "comment": "Malware payload (njrat)", "value": "1365d8e2ae4a786447b71387c7b0d146b04df6a3a28c003cb3b45dd750a180a9e689032c80d843492a45a893a989f2aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520721, "uuid": "03d1c3a2-7e43-4b17-a367-34b5ce2d2f45", "value": "T1D2E2194CB6E38154D07D44B785A6E3211774E16B5723E26FCEE968E22F671CC8A8CDE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520721, "uuid": "8fe2fe63-464b-432a-897e-f3ac2957c420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520721, "uuid": "76b7482d-ced2-4790-9d19-740fd299bbee", "value": "384:gU005Q4kW8+I4YZsi+t22CA4GZstFPI8eT+C4lDUodg9TdFpyFEIGsJjwE7UMcry:n3Lzt2AzchaouDbEEIGfRXC+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777520721, "uuid": "b0bf47d4-3869-4e81-8a7a-a6dfc0dc3ddd", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777520721, "uuid": "146eced4-a0d7-49dc-967a-65bc8240b3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777520721, "uuid": "571f393c-684d-4a56-aa57-0548f474c4af", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }