{ "Event": { "published": true, "date": "2025-10-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-10-27", "timestamp": 1761609782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "93cd9e39-dfb5-41c7-93b3-2d520026bdb6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9671b0-b32c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761566627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566627, "uuid": "fb60d399-03fb-4859-a47d-634d92c3e2c7", "comment": "Malware payload", "value": "9c55ed6e2fa14bd299f000e0d88d7b1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566627, "uuid": "3f793fd5-92cd-4ce9-800e-beffb1600d7a", "comment": "Malware payload", "value": "00b886bc6c7e621c69b7093de304460464d04d29429d1e6f0e47ec8e3ec33acc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566627, "uuid": "9ea34fba-a4a7-40c0-b02d-1367db4ade37", "comment": "Malware payload", "value": "3ca06a05e2c80a4c91ab4909dc0d4ec78e6dc229", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566627, "uuid": "59d0d91f-c392-4afd-96c4-ca7b631fdabd", "comment": "Malware payload", "value": "7ee3c0233ceb78b5d098cc0ccdfbacde55525ff72a58c9c182df20e012f88e722d358755441b0a6fa4c02aa59499ba10", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566627, "uuid": "43e4488e-3de4-4cd8-9329-ebc8f999ab2e", "value": "T1C9F028FE314083F85C14A1562A3F8928B502599116E086EDF84D98717F881C6B930E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566627, "uuid": "5d545760-20df-4644-8fde-a674506b082c", "value": "12:t9ruOyrab8bRwM0R2tSnb3yM0RDl+Fq3z5mONUq:t9ruXrag+M0R2QnTyM0RDl8q3lmQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761566627, "uuid": "faf383ca-0882-4aea-ac33-7472f35c8d8a", "value": 589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761566627, "uuid": "df8d56d6-50c2-4c35-b90f-02672a8a671c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566627, "uuid": "1c20747c-ec5b-41a4-ade6-8e942bd975b6", "value": "toto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16435108-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (AmateraStealer)", "timestamp": 1761577834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577834, "uuid": "7411aeab-01b6-411b-8956-17c64b0b99a0", "comment": "Malware payload (AmateraStealer)", "value": "054972d013598d8c67b92aa634bdef1d", "object_relation": "md5", "Tag": [ { "name": "116-203-232-38", "colour": "#BF615D", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577834, "uuid": "a0ff8936-7108-4dde-acb2-6f2cea1fa321", "comment": "Malware payload (AmateraStealer)", "value": "0152baf20a69ffecc14151a5063e07e693f63146f0a966467122b9591962b46f", "object_relation": "sha256", "Tag": [ { "name": "116-203-232-38", "colour": "#BF615D", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577834, "uuid": "c962c0e4-91db-4574-aaa2-e9a7b5fd07a4", "comment": "Malware payload (AmateraStealer)", "value": "d3ef70793d332a8dda47ef92e1cd7ab54fc677b6", "object_relation": "sha1", "Tag": [ { "name": "116-203-232-38", "colour": "#BF615D", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577834, "uuid": "58d7645c-a7b4-44ee-972d-99f5147cdd4f", "comment": "Malware payload (AmateraStealer)", "value": "165ec53f8495d7ffa601fde423a72d231f1b7b57a55facb316ec3d00a7883ffed03539bca19bd4f7091001f6ec466fdb", "object_relation": "sha3-384", "Tag": [ { "name": "116-203-232-38", "colour": "#BF615D", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577834, "uuid": "ed4bd1d2-4404-4915-abe5-7fc160db011e", "value": "T151A5E6067AA0C875D067D2358DB742813635B8780B3333C3EA527279EEBE6E85B76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577834, "uuid": "cbf98a45-9d8b-4156-a9fe-d7f82603576f", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577834, "uuid": "0566ead6-fc83-49dd-9aa6-9ca2a1a05580", "value": "24576:iuiiMFDR1lU1WXo0oN0VXTqGBW3M1EZrwgew:iNiKDR19oxNwXTqAgew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577834, "uuid": "a2acc59d-69a5-4ee8-b322-4b6db3e7d98a", "value": 2238820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577834, "uuid": "98be9e4d-a66b-4314-9d75-23c87c86f011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577834, "uuid": "16e56c28-a3d1-4ecf-8513-25b3536cfe88", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dd1c89-b368-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1761592388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592388, "uuid": "b2c98d0c-5e24-41c9-8ed7-37468d734c33", "comment": "Malware payload (GuLoader)", "value": "b14f9c657a6b1a4df51e6160e73b66d3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592388, "uuid": "4f234cc5-b7f8-406e-9773-24f4db27e5d1", "comment": "Malware payload (GuLoader)", "value": "020328abd57f3081ea59bf05b767311cdbe51f4fa835519bba8380ec1a1c33e7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592388, "uuid": "9a5d8d60-c3c2-4c51-85a4-e349b52b730c", "comment": "Malware payload (GuLoader)", "value": "8716dd5091880196caef99a48463650877f2e3f4", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592388, "uuid": "4f7c2cc5-dac6-40f8-8955-3665fcbecab0", "comment": "Malware payload (GuLoader)", "value": "73ab67546599cadd4ad5dc4065504af6142a1285ff901e0ffddf93d2918c345bb39008402e6e6b1220e1579badb39592", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592388, "uuid": "7516ea39-0b96-4988-80f1-794f54c4d82b", "value": "T1AD5423501DA89C2FE80C6E88A1D317FA8776E5DB7D45B20917AD4C13383D4EB1BE990E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592388, "uuid": "55c7a727-63fc-469d-b237-b23dec36dc67", "value": "6144:UztmX+7G0ONa8JCrKWjgfbLQJS43gvE7aUoIhOIIfaw:cmXbNTfbLy3gvE7lfOIIfaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592388, "uuid": "4912331e-8d18-4293-9511-c7f98f4890a8", "value": 296671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592388, "uuid": "9fce608b-9faf-4c9e-9f51-f8391879fc82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592388, "uuid": "662d6904-8ff4-431f-b745-91220355ff40", "value": "swift copy payment 22 oct.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3c773a-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595670, "uuid": "8af04744-f0b7-48a2-84c7-54f1b4994cc3", "comment": "Malware payload", "value": "9b1537448c083712ca567c36ebf5e7f3", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595670, "uuid": "fd5bc2d0-33e2-4ba0-b5cf-699f70dda4e9", "comment": "Malware payload", "value": "031544b693c117c6e848c8327da5af1f4e8c0457a60b43d6e3079feadff22c47", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595670, "uuid": "660e9391-5c34-4819-a57d-52c11b6958a9", "comment": "Malware payload", "value": "59ee584318075e46bef5217c55156e5da446b306", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595670, "uuid": "8e8dfca7-22cb-4487-a25c-46c5c047ddac", "comment": "Malware payload", "value": "619f0c63a904b0fecc4d730aa15a4f642116ab52a7704999cdf539c321d3af0a99ad3dc3653cf3bc1a7ca98911c937a9", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595670, "uuid": "da6168fd-7a80-452b-ac1c-343b269d31fe", "value": "T1E9A2F003C20659531688BC8E164DE80B867DE023AC7C7A39D67F780FF9DC65E5473955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595670, "uuid": "8aae14bf-b521-497c-9a67-cb4e866a3334", "value": "384:WDr2PpF55+8+uiLUqSxlOoj1DY1HMnSHc3weQ3QoeMB7MGlFB3f3kaHA8:WDCxt+8V5vcCn4gTQpBph3f3kaHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595670, "uuid": "1e85dfc6-6090-4b66-bd89-d8117a61838e", "value": 22826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595670, "uuid": "e07557c4-61b9-4993-8811-2c5f4f9ed2df", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595670, "uuid": "02eb0e09-b9bc-4ab1-8be0-8bbdbd21cecd", "value": "Request for quotation-TAXC JASS-1298740040034328960866.pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4ec52d-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579136, "uuid": "40ba560f-cc9c-4a0a-a8c7-ba843f90e94f", "comment": "Malware payload (Mirai)", "value": "60bf4a811408398bcaa6c109edbccb90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579136, "uuid": "75ff8129-9b0f-42c0-8715-cb7af2b8b2b2", "comment": "Malware payload (Mirai)", "value": "0327db68fdd761ddd3d0ff73d5068740b8119c36bf69110e50ca1c13de2c4aaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579136, "uuid": "76299d18-73d3-4ddd-a82b-e0780b43aca8", "comment": "Malware payload (Mirai)", "value": "7bbd887a67271fef4218b51cc7cbec40ac6ac089", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579136, "uuid": "4fa9c540-8ffd-4ad9-b329-4f82eeba401e", "comment": "Malware payload (Mirai)", "value": "52d6fc46d43483f6ed7a40a8e1f26907417de1b16845adf7722db68d5d047b9454f23c55a62385e843c65a48505fd12e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579136, "uuid": "c09eb06e-ae3b-4534-8ee8-cb92d8f11a93", "value": "T1C9234CC5A447D9FCEC190A752177EF319AF6E93F1098D983C398AD73E942602E5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579136, "uuid": "4091d678-c9b3-4370-87c1-6d29cbf3c6cf", "value": "768:Ii+liNWE5FttdEioOs5BcbV7UzcZFWfd/0A6SDZkSyI:IiK25FttdEioOszkV7UcWV/0A6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579136, "uuid": "5b84fdf9-67c6-433a-8798-17789d0a89ed", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579136, "uuid": "2b8fe58f-b059-4704-b6e0-b8bf53e6cbfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579136, "uuid": "3b51fb3e-f315-4bce-a790-51e645ca4cc7", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5180e6c-b362-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761589697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589697, "uuid": "1b27e549-2c56-45d1-aba4-9d92f272cc84", "comment": "Malware payload", "value": "f4d7f61bf7cc6a53cb2b936272014bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589697, "uuid": "f360707f-5124-411c-ae57-254e9bb4915f", "comment": "Malware payload", "value": "042a01cb855b6bb815e686953b3a2158a45db69e31ad2d9932bf684c8af8a264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589697, "uuid": "c60c6799-7fd8-40c9-82ce-bc0c99ef19e6", "comment": "Malware payload", "value": "b485e5e8c8ada305da9ea31c8a958f158d9ef523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589697, "uuid": "b23b312f-140b-4af2-9b0b-5421fa95f2a3", "comment": "Malware payload", "value": "197fa7959f93ae38eb310b30ca3cacf7d3c8809093a36baad1a97eb59c87101a63158269405202ccee255fe874bc5ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589697, "uuid": "227359a1-3b80-4433-a629-70878cabcf94", "value": "T11ED46D9EF53B0DEAC1DF92FB80398259F14328906151862AE7D94137DD872E26F94B3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589697, "uuid": "a6db841b-2194-42ae-81a1-5c15e19b55d8", "value": "11b5e5a8c80fad621ae3668e21759e30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589697, "uuid": "822228df-9824-4635-a3b8-1b9919f4962f", "value": "12288:c4+vOlOi2rYBcveyDFFsJdNzOG1XeIBFg:cnOlOnMBTyDTsTtOG1XeIBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761589697, "uuid": "ad1b5085-4a15-403f-bce0-e920a0a78813", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761589697, "uuid": "d1ad09b1-a916-4a0d-b8a8-b5331300dc11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589697, "uuid": "4e72600a-2b7e-4755-8206-9cec7bd9d017", "value": "Rust Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8b7d9c-b369-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761592719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592719, "uuid": "1686eabb-8295-4870-b474-84b1fe60aa6e", "comment": "Malware payload", "value": "a70c4b14a3d7d018351ecc40cec35f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592719, "uuid": "d56ce1b3-5f2f-442b-9db4-3ad756304bbf", "comment": "Malware payload", "value": "04d39773c79255aa2d29863b3ae9e661af6d03b9049bd8c1ec7686388323d54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592719, "uuid": "e998de87-a603-4ef1-85be-a597915274d2", "comment": "Malware payload", "value": "bc411e81b2e97b37a22bf81e4edcb922219fbdc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592719, "uuid": "bd4bfd3c-54b4-4f4c-9cdd-30f272541654", "comment": "Malware payload", "value": "925efddfe61f25af2fb7f80f0d076442f05150076ad06d40e2c31e0f510091a4c10ae2551fe1f5ef13c36aa0e97e4e50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592719, "uuid": "8eee0453-99b3-4769-aaeb-837fa3e59cdc", "value": "T17E089D21F3D40616D1EEC278C2768612E6F1B4C65362D2CF1474DA952FA3FC15A3B2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592719, "uuid": "4283a3ca-0ee8-42ec-a107-ed37e2c0e980", "value": "4b1892ce4fbcfcf064c6f69d693fc6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592719, "uuid": "0005356b-719f-4e97-8b90-d7bb6f55e80f", "value": "786432:FBuL8pAWhqROUNl6mTc0JHYCqBTBNQXQaL:FBbADaoHYCqj0NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592719, "uuid": "a422f7d1-44b1-4843-b0fb-f3ea311e8286", "value": 78500229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592719, "uuid": "4d4f4a56-5fdb-4784-b40a-656a8b061191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592719, "uuid": "f0d2ed59-b376-4460-9cf4-e2e96b9ca399", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93423635-b302-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761548409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761548409, "uuid": "d45de55c-3f4c-47ea-94ae-b3b3c4fb04de", "comment": "Malware payload (RemcosRAT)", "value": "d832c374724180d22e8caf235772486c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761548409, "uuid": "aa210582-e7c5-4ec8-9647-c8cd9598f789", "comment": "Malware payload (RemcosRAT)", "value": "04e9644c02f5cd6aa772a152486f35182351a17b2bfd4e49d9ac28aa2117ac63", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761548409, "uuid": "c01f8ca7-5354-4462-adc7-d0efc66a6a5e", "comment": "Malware payload (RemcosRAT)", "value": "e91dbe01ccc75695175d8bc214b112cdcc9a058c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761548409, "uuid": "86a85ec8-1f32-4b09-bbbf-c68958aa0b3f", "comment": "Malware payload (RemcosRAT)", "value": "8ad65bde01446ae7d373a95172ba8e1567f74db6030c2ea715fe494423f3de05e69e8399c88f42fa2b4e3c8a3c131291", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761548409, "uuid": "66c03ab4-54e5-48f5-a838-98e06a37ac1a", "value": "T19B933971EA28011A5F4A2B99FC546AA1C5B9C159071304B9FFDE134D900F9ACABFDB0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761548409, "uuid": "2a919896-5798-4000-9b25-a52431b01a51", "value": "1536:qQ/dJcB5eNjlfU3ul4Cv0WDF1Kropvk+fV+kvXEA5DRVH5cfo6/LQTDeDtSTeAaQ:q82745fU3u1v0WDF1Lpvk+dv5d8ZjQ2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761548409, "uuid": "218f90f1-df55-4b82-b728-45b280274e23", "value": 94179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761548409, "uuid": "1b91d0ec-bf29-405f-a069-fdffa8b76e5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761548409, "uuid": "6cc36ff1-7396-48df-923c-de01db393973", "value": "rSwiftpaymentadvice-4567688978676564.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0a476d-b305-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761549822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761549822, "uuid": "35ef2585-70ef-4936-a76d-56641234e5e0", "comment": "Malware payload (Mirai)", "value": "cb763c13fc46aef9a904570553ffc0e9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761549822, "uuid": "84f9dff3-35fa-4b31-990c-6306a6fe0fd1", "comment": "Malware payload (Mirai)", "value": "04f33ac957f3826b06df0efe0349dd878684e5f0bca8b7bc63fede9adbe4070f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761549822, "uuid": "c8af781b-5b93-41dc-bf00-f0d0c3a36833", "comment": "Malware payload (Mirai)", "value": "abcd68c86519003ede91093ebb09ff3b52085571", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761549822, "uuid": "976917ac-439b-40b9-8833-5b666a706428", "comment": "Malware payload (Mirai)", "value": "2a1a0ede72971649f57d7dea11e5f797fa9557068f547cddc4ab8fe652ffc628210303f466e46b00d70a1bdf3acb6a5f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761549822, "uuid": "3d9d23c1-ae2b-41f9-9429-2d56ca45a963", "value": "T1BE0122CF71E1037D194984693097C719A82CCAAA0EF20B9CE84938791388A94FC0CF72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761549822, "uuid": "f51f6b44-d1a7-4fe1-970c-5efd54f1ff7f", "value": "12:wJ36srPu6oRYBDAPsEENonbIjD1I4EENon+DjEENoniW82dJ:g3HoWB/EENuba3EENu+fEENuD82D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761549822, "uuid": "c0c429ea-b1e2-4935-a0f4-3d12b6c1b026", "value": 741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761549822, "uuid": "2bc85b2e-7f52-42ba-bc48-0252ef88e081", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761549822, "uuid": "e6d23d3e-5199-4e17-9636-fdc940b5daf5", "value": "tvt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc4c209-b382-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761603536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603536, "uuid": "67f3b082-52ee-43ae-bad0-f0d5a18ee920", "comment": "Malware payload (Mirai)", "value": "21407828d170cd6915be07bc135982c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603536, "uuid": "91fcdc79-3833-40cb-a256-e99b53135556", "comment": "Malware payload (Mirai)", "value": "0557ee5b5543119ac34fccc54526bb92437da59e998786cc1b79634ca170fed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603536, "uuid": "07d0d65c-38b5-4c57-bcd6-2730790f0c9c", "comment": "Malware payload (Mirai)", "value": "fd60453f9add93af398c9f6370f733feb6410780", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603536, "uuid": "79b7aa2b-9bcc-4e12-808e-1363a1c2b5a5", "comment": "Malware payload (Mirai)", "value": "3862817eaaa4d66dcd6baeae788fb146096276a21063f25721c8939d6be5e1a6c872853ba3707034d5b23872dc7e5959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603536, "uuid": "e8c7e7ae-a5c5-4b6d-9508-455a77786911", "value": "T1F94302E7E6F853E0F51F8270305ABD4606C4E95E601C84CAB74136AD58AA7EB3FAD901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603536, "uuid": "8303e960-1362-4747-887f-84f79c0a2e02", "value": "1536:DGu22CDwoJpEzhKtBIP2EvPiWnouy8tyV:DGu22CDwokhKLE2SPimoutY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761603536, "uuid": "53714612-966c-40d3-85d4-0d73798e6735", "value": 56648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761603536, "uuid": "804894ea-8733-4b57-9043-755831e4737d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603536, "uuid": "41a9265c-5384-499c-8048-d734f585860d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10d4011-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761557075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557075, "uuid": "f377d99f-0532-47ea-8d46-432c7429bfa5", "comment": "Malware payload (XWorm)", "value": "2a0808c5d4840511e1e6fd7b17d1c7b0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557075, "uuid": "2a126022-6450-45f9-8928-1b457d31f83f", "comment": "Malware payload (XWorm)", "value": "0578ce8d2d10a710e7ccbc33fef0ac605153a5928eef55725eb7bedeb5479518", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557075, "uuid": "011b3972-f21f-4c48-aaa0-731aa9af5c5c", "comment": "Malware payload (XWorm)", "value": "1445ae26fe37b2c89e7cf85c09c0770b1188dc40", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557075, "uuid": "6da7516e-d056-436b-b7a4-d64d4bb3b248", "comment": "Malware payload (XWorm)", "value": "0cc1197d768c8495bdb3f9ffe20d8ccd7902ee80fc3ff6908a5859d17f7ff0c2e66817295fe9934a9f2bbd89bbb21e0f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557075, "uuid": "0d4884a7-1958-444a-9767-e4263ece24e2", "value": "T103D3EA29B951AFC0321C3C9C9F8725DA10CF867395281E9887D77C6F1C5FD0DAA2D29A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557075, "uuid": "2acb57a7-2173-4afb-94cf-5b999ae73ead", "value": "1536:l47hjjtftL8mTMqr7AfbYCnEMq4EWUFvapwXdjghLgJm8ZpWOgknOGOKkZn:K7hjjL8oM+7AjYCA4EWUF5Np08Hwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557075, "uuid": "27603723-a36f-42b5-bb12-4917bbda209a", "value": 130254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557075, "uuid": "4627e976-a69a-4bb3-81ee-1324e6c4e67c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557075, "uuid": "96341388-c689-4d3f-8714-bee45b176bad", "value": "Maersk_shipping_document_confirmation_request_0000000_10-27-2025.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5483c2-b385-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761604607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604607, "uuid": "4aa3245e-7788-4fe5-8117-c72813432e95", "comment": "Malware payload (Mirai)", "value": "91d4a1b39db27481e1ce856fe59b8895", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604607, "uuid": "5fb4d166-b09a-4739-ad94-24bae06a866a", "comment": "Malware payload (Mirai)", "value": "0603887154b33bd7e1304b31f0cdbec45d384c10480c4222c5cf23135bc06084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604607, "uuid": "7cbbadea-64d7-4be1-93a4-fc0d9272dbf4", "comment": "Malware payload (Mirai)", "value": "e69fd1f2bb4c8a9595dd2ade7d3de6acd73b0285", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604607, "uuid": "64f42057-389a-4812-b067-4de3e1c468a7", "comment": "Malware payload (Mirai)", "value": "d650ae5c0863db59fab5684f60e8a556313a302ed12f63b3060095824ab9ab71485ab82573cfec934d75e0354b90e576", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604607, "uuid": "d89cb064-cf8a-4c40-bd21-be0e1df930a5", "value": "T124330143B5FF4B57C55A123793AA75AA0404F91A018EED83DD8CF41BEE0F3162B206D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604607, "uuid": "c3148adb-8519-4920-9cdc-47e267b785cc", "value": "1536:OZntPOk3RrCx7yF38PvL366qwhqFVwwnouy8tyK:OZn3xF8XL36tSiw4outr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761604607, "uuid": "5fc320bc-80a3-456b-8630-8e3da8ffcd6c", "value": 54764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761604607, "uuid": "cfd5841c-2e5b-45db-99b7-e5e8f044e125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604607, "uuid": "a738182a-1642-4489-a176-f523b64ff568", "value": "Orbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e985aac-b33d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761573714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573714, "uuid": "dab29959-d0a8-4a8e-b2e8-1f59cb8484dc", "comment": "Malware payload (Rhadamanthys)", "value": "ee361cc9d20d00c9f2c9ba21579f8167", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573714, "uuid": "5e30e9fa-f21c-41fb-8720-a486856c2978", "comment": "Malware payload (Rhadamanthys)", "value": "068415ce8f9a0e490131170a98c363d7d5055987dda58ae2168f71a8b600cd84", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573714, "uuid": "cdd5f084-2e54-4fbd-8539-9ef42bd63486", "comment": "Malware payload (Rhadamanthys)", "value": "67b32d4ea032ec5b01b469c03e3b6536c78f2ed5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573714, "uuid": "5627a703-f01e-4118-86fe-460524781a2c", "comment": "Malware payload (Rhadamanthys)", "value": "bb20bf7e5fec5a1bf2e7a083fd06d1438f79d7fbcb318a310308a58ee96eac5f3619068cab80b5142486116a539bb4b7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573714, "uuid": "c88ee5a0-a063-4e19-b646-19132f832724", "value": "T15575230F9AEC11FBC0B2A77C18E58152D63138E11B36E4EF6989D5648F836D0A736B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573714, "uuid": "9aacff49-3a2a-4c7a-8a15-6c2db9fe6fb5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573714, "uuid": "76189b33-157b-4bb8-9f2d-47ab44662cf6", "value": "49152:mjgLOIfRo07wlCISj6ku17NSRSobgorn:5OIeywlxAf4ASo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761573714, "uuid": "38c428d4-b01a-4427-8357-f42b8f74b5bb", "value": 1662976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761573714, "uuid": "9fae64ea-a158-4637-8bcf-dc4fce1ff558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573714, "uuid": "eece187d-51bc-4760-bf87-f71c83a6705f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813f35f6-b372-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761596482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596482, "uuid": "cda39a9d-1ed8-49c0-805b-7614f1ecb271", "comment": "Malware payload (XWorm)", "value": "8d9e5b85d16206ca8b556fb417cf76a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596482, "uuid": "2971db03-fb33-4939-9081-e93028200908", "comment": "Malware payload (XWorm)", "value": "07cc70d80281cdb146cccd3de6aaf2a5011901328bc5def66f9ede21a2fb0042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596482, "uuid": "2b690fd6-501b-4b90-9e8a-27b9f50f21d4", "comment": "Malware payload (XWorm)", "value": "54f7cbc617e353b93e8016354a3fcaf9ce463836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596482, "uuid": "90eb5196-ce8a-4b5e-ab0f-90c118eef116", "comment": "Malware payload (XWorm)", "value": "187b6f41291afc3dcc031ff8efe911e6e05beded2c2f88820841e75a23f3822186e9fb3d2451b012cc8832444b8b208a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596482, "uuid": "801b2d1b-fcde-43d1-a024-3d7cc26e6e1d", "value": "T13925AE0273D1D062FFAB91334B5AF6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596482, "uuid": "e570a3ec-fe64-4ae3-b2e2-05304dbcfce6", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596482, "uuid": "eab006f8-d23a-45c3-9787-0afa69ba37cb", "value": "24576:X5EmXFtKaL4/oFe5T9yyXYfP1ijXdae+psDGVg/:XPVt/LZeJbInQRae+pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761596482, "uuid": "92276ee0-bd3e-4320-8091-0b18e643d1c4", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761596482, "uuid": "7b0d1577-332a-4c25-9e6a-c895c5acbe7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596482, "uuid": "3f6ac374-677b-496e-85f6-42ac962ec9e1", "value": "Purchase Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23e1cdc-b30e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761553695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553695, "uuid": "c2dffa17-de17-4d1d-a771-afd2af6214d9", "comment": "Malware payload (RemcosRAT)", "value": "7273f75535db0cfca48a90989278bd44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553695, "uuid": "2b34174d-a6d4-48ec-bed6-a18f08ce7e09", "comment": "Malware payload (RemcosRAT)", "value": "07f443bca50ef0a5605591e31830f4e14c9b5c1c6d392bc0f12057f88ad4ae5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553695, "uuid": "2682940a-99ce-4a52-b48f-2ccb4f7598da", "comment": "Malware payload (RemcosRAT)", "value": "f706abb958bc993813c7597efd58e8683486e2ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553695, "uuid": "486bcaba-7f09-4aa4-907c-975af006899f", "comment": "Malware payload (RemcosRAT)", "value": "c5ec9d6a38a03dfb0a59e2f7920205b813895989c236d264c3b20bb02bf2939b8286e4050335ab54d33009922c07053f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553695, "uuid": "bf883267-089a-4d83-8ed3-603bc3054c76", "value": "T14194124063A1C2E6D8A241B6C9362BFF9774EC16CB6597034729BE1F3A7035DEE0E641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553695, "uuid": "c0a4dafb-fdf0-4630-ba10-d389a85cfb3b", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553695, "uuid": "05628076-4fc1-4ded-aec5-e4116234e333", "value": "12288:lcE8OLszQvVouPdrzMhRubt5GmuZsq+HqrBGJZc:lt8/zUVouFz4UgRBWZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761553695, "uuid": "1f1a20c7-6b11-4db3-9d52-fc00e628ca14", "value": 409288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761553695, "uuid": "6838dbb7-52e2-4a6c-b1c7-d8fa1edefae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553695, "uuid": "b92f4fa6-38d9-4fd3-add4-89bda7d755c8", "value": "Payment_Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25bc6e6-b33d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761573774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573774, "uuid": "3e29ebd2-320c-4165-8558-30e7e35b661b", "comment": "Malware payload", "value": "a974ea23ada8b03b7755a2872454e4cd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573774, "uuid": "1a92fdc9-6aee-46d4-ada2-dd5bf3f23a56", "comment": "Malware payload", "value": "085bd25ebce0ce11ea358b1d7938f0e57db66e1a5cec0f66e27043162ffe5034", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573774, "uuid": "ee6f67ab-c545-4a8c-90dd-fdf5e6fad175", "comment": "Malware payload", "value": "2e7f709f6979823eceec34d25402f8f6b6287599", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573774, "uuid": "26f9dba0-8bf6-4a3a-8c7f-0355f2f1b8fa", "comment": "Malware payload", "value": "d472b3b2f6e9cd2a570c76d5fe5378397aaae4496d97c952763219ecd7ae12639e16e8323373f9463d8c8e254681b5b5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573774, "uuid": "713981f7-9c67-4eff-a23c-444af5361464", "value": "T1D5D4235754DED6A53781F9B821A70B0B7F0A1E4428F8BC92731AFF3554228232ED92C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573774, "uuid": "121d8778-decd-429a-87f6-4e77b140111f", "value": "12288:nz0HmsOpFILO074dvpw7uoKev7a/FAMviWDS+Bf4N1z:nz0HlCQOpv+uevnQRjBfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761573774, "uuid": "d85790c2-7eed-4f67-8307-dbc57978b829", "value": 622516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761573774, "uuid": "373a6d3b-bb36-46e7-8d96-1236f035cba3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573774, "uuid": "5d92a2de-a5a3-477b-85c4-486976bf01a9", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eff46cf-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579137, "uuid": "3d8346c6-7464-4a57-a506-d6e2adf31641", "comment": "Malware payload (Mirai)", "value": "f4d1da042a556b4178d005605a02b543", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579137, "uuid": "b0cc77d1-6457-4cff-b632-d543f3d950b3", "comment": "Malware payload (Mirai)", "value": "0a748c32c7ee415ed6d407272260c2f117d9812098f9cd3b22ce073eceb42de7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579137, "uuid": "f6890e5b-1438-40ef-9418-8a35232ac8cb", "comment": "Malware payload (Mirai)", "value": "c400e6450c018920fda2032d40e70649cd27a617", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579137, "uuid": "a5f385a8-5de4-4dc9-9024-afb73f84b02f", "comment": "Malware payload (Mirai)", "value": "30a66ecd1c46edad2b899bd3edcb85c8cb6bb13dd758aa19fbf022f98a3e72ef5fef632c2d513b2dd79b29b5e15bce42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579137, "uuid": "8a5271d3-8250-49fe-bf0a-fb88aaa7ed5c", "value": "T100330881BC829912CAD41376FA6E01CD332663A9E1EF7217DD216F1137DA82F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579137, "uuid": "cae1037b-995d-4d32-81d5-e7d9c0690e58", "value": "768:BnoGCh6mppCK2t1ThNmtMGUi75dpCCDL0IIefuBJNoilSdaYBNwoxBA1ss9AAE:FoGaTDC7tgUi1dMu0IIefYJdWaKxel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579137, "uuid": "aeadca42-e439-458e-af27-5925c8bf0cd9", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579137, "uuid": "fcad3100-c685-4c15-88d5-096143594001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579137, "uuid": "1739540b-4115-43d2-8292-87e94f1a5a59", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac38c4ce-b35a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761586246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586246, "uuid": "9ae9a2fd-ac93-42c4-a681-f095f11de528", "comment": "Malware payload", "value": "224c33357c4877e35b9e0484fc88a9ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586246, "uuid": "2b57fcb2-776a-4b45-8c71-27c36a34c137", "comment": "Malware payload", "value": "0af06d853d7b33bd9018f56716df84251ddb9034adc66dc74f6e319f45d22792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586246, "uuid": "45bfdc54-3a85-4c84-bf37-b863749bc651", "comment": "Malware payload", "value": "7ba8ee02107eacf5cbd2afbf9c4b7c9075a987fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586246, "uuid": "0acd165d-656e-4518-984d-84a03a2e40b3", "comment": "Malware payload", "value": "59cb1af41ea0d4f7b3492ee53ac0ba7e16874ac29b7214d3e40d7a87d6b80fa7ba3aee98048da597fc524745ac74a67c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586246, "uuid": "6df84353-46a3-4b1d-8399-0e85db8ec14f", "value": "T188F54B02A89105BEC72DA23585B675A27671BC59073337F3EA98B2263FBEFC04935714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586246, "uuid": "2c142d29-eb3b-4ff9-895a-79c2590bf859", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586246, "uuid": "012a56bf-ac5d-437f-97df-d6afec9ac3fe", "value": "49152:Lw4CfTndN49QUzo3ugVGG5L907gM2VtG7S:Lunfc54JR07gM2VtG7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761586246, "uuid": "3b4c4d9f-2d68-47f7-b985-8491fb9c57cb", "value": 3355048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761586246, "uuid": "88582bb0-3e32-4d5a-8d14-692bebd8e93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586246, "uuid": "a0ee7136-96d0-420c-a09d-de4a9e22d2e2", "value": "project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfb2009-b36b-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1761593413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593413, "uuid": "d50c269d-c3f8-4d1d-8f12-b0bc05fb300a", "comment": "Malware payload (DCRat)", "value": "0c771da81ea7ac58256a15d2486fad36", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593413, "uuid": "99f7bbf8-4bbe-43e9-a058-880763ee6975", "comment": "Malware payload (DCRat)", "value": "0db3ef6b7cdfa87c6a695fb2c3d7cf47aad51bd8963b47fe61912b0036d3e3a3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593413, "uuid": "30674f33-0c2f-482a-9ba1-0d228d2bf839", "comment": "Malware payload (DCRat)", "value": "3e95211f4cd37202347e61874177631108a080e0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593413, "uuid": "9fef1898-9845-4296-9acb-4852cf750140", "comment": "Malware payload (DCRat)", "value": "9f0abe42e02bf9a9287498939b4eaf8a4d13fc0a29af737637842aa344391ffffe3f2bf74195f4b09689db46bbe5e8b8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593413, "uuid": "edd7ba8d-d154-41ac-95b7-b360fdcd98df", "value": "T1B006F10669D65F32C2645B7155B7253E92D0EB223512EE0B361F20A2B90B7F08F762F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593413, "uuid": "23ad69b0-4cd4-4cb1-8802-d8ee97034a04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593413, "uuid": "76880b00-db2f-42a0-a86e-a1191589eb9e", "value": "98304:k/kSsTCNQtW766zEyD4Xh3BJt+Ak8Xreovp9jQ:qkBYQwG6wyUR3fxBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761593413, "uuid": "5b5d5642-7835-4c6a-a862-298a5b3eb37b", "value": 3703296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761593413, "uuid": "a9b674b2-99d6-48db-b3c7-330bb41ba41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593413, "uuid": "5718f6ad-d919-4c35-888d-f9454bc49b74", "value": "0c771da81ea7ac58256a15d2486fad36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b41bd5-b317-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1761557266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557266, "uuid": "9bdb8548-2234-469b-8466-d13a3bf2b23e", "comment": "Malware payload (DarkCloud)", "value": "5a8bcfee3089263cff5f5741d04bdc45", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557266, "uuid": "2893c399-fd15-4f4c-aa80-cdb92d1ded75", "comment": "Malware payload (DarkCloud)", "value": "0de1bc51417ff52dbd8dea0137ce230d6ee9f0ecf5c8b8391288ac4be7f40337", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557266, "uuid": "a314e72b-0725-4c71-be73-c9a1e2488969", "comment": "Malware payload (DarkCloud)", "value": "a46a9769247851a122430b059f5a778e4867d984", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557266, "uuid": "789e9724-9b38-427c-820b-d18836565907", "comment": "Malware payload (DarkCloud)", "value": "04fda57a99b3f72f6cc43e861a09fae6490a2f4bd03dfe7cadd77f1a6e5f588d3a4c2fbe39bf379001972339d2db2ced", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557266, "uuid": "337d759f-5eca-4962-af16-e41c4f467be9", "value": "T10275D891F4A024B29147A6BC90AE054F8F2931EBE986511FF19C6BC52F1FD82B5C7E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557266, "uuid": "42248239-573c-4ffd-9a5a-a42dda8781a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557266, "uuid": "8d186763-beeb-491a-be65-f69fec5f0ce0", "value": "12288:PYG70BxGPGZD52AmKBhSHIp7bGt4w5aYET0iXhxQYMWz/HfHHCqFM0WM+nSxTsv6:T0BxGPGZD52ASy1w5NCQWjsiiF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557266, "uuid": "7eae6d17-7b63-4c42-9253-c7ae30b14851", "value": 1611264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557266, "uuid": "4472ab98-1edd-46f3-a455-3b957747a91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557266, "uuid": "87bfd75b-500d-4285-8a6d-5481ba0987a6", "value": "BBVA PAGO________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef5b76e-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570816, "uuid": "df9138f1-1f3c-4eb5-b406-85fedbf5e1f2", "comment": "Malware payload (Mirai)", "value": "77866a8df346e49ec01cee644df21f38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570816, "uuid": "2637aab0-a973-44d8-ad02-f475b7ae346d", "comment": "Malware payload (Mirai)", "value": "0e3914d8ae7f590b91310f268629e85ce4b634b78bdfbf49c60730efe7a92e39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570816, "uuid": "8f3ee98f-74f6-4b37-89ee-f67112d747e9", "comment": "Malware payload (Mirai)", "value": "06df541d6f60b88fd2e3a0f69551380bfab6af3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570816, "uuid": "ad1b2b4d-98ea-4b06-9419-791e5d75646d", "comment": "Malware payload (Mirai)", "value": "7013957907d635c08d21116472deb90261dfe1683ba6b1b7a0c29bb5d2a1c2c73e44faa2ef34392f6934ce7e183ded9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570816, "uuid": "f3058795-9d87-4339-b4e1-146d4f5d4047", "value": "T1FCE2F127116B3A54DD47497935BDD548CA23A0B41F0FC109386AC7262DAEFB5B13C546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570816, "uuid": "f68c3a39-4144-46b8-a3a8-35fe077230ea", "value": "768:pCscAALmcIyG5uOF+VfanRVsNzApgDkq0trMZ:pCR/4zAOoCKNzApggtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570816, "uuid": "146001c0-2872-493c-8486-b07d63bd9752", "value": 33444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570816, "uuid": "3ac5f7e9-3b79-4f7a-8c0e-d613dfe2612d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570816, "uuid": "dac649fb-39ff-4222-b2aa-46bd81d1c59b", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f4ff2c-b349-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761578753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578753, "uuid": "d5bc6fd8-7d44-43a5-9cf9-e2e525bd9051", "comment": "Malware payload (Mirai)", "value": "b334ef3b37b727a0004254ed6600822c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578753, "uuid": "262cad9b-ea17-4195-a63d-5d5d2e3e5ff4", "comment": "Malware payload (Mirai)", "value": "0e75207f5dcf13db9ed593df5bbb75fbdd87fd1b7d6e49df6939dcae2c56fbf8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578753, "uuid": "b4bcf392-cb37-45da-b558-8f704d714cbe", "comment": "Malware payload (Mirai)", "value": "22e6e6080b2ce1899f26699b1806edb75958f71f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578753, "uuid": "123b599e-84aa-4d29-99cd-f42d4cbab5b2", "comment": "Malware payload (Mirai)", "value": "08a65b94565c63b53cad77cbc2578d5ecee1df966163da50de843c00444a327fa51ed8cec8292f36a46b9d71709e1bed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578753, "uuid": "55310253-4e2d-4fce-9039-4861b362c1ac", "value": "T14801B984157017703DA694EA8D721C2830CA51953DC71CFC7AE7A8D61D97C14B1E22DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578753, "uuid": "5ea21b93-bd8b-452a-84e7-ffaf404e8fb0", "value": "12:YkF1kcClZF70SoqHFmqHFpqHFWlCHFSBUCgFM5gFwTHlCHFSrUCgFMDgFwTzA1Ld:ZDkH/FboqHFmqHFpqHFWlCFk3gFM5gFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761578753, "uuid": "f31da279-a28b-4dd4-a823-ae26cc88d642", "value": 762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761578753, "uuid": "d9d1abd1-0194-4385-a5f1-875e597c83e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578753, "uuid": "d3d3d525-ba22-440b-80a3-a8915f7ea468", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4e6848-b33d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761573900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573900, "uuid": "f0323b3b-44b8-4b5f-86ab-40c577e628bd", "comment": "Malware payload", "value": "1403b40189873566cddcae0f2eef570b", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573900, "uuid": "f89ce354-fff4-49e3-ae1d-59aaca2f152b", "comment": "Malware payload", "value": "0edf88ae0c13bd057d86f62b110c44b5dc180c2fe80ea4e0c6bb8a98ec47f1cf", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573900, "uuid": "332621da-961d-4673-9eab-de8d6580691f", "comment": "Malware payload", "value": "987d01db26eda38cf5f252f370e28a17a44870d3", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573900, "uuid": "041ad331-705c-4883-acb5-fce90d867046", "comment": "Malware payload", "value": "b1cd79651eba88eee1745e9924de5a47003c69c718c4f0cc30cb5b5a36c5e06e9e4ac19412823418c6bf5aed20f4c87a", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573900, "uuid": "faea7a0b-b529-4653-8e49-9dc316d21805", "value": "T1DCB312B00FB7E6E9C1589A94655981F3DA7D620F933A4D08E099F0DB1BDDED4FB22200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573900, "uuid": "d8c8598c-a1a5-4e70-9d63-1b764eaed8ed", "value": "3072:BYBf1XfB/+/m2K2UdnUAys54wljX0skR+MuN:B0f14/m2K2UdU7s54ojXG+MuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761573900, "uuid": "168160fb-f379-4018-b6d4-58b0f2056f3d", "value": 111934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761573900, "uuid": "1b8be323-c6fa-4daa-9e73-821028737c66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573900, "uuid": "a9e31d92-33ae-40ec-a4ce-9203104e77a6", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd25a863-b388-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761606058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606058, "uuid": "66f9b4e6-3a77-4a03-b6dc-94d4e1bb7704", "comment": "Malware payload (Mirai)", "value": "35deba4a41843be9400af681cecfbca9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606058, "uuid": "3237d826-58fb-48f4-aaab-44b40a3be0d3", "comment": "Malware payload (Mirai)", "value": "10a92de1e513750fa3fdb6e0314af0886de332ba51428aa5f31a1eca3c0b46f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606058, "uuid": "d2c44a3e-590d-4da3-958b-d175b5a3f562", "comment": "Malware payload (Mirai)", "value": "18104e18c8693b76b4a4f9d9e0fc3c3f9aedf5ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606058, "uuid": "b12c639b-5544-4ee6-8f5a-608915a2619f", "comment": "Malware payload (Mirai)", "value": "953d9fba8b6016ee303242a6ea6b177156fafecdbc7c4f54e7f611ae1537dbaec8feaa2953a6abf750db470fac18eb94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761606058, "uuid": "0bccc375-8d5c-4bc2-a876-412df5856b6b", "value": "T14E5302A1A697FE728170C871EA388C8F961C3CBDF94AB0996C4C65F41536A03572D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761606058, "uuid": "4dc0e28f-7d65-45ee-8b11-1494c3f5f030", "value": "1536:gWzrgs95is0YOXVYnM9OJ2Qcwv9U51jYW/Egnxx4YbRnEzC:xpjisrMYlQPwvm7Hlx4YbREe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761606058, "uuid": "544afea5-3375-4589-b0e3-81eac38ba91f", "value": 64884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761606058, "uuid": "6eee169c-3358-4b58-b974-b7b6b8d1b6ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761606058, "uuid": "c9829682-c605-44f4-8057-920664e16033", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78e9c27-b359-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761585809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585809, "uuid": "d81d850e-1817-49dd-b667-99b2e2bb7830", "comment": "Malware payload", "value": "5fda1a7013adc491a1b1ca9483972231", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585809, "uuid": "6f0aa17a-1862-4dd2-8563-491182d473e2", "comment": "Malware payload", "value": "114851609f6df58c1deca3e77f4e157e571075f5ce9371b813b4a52baf16c83b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585809, "uuid": "6ed83d3c-8114-4ddc-a71a-a10eb34d604e", "comment": "Malware payload", "value": "c50b42eeba7d33043fd6d2db3143ac1099f3dde2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585809, "uuid": "45e56706-0e42-40de-b575-10be95d186b6", "comment": "Malware payload", "value": "957bbc1fc9e40e3401c35e9813e383ad9bde1e7ee64f9248022606354ab8e1474de4daa994089f166006f7aefa03a5c0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585809, "uuid": "1f11d94f-f230-4912-ab3b-caba6dfd221f", "value": "T16912946A84381C90167BFBB6BBA75204F73380139902916D3FAC899C1FF6C459562FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585809, "uuid": "5d5177a1-26c5-49fa-ad2a-f5efeac84282", "value": "192:n35mx43mJXvso6ujibl7E/UY0ZmTrOf2z3RqsETq/o9lTa:3d5blRfmssETl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585809, "uuid": "8c79daa7-0067-487b-98c1-eb88541a9d13", "value": 9653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585809, "uuid": "06f85d65-11fc-48a9-b737-0b51674a2463", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585809, "uuid": "98b9edc1-36cb-4080-a55e-608da82225bd", "value": "SHIPMENT AWB-ARRIVAL.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d19ae7c-b34f-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761581469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581469, "uuid": "898a888f-d14d-4010-ae3c-1634a325015f", "comment": "Malware payload (AsyncRAT)", "value": "55be0c56e2405a583fee0cd0c5ccbc65", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581469, "uuid": "87fec1a6-b271-4591-ab1b-fd1ebb66def0", "comment": "Malware payload (AsyncRAT)", "value": "1312f3ab8ce19193f0fd34be951cdd591d0ed8997c229b75b4e570aca49d0b1f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581469, "uuid": "2b72f938-e4b7-4be1-826f-696761e1f933", "comment": "Malware payload (AsyncRAT)", "value": "cd752f22fde4ae464946b83dec76abc4216c761d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581469, "uuid": "e284e332-575b-4667-8583-26dd3119e025", "comment": "Malware payload (AsyncRAT)", "value": "5597029e262b17361e03255939d52c928293eed6229a175604ed8bb92a677f5a54eb0580a3977e65f40e19bde2c6faec", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581469, "uuid": "04efb0ed-a597-4ee7-87f1-b60db70514fe", "value": "T132E23B483BA5832BD6FE6FF628B6910202359507D913EF9E4CD885B76F77A8147003E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581469, "uuid": "623fbe68-7f82-464c-bc02-9b18888bc042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581469, "uuid": "73860d68-27cb-4b47-bcad-64b429522422", "value": "384:zK2KQySXfHCLsY2WvDogLZeLEd0hYACSqR/inw2uRugtFuBLTIOZw/WVnvn9IkVW:BxCLnDTndMYAoR/iw2uBFE9RFOqhTby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761581469, "uuid": "cba2a93f-6dce-44f8-9ad9-521579488f5c", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761581469, "uuid": "b7dbdb8e-c6d2-4edb-a1c5-dddbf9cfc816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581469, "uuid": "8668d297-26e6-4a71-b724-75b47daf4a10", "value": "sxx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bd56be-b2f1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761541061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541061, "uuid": "2a0ec198-0c80-4370-8f5c-e90c6b053e2d", "comment": "Malware payload", "value": "d354b57605396e7a64b85c72abefd930", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541061, "uuid": "3e052a30-f7c3-441e-8b2b-1803d12323ee", "comment": "Malware payload", "value": "1316c013b33ecfec3160672091ec73a840f6da23e9f4fbf32dbb13bf24e9f224", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541061, "uuid": "dfb50682-a156-4efe-9234-3639f3b35ac7", "comment": "Malware payload", "value": "b11ee57807f679ee752223d68b93e0f16bcaf169", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541061, "uuid": "89010929-62b0-42a8-ba97-b2aba5e42cef", "comment": "Malware payload", "value": "0f659f1f7d0b523792adab42d0bf6ddc5c19f7f7302c90fa6be1b6c42cc5196fb0d8eb5243d404ae77e067da1c72f570", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541061, "uuid": "3617347e-8381-4c37-b65f-5fa274654d47", "value": "T1D23170BE90969096014D8E6EF2775FE8DEC48F8724715F889E8C4CB18A59D09B83CA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541061, "uuid": "ffce6566-bd51-45c1-8977-d8614b278330", "value": "24:LlllW2aRhDbws9yyOj1l7qNO41W1BNvUazMrA3ptEtD10+fJ/4FJukxSd:DaXgWEwebmYL+D10+Gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761541061, "uuid": "9a6b5484-012d-45bd-aff4-7f0f4564f9a4", "value": 1457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761541061, "uuid": "f058615f-4390-4ea3-9288-a2c289ba9020", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541061, "uuid": "9ca23445-5901-4474-97ad-77c51308a955", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec4a691-b335-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1761570305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570305, "uuid": "1909a6ac-0a37-4b6a-8376-3851c2c2d76b", "comment": "Malware payload (RedLineStealer)", "value": "f0cdee3aac59364064504afaa97a138b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570305, "uuid": "fd1755be-8145-4b7f-9b3a-3b4ae01216be", "comment": "Malware payload (RedLineStealer)", "value": "144db9817dfd0a6e61cf7dd18c34c862be3e98fda4e7bf18f230149703575e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570305, "uuid": "ccb3af6b-3ed5-4beb-a70e-9bd5770bad47", "comment": "Malware payload (RedLineStealer)", "value": "61eb41bbbd504e262cb37a90e1d29c7ee61159f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570305, "uuid": "908a7a18-4cb7-4df4-b26b-ef39e775c5b5", "comment": "Malware payload (RedLineStealer)", "value": "d257105b69d69a170c098b5fa9e5297f76b8fee4e493c003ddf3a3caa7498dd31799a97298701e5603c1057f554310ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570305, "uuid": "8e9f78de-ce6f-47e0-865e-bc7bf91113c2", "value": "T141B4F05512B6DE06D5A163B308B0F6741F7E2DA5A822F24A5BEA3EDB7D72F100D04393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570305, "uuid": "31792082-8a0f-4cb4-a4c0-55435221f8e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570305, "uuid": "481355a6-f9d3-490b-9603-e51e5ef51197", "value": "12288:QQzh5+hGmhK7fOqpRqSuSy7tsZeKV2h4:QQzh0hGmh4JuSypKvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570305, "uuid": "72cc9f71-fa60-47ee-9d39-640d20b46e25", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570305, "uuid": "b98b1e8a-539e-4f82-9fc1-a353ff772dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570305, "uuid": "f6364725-7fa3-4621-90f9-a84849583fbf", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c73ea5-b361-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1761589326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589326, "uuid": "ebea552b-1151-40f4-8647-5e9544a78cf2", "comment": "Malware payload (GoToResolve)", "value": "e38dedb976e2263dbc8dddaed5d691b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589326, "uuid": "f222f37b-7805-4054-b029-f13e8a81e547", "comment": "Malware payload (GoToResolve)", "value": "149f19c05392cf02abfcff31b66a0e3f827629250075d49a7edc7c02efaae432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589326, "uuid": "e690c8d5-1632-4500-800a-23e2edd9820c", "comment": "Malware payload (GoToResolve)", "value": "21d6e97df6158e3e5beca1db9b5714d646c76099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589326, "uuid": "f55447a0-3af5-4b4d-9277-cfe72f332dec", "comment": "Malware payload (GoToResolve)", "value": "667a63f2a1f2c3d509b2335a739c3940bdfe053709a02183527f668a146cb04d09ad17a8658da100be647b5b67440d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589326, "uuid": "925ca897-024e-47b9-b5d5-294045eeb850", "value": "T17D37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589326, "uuid": "f003c086-1243-474e-9816-f3190960ed67", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589326, "uuid": "a3a11636-6366-4875-9434-91a9328f1426", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXp1:q9WtLzgOTbjZvk/ekS/mcp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761589326, "uuid": "ef9ac0c5-a7b1-43a9-b265-b0c1ee9c273f", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761589326, "uuid": "7095da33-aff1-4806-82d1-ce9175cf7676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589326, "uuid": "ed0425dc-c4c4-4ed3-9fc2-d4283503320f", "value": "remittance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a983392b-b329-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761565196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565196, "uuid": "5ec401f3-58c2-4dce-ad54-937187a821a8", "comment": "Malware payload (Mirai)", "value": "897993c0dac95b5705e951427703a398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565196, "uuid": "35ef20e4-fdb1-457d-85ee-e82b30fb5539", "comment": "Malware payload (Mirai)", "value": "15c40895de2d5da74ab20a0ca68834073a6f8a266c267ef860cff218ca1f6148", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565196, "uuid": "da457956-0b51-424d-b147-06c2e44b809f", "comment": "Malware payload (Mirai)", "value": "08a555871a4162f783a5248d4f3c3a4e24418cf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565196, "uuid": "f481b564-a58f-4c83-92f1-7656d4f5ac50", "comment": "Malware payload (Mirai)", "value": "63d3ac115e09ba4e6aa654f7fc385cb7fdd2ce28468cfa55da50caa952a363d21d3c8c8c2a411ea79f4fd1f7fd6b0469", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565196, "uuid": "034ec8e7-a296-484e-80f6-586a3ef3b1f1", "value": "T11A933952FD818A62C6C126B7FB5E028D376613A9E2EE3303AC255F2137C795B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565196, "uuid": "60c68f57-17b0-40d2-ba2d-92c00c860157", "value": "1536:qdYEXG1cVM56a9stYn1Us7h3UPNqXDKa9rS5+m/H3hGQz0Oc4g9jq:qdYEXG1kM56avFsqXN1w+mfg+0O3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761565196, "uuid": "81c79755-e488-4c17-8eeb-9350f6f9119b", "value": 89844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761565196, "uuid": "545ffa0f-6428-486b-bcbd-3c9013ee11bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565196, "uuid": "d0c70fab-17e6-4d14-902d-fe025278bbf5", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d45bbd-b384-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761604247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604247, "uuid": "214a41eb-d866-4025-8fcc-7f1f1a7501b6", "comment": "Malware payload (Mirai)", "value": "a37fd68208babb4ebfcbbf35b97782d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604247, "uuid": "17261fec-e6ef-4614-929c-c88dbf9c0578", "comment": "Malware payload (Mirai)", "value": "15e6b9a5a69d2e610d64e18548a4096fd84506a0341d20a321b1bb07f0e86127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604247, "uuid": "afc0a14b-47b4-431d-85fd-7af8b3a90775", "comment": "Malware payload (Mirai)", "value": "4aa169761da39ec25e10d000095154451a932a82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604247, "uuid": "66f4db18-18c0-43b7-a09a-4817e8ef5c35", "comment": "Malware payload (Mirai)", "value": "326ca65fbc3a245cf4f57fdd2e74957193120341aaea49a5d8095b45411c923d769899db1d194371766d5d2144883fbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604247, "uuid": "b101a2db-c24a-4963-b170-77137ad1bb4f", "value": "T1ED63F16DC5682419D64C5CBE8ADE85B21E80F004FBBAA7CE37394488F2B2D2EF1494D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604247, "uuid": "b845a658-77b7-4e46-9ba0-bfadfb97dbd3", "value": "1536:1pugbRQ6HGS6ro7l7ReGw9hyErmyHQnSd77sxBRckV:BOj+BkGaNHEAmBRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761604247, "uuid": "093da256-df90-4799-a514-0f627322c328", "value": 71972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761604247, "uuid": "71e62b73-b0d7-471f-8bd8-3f5ceee5e37b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604247, "uuid": "ac8fb220-8487-45e9-8fb1-941589da221d", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357fe964-b32f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761567579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567579, "uuid": "101149ba-ebf3-4d3d-ba4c-483002b9c443", "comment": "Malware payload (Mirai)", "value": "43ceb8041282d3ddad5f8910ea052284", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567579, "uuid": "f32ebe15-d08d-49f9-90cc-b8200b016d4d", "comment": "Malware payload (Mirai)", "value": "1625aac86de7279f61437c68e8b8f14b33a1785a0a27d331d8cec21afb4390f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567579, "uuid": "ae6dd897-1b73-4a7f-8ce9-b8fdbfc33478", "comment": "Malware payload (Mirai)", "value": "a1560780b46374808796fedfbb5b0d1dd2313c99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567579, "uuid": "1faa15b1-c470-4d7c-a77b-7f9ae2051fde", "comment": "Malware payload (Mirai)", "value": "2aa1965a5b0c7f470c582d7fc3c2fe412ca1dea817bc2bc1aa285b11dae5920de72c23225048ec58135a76bd53c20d86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761567579, "uuid": "634d59df-223b-4c01-8ab0-3e2aa8b1debe", "value": "T117B30885B881EB21C6C256BBFF4F428E7316539CE3EA3203CD195F6136CB55A0E3A156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761567579, "uuid": "0a8510b7-dfd8-4cce-b802-f2846f1a5c60", "value": "3072:Xjddh2hhFOWLv2dBji10mV9I7FNe80kwtrmXrd4F+wa63vhBynwvGznz2:zdd0ZZLv2dBji6mV9Ihc80kwU5ht4vH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761567579, "uuid": "df1a2954-a40b-4f7b-95b2-b4a3a20bb734", "value": 115896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761567579, "uuid": "bd22a6c2-7453-4959-8adb-113f4a4b82ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761567579, "uuid": "e1bc201d-4705-4160-9b34-cfb21ff37e4d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1348709-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761578067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578067, "uuid": "524b1c87-bddf-43e8-938b-f01784efdfe6", "comment": "Malware payload (AgentTesla)", "value": "7ac97842bd30072306eb70caf995babc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578067, "uuid": "efddcb85-a2b8-482b-bfd4-b1763ba3d6d8", "comment": "Malware payload (AgentTesla)", "value": "16fb4eb3ecf363cb722bcd4c25f25db3abbeec05eef1c14c32babebb62359b4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578067, "uuid": "77f7a51e-85b0-49c0-b7d6-9fe0c2f3f50f", "comment": "Malware payload (AgentTesla)", "value": "33510ac7c22d9551b7d83834edcc524fe9c02618", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578067, "uuid": "eecf4afd-ca24-456d-971c-e9bfc25e290e", "comment": "Malware payload (AgentTesla)", "value": "83ee69851927330517056f06286854741a5d4ba8eb11bae6530c39ab545ed226d22f1af11febd8ab14c868ad061489a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578067, "uuid": "3d5d8afb-3612-4279-a0ba-6a73b6c8472a", "value": "T1DC35331E28BC0896C718CDBA247FBB4A83F5E49626D7D4ADE140E4C590383CA779CD79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578067, "uuid": "3e7509b5-306c-4fe2-b9dd-9a1ae3a851c1", "value": "24576:HbmwReDuYITKNF9grLBy9MpHhEhwVra+BI/9WXwEU4a9ZDb8CHpoVZ12/:7m4nrKN7S7Pe+BI/9dEva9Jb8/2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761578067, "uuid": "cdb6252b-b20e-41b3-a34d-473f93d10852", "value": 1133084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761578067, "uuid": "1b70dfc1-b587-4577-8c55-069572d02a52", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578067, "uuid": "bbcfd1ea-0f99-4179-802b-1b30d3b2dbed", "value": "Swift_coft.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752e6684-b307-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761550506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761550506, "uuid": "bb143a66-3123-4a00-bd44-26ad1bc69da7", "comment": "Malware payload (QuasarRAT)", "value": "156280dc98ce13fddb21fac49dcff002", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761550506, "uuid": "cae3ded7-41ba-4b91-ad58-fb1103642044", "comment": "Malware payload (QuasarRAT)", "value": "1888dad764c782fdb3d8cfce0916fd197e645231f3cdc28e4d45d1558a0935db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761550506, "uuid": "082362ed-3d59-4b10-adb6-d4dea9666ab8", "comment": "Malware payload (QuasarRAT)", "value": "dfae4d7db0fd05688f4c57427716ea634760fc1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761550506, "uuid": "9a28ba5b-d621-4cb9-8028-b6df8f2808ca", "comment": "Malware payload (QuasarRAT)", "value": "8a10259bfd6607606d425059552ecb6800e3ec381fd43469bdf08c458a2fffbf346c6646fdaef78ae3f302b9b8fafd8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761550506, "uuid": "4866ba7e-2256-4cd6-8848-21d30ff2016f", "value": "T194E56B0437F85E72E16BD7B3E5B0501263F1F82AF363EB0B5181A77A5C93B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761550506, "uuid": "6d942fd7-0dfb-47be-b426-4cf54ec2233e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761550506, "uuid": "ddc9246b-dec0-4cfe-91f6-0f8f7a08c1c6", "value": "49152:evkt62XlaSFNWPjljiFa2RoUYIhg5qihwoGdQEBTHHB72eh2NT:ev462XlaSFNWPjljiFXRoUYIC5qie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761550506, "uuid": "6138d270-639d-4615-b670-cbf70457f4c5", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761550506, "uuid": "01dd7949-b0f1-4c54-b28b-e6c20266a12c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761550506, "uuid": "2dcccb92-b3e5-4f71-91de-c0c0f9fe718b", "value": "156280dc98ce13fddb21fac49dcff002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbd09a6-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761556880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556880, "uuid": "72afbf20-5249-4ecb-9cb8-c5a67d4b5e0d", "comment": "Malware payload", "value": "21a4d56107555cfe6517a9adf529f46a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556880, "uuid": "7ef914f0-d0f2-4670-98c7-299bbf3ae665", "comment": "Malware payload", "value": "18a5c47d750e80a52324ca158b11d5949c2f5748d28ddbe0723459a7dbe2a050", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556880, "uuid": "67f2a341-52f9-408e-8895-337bf40ce4cb", "comment": "Malware payload", "value": "723a3fb8865300c2beebef94601977d8a287a39b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556880, "uuid": "3a2366d9-c641-4c88-9192-715f6e34e2fb", "comment": "Malware payload", "value": "8da5cbd42c1e64846705262aaf60b961beaa0ced0713b58c47e776b5a6b4e2261db66b3a12f7697cc9adc59e387249c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556880, "uuid": "6ebfa706-e164-45cf-8bb9-ff1a2e9e7e1f", "value": "T1E6254BA1DD28075A8E4727EEAD9047A2C56EC609443381F5F2E90B4E7306CECE37E56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556880, "uuid": "c6101ff9-1841-49fb-92cc-6ed35d4c9515", "value": "6144:cfYcCfYWf+fYdfYy4fEfYc5fYdfYtfMdf2fYlfsfY7fYcIf5fYffYNfEfYZfzfYN:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761556880, "uuid": "65bac8bd-3ea9-4063-b4a9-eedceb0f2619", "value": 1037156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761556880, "uuid": "e462e233-2cd4-410c-ae22-98cb85c70dee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556880, "uuid": "76fdc11a-3a86-43d4-9302-a618ff75346d", "value": "Request for quotation-TAXC JAVS-129812122896066_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ac7f1d-b34c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761579999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579999, "uuid": "9b5cb034-147d-4e65-98eb-f138c87791e2", "comment": "Malware payload (Formbook)", "value": "b4b2d901ae9dcbf0ec2c416749f99ec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579999, "uuid": "087896ec-e220-4cd2-86b0-c34c0ecd9d27", "comment": "Malware payload (Formbook)", "value": "19969e249cc3273a55861163c5a3390dc8a8d0466ee8b807549d238fb2a88122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579999, "uuid": "3aee87c7-2a52-4889-87c4-22da26abedfb", "comment": "Malware payload (Formbook)", "value": "c631e3dd4ab0d1cdaf0159e1808af2678ecffe00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579999, "uuid": "dac2e2ae-8d32-4cb6-82af-9263eacceb25", "comment": "Malware payload (Formbook)", "value": "e3e9dce9c0cf59862d1c2b574001ad1fea45dd47290a6c76ffef015c42926569ba1d6295745eeb793f735e157d042567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579999, "uuid": "b880c253-d043-44e5-b40a-f0da2facd2cf", "value": "T18C45BF027391D062FFAB91334B5AF6115BBC79260123AA2F13981DB9FD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579999, "uuid": "eef64ff7-8ffd-4480-b0b7-4340406feda1", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579999, "uuid": "c9f46fee-44f8-4edc-87f0-5221b9639d13", "value": "24576:v5EmXFtKaL4/oFe5T9yyXYfP1ijXdaJDGM5zGsq3ljA:vPVt/LZeJbInQRaJB56sqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579999, "uuid": "1f4adfad-127e-4f8e-9c90-b177dec8ad8c", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579999, "uuid": "2ecb9075-4d96-47ab-af53-c531cff756ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579999, "uuid": "c0ade353-f171-4208-a000-417ad0d5c533", "value": "Aramco HJ444333319088888888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5438d791-b308-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761550880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761550880, "uuid": "491af373-60d9-4e33-a447-83d89781166c", "comment": "Malware payload", "value": "a595f77eb966347361757ce6b1ed0948", "object_relation": "md5", "Tag": [ { "name": "LnkRun-BL", "colour": "#439EE1", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761550880, "uuid": "ce39da7c-3d60-4f5c-83fd-21a0a92ed766", "comment": "Malware payload", "value": "199c208c5dd7010aaecb5a2ac9d1e16c5c64bdae121ff4c13b835bb5d3ce24c9", "object_relation": "sha256", "Tag": [ { "name": "LnkRun-BL", "colour": "#439EE1", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761550880, "uuid": "d140513b-96ec-4677-b3a0-0e77d138a866", "comment": "Malware payload", "value": "7601e6a5c4e039f30b5b479b7734b290e7645b96", "object_relation": "sha1", "Tag": [ { "name": "LnkRun-BL", "colour": "#439EE1", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761550880, "uuid": "381d3718-0279-45b0-8ea5-42c4dcc1e9e6", "comment": "Malware payload", "value": "15a3c19b33f60484965e7e022c2ca0af4c0564ae2520791980755f1985e2756df1e6eac1cbfcfdcf523424f3bcf90acf", "object_relation": "sha3-384", "Tag": [ { "name": "LnkRun-BL", "colour": "#439EE1", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761550880, "uuid": "46da33b6-b904-4951-b128-6e42df75dcf7", "value": "T19F15335D5E90C836A0E36EC9E7385F64D3D736E64A717EA291CA92211C82BDFE0313D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761550880, "uuid": "da646268-084c-4f85-b7f9-6e5850886317", "value": "12288:PlK5k4n1vlRvmQlXxv/ppHiABPyI6/xGnE6S6LjyUZzbU1EdlC1IBY1tO82bSJ:9K5k4tlV1biWyIGuE6S0jRxDdlCWylJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761550880, "uuid": "ea8ef144-b8f4-41c1-9ac6-f5757376e298", "value": 889125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761550880, "uuid": "0351b854-b63b-423d-83c2-3a31f26a4934", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761550880, "uuid": "79a22b28-0ad5-40c6-90ca-dc5525737cdf", "value": "BREIF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f751af6d-b32b-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761566186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566186, "uuid": "2f4cdbba-1a32-45f5-aa51-fbd659d618f9", "comment": "Malware payload (a310Logger)", "value": "5e007749ce7d3db2a7d5cb6a9456e6ad", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566186, "uuid": "b35ce563-ef9e-49ad-b561-8265f5be5f2a", "comment": "Malware payload (a310Logger)", "value": "1a67e3d11a02fc98db956a82340065c8e1f5fd39db75bbe4d0e21262e9fffc9d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566186, "uuid": "40358fce-3445-4993-8830-147044239ca3", "comment": "Malware payload (a310Logger)", "value": "5369e1137f1b3d7d7d9ba589518d78f4d9d82570", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566186, "uuid": "e595ebdf-b846-4b20-a776-6dc411f5baaa", "comment": "Malware payload (a310Logger)", "value": "71a1964a1a7521e2da9d28e31c96b19e5ff457f7ace552457b5497279de182ab3ec08f78185c1d176d2551cc9af61d88", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566186, "uuid": "67d61e22-eaf1-411c-b9b5-ee669df27d1e", "value": "T16B151249271AEA06C6E52BF41E70F2B50B293CADA532D30A1FC86DDF78A1F159D01793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566186, "uuid": "d9697a8b-7603-4d8c-898d-7b65c6253ff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566186, "uuid": "ffa2d430-f167-47e2-993e-2cc5f55b6644", "value": "24576:EQyJyXlsHcRLdROlvCb18nXSGCi+U6OD0p7SV:byEXwY31mSIZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761566186, "uuid": "f48247f7-6f8e-4c78-a194-e54db19fd117", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761566186, "uuid": "b1e740cd-ccba-4b63-9c34-20b6e7649d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566186, "uuid": "0157387a-e2f3-4824-b6f6-0859b050bbed", "value": "Untitled_27102025_135412 2449 No'lu Talep.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c487aced-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570825, "uuid": "61839c97-c518-4b5e-9ffe-07e0fbc15899", "comment": "Malware payload (Mirai)", "value": "03cbfb77aae1993342b3e8eda4b6b1a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570825, "uuid": "ba32d4da-dfe1-4644-8a3c-747a6e1d635b", "comment": "Malware payload (Mirai)", "value": "1a6b839a30a459e32f83dfd18311dc2727547515cb9caaa9b7bcadf0726e5b38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570825, "uuid": "c9541015-6f1e-4d46-ae5c-42c7f32a0966", "comment": "Malware payload (Mirai)", "value": "2abd75a8205a319bb1411fb62e8dcc7a74703edc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570825, "uuid": "548eeb76-9245-4745-b5db-610e731bc4e4", "comment": "Malware payload (Mirai)", "value": "4b8100589a8be2a45d6197490f4b7b1964df4d082317e20536394051f95b5c538139bf7a43b7f659a1ed00215eaa2103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570825, "uuid": "473774ca-5b3e-40b5-bb46-816717de6579", "value": "T1A5336C36E029DED0C6560134A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570825, "uuid": "bd11785f-2610-44d9-96c2-72adb58039e6", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9pm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBQm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570825, "uuid": "1ba106e4-c04b-4395-86a9-900c33ea89c5", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570825, "uuid": "0b0443d9-a42d-4327-b31a-527d4ed40046", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570825, "uuid": "eab9fb04-3797-4ca4-90c4-c20c3e255663", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eabf5de-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577929, "uuid": "19b126b2-efcd-4677-8692-38a7026978ee", "comment": "Malware payload (Mirai)", "value": "87c99ba9b1cfd4ba329f64c57ad71326", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577929, "uuid": "04cd17b8-4740-4597-b2ce-9740bd4fa115", "comment": "Malware payload (Mirai)", "value": "1a807552746cdec61f1f2a7b0e585b8cb381247d22574eba8e2707d50ab984d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577929, "uuid": "69f32073-db80-499b-b737-8d82dbbc01d5", "comment": "Malware payload (Mirai)", "value": "f819a72fc72826c3f038fa91c0f72213029485da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577929, "uuid": "aa2913da-5fc4-4fe9-9039-13de38a2c07c", "comment": "Malware payload (Mirai)", "value": "30345cb8b2a4c8524a521f09fce9dea02761ab0af1f899bf55a35364e2a3922e8878b7e2705988b1b35e61c3ee3b748e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577929, "uuid": "9d7d1524-4442-4a3c-a18f-c68d1545d0b6", "value": "T1FE73AD63C41A6ED4D1494174B0B18A701B93F158A2A31EF62EDBC279848BEBCF91D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577929, "uuid": "85deb64c-ef1f-4f64-ac9c-589f1e3c0fb9", "value": "1536://QSW2iKia1UDDcqTeaC9qIaeBC85cK2orUO8GAtwC72fz5k:/4Sr2CUDDck6oIaOCKD2orLAtwbdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577929, "uuid": "80b90a8c-b630-42c7-a24f-15fd2b1b43b3", "value": 75116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577929, "uuid": "de76a724-5b8a-4de2-84d4-45394b487663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577929, "uuid": "829c99e4-785a-4c05-aa3b-fd1ae6569e7b", "value": "kvm.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a7da84-b350-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761581732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581732, "uuid": "a65f0e3c-1df6-4551-931c-50645d879892", "comment": "Malware payload", "value": "62f61d9f528c90ed388bbbe142fbecab", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581732, "uuid": "e25b6b37-aa5c-433c-ad16-7105d28742fe", "comment": "Malware payload", "value": "1aae99b733ab72044e157732a6c1d917edf704851d0c4fe38578c0175121408b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581732, "uuid": "20294888-90f5-4b5b-8359-f4eea229786d", "comment": "Malware payload", "value": "0ae3382efa537b4bc77163277a657af17926c22a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581732, "uuid": "9be37038-d29e-4a59-b4f6-5fc93f648765", "comment": "Malware payload", "value": "4202c33a655c649032aaad7b4488e0a9cf47f638b6effaf702d0d6f5d9790d48426c843e287e40bff37488153b0337d6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581732, "uuid": "1d1f813e-52ee-4ea5-8ed7-1c9f5e901ef1", "value": "T1AF76D011B7868136F1FA023059B96355867EBD718B3186CB77C87A5D2E716C0EB32B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581732, "uuid": "6b458a0a-3b2f-49c0-803c-71e71ed11d8b", "value": "196608:LKHGL2yAhIW4W6ZsYHVkKforaFLjLYx5n9u3+Y+g:yGSRILjZ1VlQ0LYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761581732, "uuid": "cdc79a16-431e-492e-870d-402802869629", "value": 7410164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761581732, "uuid": "46c77a42-9f09-452a-9370-e570f23c8ecc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581732, "uuid": "fd30b55e-e87f-447e-912f-4238da1bc3ff", "value": "TEEKPBFU.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205bb9dd-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579140, "uuid": "e240aa0d-2ef5-4faf-b39a-12b4e8c87d6c", "comment": "Malware payload (Mirai)", "value": "fc394436c4ef92d7ef5811e72cf1c471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579140, "uuid": "16ef10aa-e3e0-4ff1-bf4d-ffed7772aaea", "comment": "Malware payload (Mirai)", "value": "1ac43ec14170f15c4a9a02b37bc3798fe0128008a56b7cd6571b58f64c742cdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579140, "uuid": "b1aa6909-e03f-4885-b449-c72d1aa1d93f", "comment": "Malware payload (Mirai)", "value": "8e19e9dd4c6d9dd461d80ed2484037b612fca5ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579140, "uuid": "1ff755d6-bd90-4f05-84b9-205a001373e0", "comment": "Malware payload (Mirai)", "value": "e89126f260ac412f8d47d7cdf1e3c48acef1511be377f2e6b56316e91449fa9aa567b50d1ef5ff7849ff2a51d743754f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579140, "uuid": "bc3e1a0e-bf80-4173-a02e-2e55587066a9", "value": "T1F93318D6B4019E7CF95BEFBE80124909BA31625251930B3B237BFD936C322A48D53D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579140, "uuid": "c2d05862-2a2e-4115-9819-a81b61c5c269", "value": "1536:kutWMN1XtflsF+Cd9bLdCHXnRVPaVA5r9v8i:k0HlO+EdAX8A5hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579140, "uuid": "01c802ae-02df-4e8a-9a1c-a48f595de440", "value": 52496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579140, "uuid": "e0dac533-0c0d-43d2-9d51-ebc7ef31c9c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579140, "uuid": "6eecf6c9-eb94-48a3-8d53-8f88c021b131", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe57d708-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588531, "uuid": "9e297567-9230-497d-89b4-d426e982758a", "comment": "Malware payload", "value": "86dad9294fa0fe2073fab8eaf6b9483a", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588531, "uuid": "9612a86c-eee4-41a0-b906-e61f30e95a5c", "comment": "Malware payload", "value": "1c772b07b7b7cfbefc147d3a816b5a52b4dbb149b5ecd18b37a1899909d0d1cb", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588531, "uuid": "07ff0727-cb4c-4b5e-8f12-8376057c2740", "comment": "Malware payload", "value": "1548d957058fa79dd26f7068905c5cd65fbc9a36", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588531, "uuid": "8074503f-7193-4abb-ac21-e1d8fb67f6c5", "comment": "Malware payload", "value": "ff046da0809675b9e8a8c286329baa6a40347e42a98b82186d420f6eecb74f2cfa51a0d70b300905b368c06c6e5f07e0", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588531, "uuid": "5861cf7b-17c0-4d45-a80d-2d6c706f8196", "value": "T18F4533764074B1E5EA088FBF96B6CEBE34815074175FD618AE2BCBA9B8073C38C97445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588531, "uuid": "e42cf015-1654-444a-bd6c-5ea5ab2e4ff8", "value": "24576:iTdKZ3VirhJHb5fCpCSH2fr5JyxmvXACYcP9+CgiMCIG8KW+a/wngRx:i5KVp7H2HyxsXAxI9+CjyKGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588531, "uuid": "7f1a2c3a-60d7-4326-83f2-0181ab408139", "value": 1174331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588531, "uuid": "8fda70be-4bf0-48a5-9ceb-b9d399e6cf97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588531, "uuid": "5c5d3c06-3964-4895-aef4-1ffb84134fc3", "value": "PAYMENT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f9d50f-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579125, "uuid": "6613a4b8-7fdd-4c5b-888c-fd0488daf804", "comment": "Malware payload (Mirai)", "value": "65b155faee8eef5df1224f938d50e22f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579125, "uuid": "98106927-3da3-44e2-9251-3c57f408beea", "comment": "Malware payload (Mirai)", "value": "1c897dcb5998fa724629935692c3cb502459bdb55a0b3abddacb3069d374f07d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579125, "uuid": "cedebe44-c3fe-4ebb-997e-058c6ebd125a", "comment": "Malware payload (Mirai)", "value": "586b10de0d2810bae05a94562bc45e5170aec2c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579125, "uuid": "099c8ef9-82a0-4455-9613-23f2ba222345", "comment": "Malware payload (Mirai)", "value": "6f6c4dfcecb638a4da5f42d7fa52d1041509f9a1e3977e629bdb5726e29f97404c7e35feb014dcb26386dd2249a40ad9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579125, "uuid": "f2afec44-a49c-4e91-a87f-fe67217259f0", "value": "T1DC73840E2E619FBCFBAD863587B35F209248339226E1D545D19CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579125, "uuid": "b25da7df-3fa0-4ce7-a396-5dbc6cb7caef", "value": "1536:G4Z8LUay6+vl/R1KIdysUmR9EiYHXwAm+yhQXHcZjDETj:B6ry6+vdGIdysUK1+yhQ3cRDIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579125, "uuid": "3aad6be2-7ccc-4415-9372-d716e02a44e9", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579125, "uuid": "d60a8e87-eeaf-4c2b-9ec0-78cec8e40c75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579125, "uuid": "b15bc237-fcc7-43d4-b6ad-32af7a29fc07", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bfed61-b35e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761587950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587950, "uuid": "3a9c1887-d4ea-48e5-9571-e0aee2a69c6c", "comment": "Malware payload", "value": "41c52462025f68f55ec7c9838017b1f4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587950, "uuid": "e2f4c531-96da-4d78-a1ea-63f932d083f3", "comment": "Malware payload", "value": "1cbbb5dfc0c192f12c73ffef24f957c47bf36fb0c7c3b47076bac0872fac33a1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587950, "uuid": "94aa721d-6618-45d3-ae43-d6125dd9fd8c", "comment": "Malware payload", "value": "73a626b568091d04636f572527b2b03df1ad8294", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587950, "uuid": "9c0a712b-4861-4db2-a7cd-7a857e0369b7", "comment": "Malware payload", "value": "e3e0ea07bf5ac0c6d5f74e531c6cada91796b50e06f0c15962820695265d08859c72c266669e154cb6fbdc733f31a1c5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587950, "uuid": "cc54cf6d-f361-4fc7-b20d-5f2c20f74cc5", "value": "T1E706122C9934B99FB2D8617C54F6BA1B13DCDE81CC3912EDB14897D21E5CE704A2A24F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587950, "uuid": "49a286bb-2467-41a9-a977-ffa05d2d2129", "value": "49152:77DW5f3pMsesYyNX+EGpKa6C+9a9YTg7CuJWuIf5WJkYrFVTsz0nE:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761587950, "uuid": "a8f9a7ef-c7d0-4427-82de-a21f93496e64", "value": 3977155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761587950, "uuid": "16064762-814c-46f9-9218-05c3130acf50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587950, "uuid": "1c6b6ac8-a68f-43f8-965d-0d74ee986222", "value": "20250804.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6976a84c-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595583, "uuid": "6e0b832a-e303-44b8-9952-5c0a0275ce21", "comment": "Malware payload", "value": "e155470cf2a008334fe442cd9606b995", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595583, "uuid": "5a24765b-042f-41a3-965d-04b455616209", "comment": "Malware payload", "value": "1df1116823e298fc83cda2cc1c6f750d53f08c3506b0ed5823332dcbf1fb0ab2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595583, "uuid": "d2535e0d-0e66-42c1-becc-a38c895bb070", "comment": "Malware payload", "value": "7c05fd98888a20e531ef380f7d3fa4a2b2e5fef8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595583, "uuid": "54d1cd87-87b7-4e81-8877-849e8cea36f8", "comment": "Malware payload", "value": "1321ff2636cd91661bbb0097f4dc54becd6013ab6b51178f48b31b2035cdeb4b85ce1df6fe0fde55f0c745edd19fae6f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595583, "uuid": "d6e12000-371e-4104-abec-d5b046d461d2", "value": "T10AA6BE1493E900B6D86BD634CA55D333CAB8BD929631C50F198CE6C51F73E629B2F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595583, "uuid": "33235f2d-acb9-4887-b6a1-48208ab8c8ca", "value": "5dab9230d6252167e5f02d4a8a9d75c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595583, "uuid": "71b4ac1e-575b-4dee-9a9d-e3c5d9a661ee", "value": "98304:yzwqjI+Rf21XCPZ9DWenb6SAfWvNwHnr7B6pq21bh5Dmz0:y0+21Xk/DWeb+fKwHnr7B6qz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595583, "uuid": "5ccce99b-9154-41f4-828d-fa1dfc032e25", "value": 9832216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595583, "uuid": "d1e33db7-86f1-4068-89af-787af555148b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595583, "uuid": "f7904c65-4c31-469f-9e41-56c93f57d49d", "value": "encoding-conversion.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3e5bbb-b2dc-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761532021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761532021, "uuid": "b637b58b-ec20-4686-8008-1bb2fde61771", "comment": "Malware payload (RemcosRAT)", "value": "fd71d249efc89846992ed810267f7b03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761532021, "uuid": "99f902b3-020b-4bf1-9e14-8c02d8ebfc3c", "comment": "Malware payload (RemcosRAT)", "value": "1e4d2dded318d08dcde3ef44bd77c14b8de3626c215c542c9ffee396d84b9d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761532021, "uuid": "0863733f-4259-44e8-aab4-a4c5a81f0195", "comment": "Malware payload (RemcosRAT)", "value": "c1500c990e6061c2cd0fe63244c27ba5e9a40f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761532021, "uuid": "fafb7a06-05c3-4401-9338-7dca4a857704", "comment": "Malware payload (RemcosRAT)", "value": "db762722659c2b2952778c0cfb925ec15249dcebdd736a03344b87072cb42c99339b08516f9a28d4fa8227b511ce3841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761532021, "uuid": "00e4439a-3ea1-48a6-95bf-733c05a95909", "value": "T1489413002650C6ABEC9641BBD5346AFF9775FC1EE98291034B5DBF4BBD310C8EA1C19A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761532021, "uuid": "c9f40622-ca02-4d8f-895a-f91ad2b8d3a2", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761532021, "uuid": "b308f022-0ac0-410f-a9d6-2cc156e1728a", "value": "12288:LcE8OLszQv29mRF+78R6Q3cJn1ykj9Eq4NdYBx4MCA2MI/zQW:Lt8/zU27wYQsXj9EqSWBx4Lf/zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761532021, "uuid": "f87b3101-7e9c-4324-af3f-6f957b04689f", "value": 433176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761532021, "uuid": "b03f972b-0eef-4b26-a1a1-807c9aefd055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761532021, "uuid": "4eab0da6-427c-4296-a773-aa67371dfecd", "value": "ORIGINAL INVOICE COAU7230734290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2b3e63-b303-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761548939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761548939, "uuid": "2f62b615-c4d3-49d3-a986-4b621f62011a", "comment": "Malware payload", "value": "198a382c834d050d4c69a649119b52f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761548939, "uuid": "3d63e0cb-aa08-44dd-9574-36956bbd5fa2", "comment": "Malware payload", "value": "1ef7a75de8999627c5d47f4aed407a2f64260e8b96aa4625426229f2d12796da", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761548939, "uuid": "bf019286-e62c-4e23-86c6-f9334de2b849", "comment": "Malware payload", "value": "2fe7498628f070c1a4cd733c61fd9d6648fabf9e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761548939, "uuid": "05f7bcac-f537-4709-9da9-9866841848b0", "comment": "Malware payload", "value": "591427ea46870789d2c6078c581eb0cf956b682c56eae62fba045c561a47c75fb14d3e069552ab245850b412e0368bcd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761548939, "uuid": "d8a0a19a-8a52-4707-89f9-70a274e2504e", "value": "T19C42B59DB2C7F06543937635901F100AE37A5869B44DC098E329DCE2FDB845E922BFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761548939, "uuid": "0a3a2d99-ca98-445d-9984-79f6ecda8b3d", "value": "192:eLYtnDYprsNuiqARbCyqqydqNPtyLYbsuqj44SdH2j3HndRyaARVBmzfODH3o/cx:oprsTbCVQ5tyK4xSk3dR+vEfODHDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761548939, "uuid": "3287cc6c-cd10-4e8b-b2b6-7fe6131eb92f", "value": 12213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761548939, "uuid": "1b1460ba-35bf-4e76-b2e5-d5aaa492df07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761548939, "uuid": "093eeaa1-f56c-4b2a-9c50-57d9b25481e5", "value": "worker.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a81e774-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577922, "uuid": "42f702e2-3240-4865-8c59-8b72700dc056", "comment": "Malware payload (Mirai)", "value": "26dc37768d99b912e9f24f14087b60c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577922, "uuid": "c9cd78f8-becf-4286-ac4f-104fd9a8961a", "comment": "Malware payload (Mirai)", "value": "1f2ce137ed66737f93f8c811e117bd5fe75673799bcbdcf9c11e1f5ba8077519", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577922, "uuid": "febded9e-813b-4d37-bcf0-a74ddfca1438", "comment": "Malware payload (Mirai)", "value": "13e9f6fb5aa76517bc2db4ce196d37c43b2fadea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577922, "uuid": "ffb0a80a-ddb0-4973-b02a-aa17a4baaffe", "comment": "Malware payload (Mirai)", "value": "b3fcd3107330030ac2bfa01b02c0a7944a6a503be2308de3961e3f98bf6b13be47b4fe5b82541d00f732e4f6e2d4ce6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577922, "uuid": "32a4dd47-8187-4fa3-a0a8-bcb5f4f96c81", "value": "T1CAF2E146874E1FA2F36EB9B96FC5CAC27364AB8039EBD42065507F691393074875CBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577922, "uuid": "17d26857-98f8-4948-bfdc-d97d59995b17", "value": "768:+o2y1iRZPB9QC2xVSHkNJyF9qCHj9pzsQCHBcyp4uVcqgw0t10tLyr:syA5BwJyrHj9hsQCCK4u+qgw0tYur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577922, "uuid": "d92687d8-db46-4807-807e-21a9a2843ccf", "value": 34276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577922, "uuid": "df3763d3-baef-4fbe-9433-4263c050ec0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577922, "uuid": "2b261492-5b46-48a2-8bf4-a7b34a9ea5d4", "value": "kvm.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42376e3a-b360-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588645, "uuid": "b3f5da1f-c23f-486e-8401-63117b1f3059", "comment": "Malware payload", "value": "cd1b08f4930b276ad78853580b76b5c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588645, "uuid": "26cbd648-7249-4d8a-80b9-3c95571f31b5", "comment": "Malware payload", "value": "1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588645, "uuid": "f5dd08e0-55a8-483a-a06f-d7476e6de201", "comment": "Malware payload", "value": "a0330279d3d0d47f19ed984726e25260b547a228", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588645, "uuid": "0d50f93f-9c51-415b-846c-885bd4eca377", "comment": "Malware payload", "value": "d3c6592907468b7893b87b91173a52f4d3aeeba1bf78455c2f56501f7bce86fb99b6ca9500cf2290ed182bde97d6c3f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588645, "uuid": "c56359c0-c5ee-42bc-ae0f-7e8e96e6539d", "value": "T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588645, "uuid": "b1c48be2-0db1-444e-bcfe-b747714358ef", "value": "faf1de4e688195ca9bd5697cb1dccd29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588645, "uuid": "7c0d66ff-7673-4625-9c17-6a49feafbffc", "value": "768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588645, "uuid": "1ca6cc7d-92be-4d90-8abe-2902b9a36009", "value": 49792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588645, "uuid": "25e269db-099e-48fb-a8c8-defcac3dabcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588645, "uuid": "aacaec83-00a2-47d8-9f83-0115eed47ed5", "value": "VCRUNTIME140_1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28495d4-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570822, "uuid": "bd6fd180-e502-457d-8b54-789c648b4109", "comment": "Malware payload (Mirai)", "value": "bfbe21ab35859adf7040a549e7510fc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570822, "uuid": "a66380e2-a13a-4cba-8f3a-ee2f33c15ea4", "comment": "Malware payload (Mirai)", "value": "1f9bdc7b410236e41c9d0201ef017c0a4d518500ea5184ee39f3dc9d15a08144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570822, "uuid": "5ab09c93-1d62-4fe9-81ea-eeef6d4f3d1b", "comment": "Malware payload (Mirai)", "value": "a9bcfb66383a56af7dbff31b7dc661554e78e542", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570822, "uuid": "7f01987b-786e-469f-ac99-4c792d7da14f", "comment": "Malware payload (Mirai)", "value": "e850c5a22d8f20519904873acd4ac543d691666106d05546e260967e6091fff76ef9f2a42a491480b8caf92158ac95c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570822, "uuid": "902ae1ff-46f4-4f1f-afda-e78429648f76", "value": "T169B2E174F642515EE08F63FCE13F42E1ECAADB5285A941172D3BEF2A1A5B011612CB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570822, "uuid": "6161438f-6080-44d3-aaaf-92c02ef930bb", "value": "384:MJiiBiccUIgcNADBQDDlXOYZLwT0qJmY1oAjy8G2QRN7PmrCvzTv1RHM:LiBiQI3ADYDgm+SAjViRHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570822, "uuid": "4b326a08-ee35-47a6-9ffc-56ea5eb4a9d3", "value": 23432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570822, "uuid": "d765c2c9-c873-4be0-8b3f-1fe5475970e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570822, "uuid": "a72f9efe-587d-410a-afef-af6487c2978e", "value": "dlr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a3d90b-b360-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588535, "uuid": "f5895f4c-f1a4-4716-a2fd-3b234028bfb7", "comment": "Malware payload", "value": "dbd76e2b7020be86a9d8e040746c69ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588535, "uuid": "32a5b780-98fb-4bd7-a09c-733423ad9e0a", "comment": "Malware payload", "value": "21a9c105bef33ed171ec26a576b19f6552976007c35064ae55a08b5a12e32c32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588535, "uuid": "f4cf916a-cbfb-4407-a421-41df6bd5c7b9", "comment": "Malware payload", "value": "8eaa6736badf0213a024d1478d0797b2f66a7427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588535, "uuid": "a2b016a7-55c1-4301-87f9-aad1e9c3da7f", "comment": "Malware payload", "value": "59763a981cc31c9fec198f3028da91283de4a03fa34b1e9a6f042fff9adcf236574faa6acf709c9cf88674951e6d3a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588535, "uuid": "f848aa5b-43a7-4c9d-a932-a90977c6b81d", "value": "T10F75D011EE919C3AF02E353ED86BDAD658197EE12A14B81E7AFD3A0C7F395D33416042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588535, "uuid": "bc85c88b-6491-4a21-96c2-ad42af5f2197", "value": "080f6115fbed3f9c6472d51d1ea66846", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588535, "uuid": "af10912d-9c0e-48ec-9823-4fbb8e113a1b", "value": "24576:EW8UvDw/+5nbjcVMplER4QTSCJWV62Wh7hsxD1Wk9QYCg4kIpQppE5HpzTp:Eiq9bJWIv8Mk9xC9prJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588535, "uuid": "de69b9a6-2563-4fd6-b794-2889c266be1d", "value": 1667584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588535, "uuid": "45ff70bf-dc19-4497-8e10-48445d7bfffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588535, "uuid": "368c26b5-cfb3-420f-ab8f-3db41258fb97", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9d764b-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579135, "uuid": "8049b4c3-c4a4-4420-b05d-bd6c0d8d05d7", "comment": "Malware payload (Mirai)", "value": "29aa48744fdc3efecc88754e5bfb53fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579135, "uuid": "6d5efca0-d9cb-410e-90ae-524c08c8fe3d", "comment": "Malware payload (Mirai)", "value": "236ae89fd65d12be32ebc853c0e0f23b4f501642b781524788dd4d975fdfe7f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579135, "uuid": "dcb18b1b-ad30-4fc2-8749-443cfa584cc3", "comment": "Malware payload (Mirai)", "value": "20ec17d95049b444a121c5e7f05908980d47bc5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579135, "uuid": "8aa62983-9d64-4f59-9239-673f635c455d", "comment": "Malware payload (Mirai)", "value": "08cb987f87b25a09aeb3d5ca454811c7beb1cc8c6ea7e2e84cdda23fcaffe7150f603ae63e640da6e0383f9204ea96e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579135, "uuid": "2dc46263-9d06-4816-81ae-939bef260b0e", "value": "T175237DA7C43C7DD4D15982B8AD248A3C5B23E016A6D33EF6B64785628047EECF6093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579135, "uuid": "dd327f41-e611-45d8-a7ba-9844c797d9af", "value": "768:f/eptstaT85n1Oea1wtgR0Qmqq1rKFjfGcQ1q95L3XGbtQhCWo29a1CaeE:f/6s+Yta1wtgB6KCi572m6Oa1Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579135, "uuid": "076dbc6f-3e04-4489-83b0-1ca2a22f69d1", "value": 47556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579135, "uuid": "d3b77b75-fffb-4170-a984-dd17450cefee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579135, "uuid": "55c96847-d7fb-42aa-8ac0-256c967609e2", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d000b6-b32f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761567577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567577, "uuid": "5efd8f14-0023-415e-b2c1-b8907be9a301", "comment": "Malware payload", "value": "3b21bc3003d32d2a8f46ba7008d3ff42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567577, "uuid": "0a3a6adb-6180-4545-b4df-6a53435c08dd", "comment": "Malware payload", "value": "24ce9aa053ab3dd562ad59027f50c1f2ae7658e2801c07c4f1ce65bbc5783910", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567577, "uuid": "7ff7fd99-c859-495f-9915-58511957d14d", "comment": "Malware payload", "value": "2179be5f98035284f4050f31b7106aca77a121a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567577, "uuid": "3022218f-4a93-4a3f-931f-8841a10ceea0", "comment": "Malware payload", "value": "69decf9d6bdcc86ba765f5341bae4262b9cecbd36e378a3857cf155ce5bcf4b94207a9deb1488c43be76c389a54594b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761567577, "uuid": "b18a7842-f058-42ed-a1cc-21b26d055ca4", "value": "T10234728ABFA13FFFD81ECC3342958A09129D490A52D8BF762A34D508B65B14E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761567577, "uuid": "3b4c592a-493a-49aa-8642-c397621e1835", "value": "3072:8cPW75oo7yUN+4coAMuKeWT9FzyRnzzRw:BToAMuPWT94z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761567577, "uuid": "bd54e60f-9725-4bb2-8a7e-4e094e8afbd6", "value": 231084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761567577, "uuid": "00b0ef5b-82a0-45b7-b283-d4e9254bd521", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761567577, "uuid": "276c5b58-fd7b-4dd2-9f75-6f455174c824", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cb1698-b345-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1761577107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577107, "uuid": "ff5666d0-bee5-4ee6-b696-9471b9c35c52", "comment": "Malware payload (ACRStealer)", "value": "97679b1291ee9e51e0ab025eb5f3d5e9", "object_relation": "md5", "Tag": [ { "name": "46-224-8-58", "colour": "#3A48D4", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577107, "uuid": "5aab529f-ecad-4997-9b24-c5f384ff2cef", "comment": "Malware payload (ACRStealer)", "value": "258bd09ae466b4590060a1c9057744f73d4e1a20d51684a6ec705d6464e6c573", "object_relation": "sha256", "Tag": [ { "name": "46-224-8-58", "colour": "#3A48D4", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577107, "uuid": "62be90e7-227d-44ae-a200-ef93b4c08995", "comment": "Malware payload (ACRStealer)", "value": "a6f59489d57def1d32d7e40025263170767cd1af", "object_relation": "sha1", "Tag": [ { "name": "46-224-8-58", "colour": "#3A48D4", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577107, "uuid": "5d0de17a-3bb7-468d-80f3-44aa31516346", "comment": "Malware payload (ACRStealer)", "value": "0abfe72dc939707c1a297cbfcec3b4a6f4bdb2c3af2e21815e003d0428c8bb751836b0dbafdf53ffe4f96f5aeb1e2728", "object_relation": "sha3-384", "Tag": [ { "name": "46-224-8-58", "colour": "#3A48D4", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577107, "uuid": "8db28348-0166-4583-96a3-87515a4b5f02", "value": "T1CFC6334D82BD71EDE13047F875A38A9194192B35DAB8C79E4BE0072B96CF4DAC8533C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577107, "uuid": "3c8ec2e2-dbf9-4bff-9ff5-955ce2bc9ef7", "value": "196608:fbdvLhzadXtJGIjla+ANFHk5lkEQMwSVTYQa/oduUZWrcGgB23xMo/KXp/TZx:jdvLhzGXycM9k5lj4Q0UZNo/KXp/TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577107, "uuid": "0a46bdcc-8554-4264-a383-eb1fec9fc6e2", "value": 12476069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577107, "uuid": "1fede2eb-0667-4d7e-8df6-08831546bc15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577107, "uuid": "d756bb32-2d51-4e34-8b3e-1fe773d538bb", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2275b504-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579143, "uuid": "bcd4c82d-7cb4-4c66-885b-870f350c20ae", "comment": "Malware payload (Mirai)", "value": "bc7c407b4682a116e172246e012145ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579143, "uuid": "b87d3370-86d8-4b9c-8f55-5b12100c9b93", "comment": "Malware payload (Mirai)", "value": "2695ba132e9ea57befc69c76d0a155e158f86dc4ef96a037ed276ebd5e82397b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579143, "uuid": "098b2dcd-bb6f-4d75-832a-f8fa043cb60d", "comment": "Malware payload (Mirai)", "value": "95b1e4e20fbaaf5447a4f31ece0b3bd66adafe83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579143, "uuid": "0244a45c-39e3-479b-816c-06e3aff4d489", "comment": "Malware payload (Mirai)", "value": "ce52e51ca0fb4b998ffff5ac5d74ac96bedacfcb7f192a654c3558accb3f0aefc1b809b98441e40fe1bc6387d6ca2b1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579143, "uuid": "18822256-2d97-4569-99cc-72756a0760c7", "value": "T13473830ABF650FF7E8AFCC3789E91B45248D641A21993B797D34D818B24B24F49E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579143, "uuid": "d03d21f6-bc5e-4ccc-a1dd-8100e80cdc72", "value": "1536:vGFfut16/jhZRcogB2UHS8ZMDuPSwtOA3B:+Ffut16LhLgB2UnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579143, "uuid": "21ab2ccb-b2d6-4555-a518-a125c7056abc", "value": 79884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579143, "uuid": "d47e91ea-a80e-4f5e-a7df-d25a390c5f40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579143, "uuid": "a32b52e0-b03f-48ef-9ebb-7bbf0c734251", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b04bf4-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607012, "uuid": "dab7f15d-39aa-4daa-812a-dba56ead0f81", "comment": "Malware payload (Mirai)", "value": "222f4f54bc39f743641dcb7a62becba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607012, "uuid": "f46cca6f-8363-47c7-9aad-255b2a09e1cd", "comment": "Malware payload (Mirai)", "value": "26d10a297aae6d2e772b7bcb65710e60aa63ec1ef0fe2420d09fcb2ec0467de0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607012, "uuid": "256dd69a-e5c2-46e3-ba02-6326f4723709", "comment": "Malware payload (Mirai)", "value": "58179cb6f5b2815c2893822c56dc9c33a5d59d99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607012, "uuid": "a8619d16-e8f5-4728-9956-53b724df7def", "comment": "Malware payload (Mirai)", "value": "45482f230c32c61e43cf12603a4f195cd05dc2f5b05d539d48dfbbc3f5471a5b7160fee46693ba8ead50d685c74b1d6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607012, "uuid": "e73043fa-ecd1-4eb4-af78-cae817799c01", "value": "T1B0D30945F8505F23C6C612BBFB5E428D3B2A17E9D3EF720399216F20378696B0E36546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607012, "uuid": "c2858773-057d-4a3b-9a97-75a0cf76de88", "value": "1536:EKdnEPmm8uFrCZqGU7F8PAZYg4V9z6mTQnAYm0fF5Vhr8VBShAllCmwywnRl2xId:EKtrodh8P24PvUAYmwFtoOhS5WKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607012, "uuid": "2b572be8-37e0-4992-a950-3c994bfa3db1", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607012, "uuid": "75da3360-ca1c-4881-80ef-f90ebc42531a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607012, "uuid": "088d3e35-f434-4acb-86d4-7db760b982d8", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf22a78-b330-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761568126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568126, "uuid": "e78611ac-0ee5-4c76-b3c2-1b019f81f67f", "comment": "Malware payload (ValleyRAT)", "value": "8a3a09b52a981bc8978eed7616980905", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568126, "uuid": "45141e88-8dc3-4a13-aa54-2a0176d7cf79", "comment": "Malware payload (ValleyRAT)", "value": "27b29a4a67e5d22b2801a415d5677739d5900b6c72b433497eb9ee0e9960dfc2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568126, "uuid": "0b3a3f27-d2e5-483f-bedb-f32524769609", "comment": "Malware payload (ValleyRAT)", "value": "a091a5883ab665e5af2ba8ced575e86ea2539d04", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568126, "uuid": "464b78ee-7a84-495f-a1be-a8e5d2ca80ca", "comment": "Malware payload (ValleyRAT)", "value": "0970472358935a6924453a5f58590d160fb2248e904945ec4ee6023748bb9d642d8d7efdbe4c104f7385137bb9d15590", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568126, "uuid": "aba039dd-cfd4-49c4-aed3-d63cdad67732", "value": "T141768D11EF415111F8DF02BF59FE66BD493C6E708B9840C3518A29FAC53A7E16B3A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568126, "uuid": "79d23fc0-6bff-4b1b-b59b-6d52d19853b2", "value": "2a853ab56cc80c8ac7afda3afd9c6f49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568126, "uuid": "67e23c7f-8867-41fb-9720-a56582e385e5", "value": "98304:BWeSlLp6ToMACjPBDQTbTMvbi/jlYlG7LAAC:BWeSlLp6ToMACjPBDsMva0G7L9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761568126, "uuid": "78f72086-4a12-4f7e-8e9b-cfcc8b72af20", "value": 7529472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761568126, "uuid": "c949510b-8209-4ddb-813f-63899b80752e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568126, "uuid": "b9fd56a3-1a16-45ef-b572-c3985dc0eb8e", "value": "HPSocket.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23aa62a-b36e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761594846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594846, "uuid": "c88c51cd-3319-42bb-9150-9629bb878cb9", "comment": "Malware payload", "value": "22899bf7fcfa14def89397b63a8ef8ee", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594846, "uuid": "bec4c2cc-d852-4d0a-bed3-6cb40cd7cf35", "comment": "Malware payload", "value": "27f24adab8c696069e22233860851dd8654a846700483f6c4a9a8aa05f1b27db", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594846, "uuid": "6f789c99-a249-4466-b052-d070f23ebedd", "comment": "Malware payload", "value": "5a219617e12bac6bdeeb199770237649fe896023", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594846, "uuid": "34542536-692a-4035-a4fb-051b9ab2e683", "comment": "Malware payload", "value": "60ed520e1c39457fe733f3386170d05e7dacafafeafbd4b6b7516f3b79560c07da1370dd46d77c70172d8ec577e72881", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594846, "uuid": "171e1c2a-9b2a-48bb-8486-840e5fd551dc", "value": "T11CB7339476C5CF1AE20A0AB3E0AE538DFB3EFD43826599E74314B902C7725A17B5C21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594846, "uuid": "f51aa6f7-dfb0-4cb3-a0db-fb51bdc4da6d", "value": "786432:/iR/2hEtnpnc/+LFhhyVBlmTsfXlNGGwUn7i51Q2Nc61cWyEw4f0+lSDN1dvabv5:qROh2J5SyzGvi51drvMD3dS7Gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761594846, "uuid": "82ba292a-e460-4bfd-a610-473d9f038058", "value": 51052544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761594846, "uuid": "66407b0a-1c5c-48a3-a134-1eba9b087155", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594846, "uuid": "0e4fd084-c2df-4935-8201-cf361d4b5faf", "value": "AzureVPNClient.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9a6204-b363-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1761589929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589929, "uuid": "2d9f6d84-1d95-4cbe-9414-5a9f7e62bc9f", "comment": "Malware payload (GoToResolve)", "value": "256217cb5a9bd702edd2618cdf4bdf46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589929, "uuid": "5ac910ca-8311-4caa-88b4-796595995e9f", "comment": "Malware payload (GoToResolve)", "value": "2a20d6e49a8dc3766f67a2dd820f4ba42c3bedc3a1905437ffc834b80e6f3a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589929, "uuid": "0152ce69-df0c-4fcb-a7fe-52939546e7ca", "comment": "Malware payload (GoToResolve)", "value": "5514280ea94d07c6d29ef92ef66bf5e653126295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589929, "uuid": "524ee484-d2d4-48dc-9324-22b7909118a6", "comment": "Malware payload (GoToResolve)", "value": "80645a4de221ebf8c8165fbb0c03255cea4ca5d584a14dbc488831d333fc2ecf8dca93202276f776fdaa0e1fecd9069d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589929, "uuid": "7140a2d2-b331-4496-853c-5855f2e8f584", "value": "T15D37333132568471CC5211F1E929AFBBD66D6D248BB208D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589929, "uuid": "d7fd2ba5-4bcc-4c2e-8503-5e1f6dbf5749", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589929, "uuid": "976dd299-9c1a-4528-ab1b-ee35ff1858fc", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXp7:q9WtLzgOTbjZvk/ekS/mcp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761589929, "uuid": "4b035a94-75cb-45d5-89c1-fae2d6fb8c59", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761589929, "uuid": "05415536-d35d-4808-9677-2db22ac113a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589929, "uuid": "150c732d-0893-4635-9db3-d0067c829386", "value": "Tax Amendment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd2d9ce-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761577736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577736, "uuid": "f87bc9ee-3e46-4684-bc2b-d7771b5e975e", "comment": "Malware payload (Rhadamanthys)", "value": "7101c48686b98ce7391206e52c1d2f28", "object_relation": "md5", "Tag": [ { "name": "api-lkofitjhecvr-top", "colour": "#D5ECC9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577736, "uuid": "d8396b29-d3e6-4dbd-9cd7-3e2c37988df6", "comment": "Malware payload (Rhadamanthys)", "value": "2a38e90788f3d07c3989c5d8f38d998d655ca37844ddd64ffb472e4e2f7b0aad", "object_relation": "sha256", "Tag": [ { "name": "api-lkofitjhecvr-top", "colour": "#D5ECC9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577736, "uuid": "b992c384-f86c-4dc4-8397-7f9e8eea1c66", "comment": "Malware payload (Rhadamanthys)", "value": "5e2e506e996b640f5b4bafd74632f8a8cb43a282", "object_relation": "sha1", "Tag": [ { "name": "api-lkofitjhecvr-top", "colour": "#D5ECC9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577736, "uuid": "b5815765-44c7-467a-b614-909a58f6d235", "comment": "Malware payload (Rhadamanthys)", "value": "5427f3c7d4f0040df259bce5bfe6755d1b0144202ec06d86a0809d82ab6f3a29f3b3c20310b57c9a1b17799cab8cc753", "object_relation": "sha3-384", "Tag": [ { "name": "api-lkofitjhecvr-top", "colour": "#D5ECC9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577736, "uuid": "6e25bc9b-c319-4dbb-bbe8-1f42533b5378", "value": "T105E61600A4D85A06FD7EDFFC999E72014F7AB1961601BB388F4259DD2AD1B68D8038F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577736, "uuid": "175c9a7c-16e6-4228-a146-b70baa001dfd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577736, "uuid": "212ef3b8-8464-4195-beb9-bfab28590665", "value": "196608:BzFVSCJSyUpSHJH1GlSacDMvlXjV7UA2f/xcl3MW5ik:bHT0vljVASuHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577736, "uuid": "62ce3e9b-0879-4394-94cf-5f6a08293a97", "value": 14449152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577736, "uuid": "5718cc46-71c5-4a21-9dbd-1efe0c9c71c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577736, "uuid": "b363fa42-0523-4381-a141-63367d5b735c", "value": "WindowsCodecs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dca7b1c-b33d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761573740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573740, "uuid": "66519c4b-93e6-43c7-adc2-a661a758330c", "comment": "Malware payload (Stealc)", "value": "8121881ff575d692f1f06205b743fe5a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573740, "uuid": "3309d1d5-66ba-4cc3-8f56-eef1c6580f7e", "comment": "Malware payload (Stealc)", "value": "2b091c0eab9477231eb8a65bf5094050829961f5e31580c466e3d228692ce715", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573740, "uuid": "9344f023-9e34-4146-816d-9b20749d1f7e", "comment": "Malware payload (Stealc)", "value": "df0584a5314651581f9d9d78e79fc2f07f49f598", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573740, "uuid": "25025048-2716-42e2-b79d-e0e5e340d387", "comment": "Malware payload (Stealc)", "value": "eb20093b8d4b147100ff7fa919e5e9f864bdc000b3750370dbfc87e65b7b012b84b751f5da4b1bb8129ceef077bcb589", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573740, "uuid": "f3020f33-5f03-4129-a121-44be9ef6d344", "value": "T12AF5111D22D49559FD1EDA32359B8220D85F6EDE285C93BF6368BB7EB73118DC022318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573740, "uuid": "749c90bd-405b-4263-a670-b60d05460d27", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573740, "uuid": "61eca0d5-fb1a-4ee6-b70b-95f25b886805", "value": "98304:kpmXKq6hbO8rx0ydQ4nutWmL2vJS214Zd3:kpmXKq6M8t0ydLnuImLqg2OP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761573740, "uuid": "b4fa0896-e542-48da-b91a-e8fb1ccbd7dd", "value": 3492288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761573740, "uuid": "4602907d-fab0-4038-bc05-d2aa40d2346a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573740, "uuid": "fa26bf0b-ecb8-45e8-a646-617a5a225357", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af108536-b36c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761593982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593982, "uuid": "86b1cd93-ef0e-46c8-8968-d3810b056ff3", "comment": "Malware payload", "value": "f598bcbdcf5cd5ad4f15e28159187ed2", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593982, "uuid": "fd061cfe-61c5-465b-960e-3e1b3f6de2fb", "comment": "Malware payload", "value": "2b5a464a4c4afaaa4d67b66b4c003f7ace98be0ff88b045fdae0185fc020daf0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593982, "uuid": "718ebe11-8d8e-435b-93b8-3b45986601ab", "comment": "Malware payload", "value": "5dbbfd8424c3ef85a4feb0eda36c5bad843a350d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593982, "uuid": "6294002a-94bf-49fa-8d11-6661774c48bb", "comment": "Malware payload", "value": "0caa7df2d20cb6f8806e49bf4d2ed1b8c76b0733a54a8697b22236174f26d520ffe28d5c814cf7fb70aee4d3e3f905ea", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593982, "uuid": "a890f8a0-e689-4da7-9a7d-7e74619e7885", "value": "T1F764F116EB04EE0DD05F42F8963D9CB250CAC25852EBE11DBAACFC8937A45434BCD96D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593982, "uuid": "e44d6503-a43e-465e-9dbf-3dea4d5ecaa2", "value": "6144:/lg5w80AIImSb8vG3PsPXBe0XzTWliKPMjAz/GGiM8OMXS:dg70AIImSbISPsPXBeImYKPMjAz/GGig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761593982, "uuid": "a1cc5d20-ccfd-4529-8b57-85002766af03", "value": 331377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761593982, "uuid": "22fc99a3-f3f6-4557-90a8-71598f01d0a8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593982, "uuid": "17c37c5d-49bb-4ceb-9daf-52daa2b098b3", "value": "JPM EU Oil & Gas 3Q25 Preview UPDATED.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38eb6258-b360-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588630, "uuid": "e6e95055-0fe0-4534-a11a-7c5b91c1782d", "comment": "Malware payload", "value": "49f99f103307584d31752d06bff835c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588630, "uuid": "a3696961-5bf4-436c-872b-a76babc0ee54", "comment": "Malware payload", "value": "2b5d9690f0b521bfd2d012f03554a0b4d694392c79e3da5da37f9472fa85be6d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588630, "uuid": "38b4a947-7fbb-4ab8-8b2f-debc1244c1d2", "comment": "Malware payload", "value": "e80d1963e433228a57181358871fd7e9cdf3cf3d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588630, "uuid": "577059fc-b8ba-4a38-a208-26bfdb834e56", "comment": "Malware payload", "value": "3ffd68ac50409dd3fc6f7a1760d15f17c755efe0e6c6a36e5c680f8ed5727bd8833425a2c2f6e0d3667d2fc30d1a5357", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588630, "uuid": "823507f0-17c3-4b83-8726-b7e9bb39e650", "value": "T1F4342324B4F6BAC93241E65F2D9A5ED98A164C1C3F071E60AFF33D781E926DED080235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588630, "uuid": "83ad8076-75f9-4b33-8792-17a6ee35815c", "value": "6144:Qv+7JO2tHIMqDHSwFVOd9pROZp3tB3ZOBSfx9Xu:6vMqDHbQ+OBSfx9Xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588630, "uuid": "c96f4f86-d1fe-4de2-b3f9-e974655a26a0", "value": 241878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588630, "uuid": "6ee213e8-323e-40b2-88be-6807a56aa0bc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588630, "uuid": "f39777c6-4a48-44f6-8343-be36808c4f12", "value": "concrt140e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2511df52-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577429, "uuid": "939285f3-4313-4df5-bbb6-178e8f9a3933", "comment": "Malware payload (Mirai)", "value": "5267b8d28ae3c93210e567d128421722", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577429, "uuid": "127d00fb-bae7-4f76-a2da-52b6d9a43f5f", "comment": "Malware payload (Mirai)", "value": "2b8b5c6907e6b71c590f7604214f9efeedf68e5b8d89a255ac588aa8ef0a2689", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577429, "uuid": "c1d19367-8f1f-496a-8f76-1d32cbd40a94", "comment": "Malware payload (Mirai)", "value": "9db200e0029c9720a8dfd3d4e882902179271ca3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577429, "uuid": "28232765-b1bd-40dc-bc0a-b5ab0d74405d", "comment": "Malware payload (Mirai)", "value": "cc65c15ae677862da550b2fde3c7208298daa05d24352659e4c5926434c4af6f57fbbf7e8e786ee65b6a757fa418b49d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577429, "uuid": "58bb050d-5bb9-4925-a6e6-e25cefebaf93", "value": "T1DAC3F874FD04432BC2D227BAEB9E478D3F351E97679733116A3479B02BE17982E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577429, "uuid": "272bf768-b14b-4ea8-ad05-f1ed34a79a85", "value": "3072:8WsD2Qcpm4ZKLbk3YKm3xVKmNYL7QsvSGfFVNb:KD2Fm4YnmYKmymNYL7QsvSGfFVNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577429, "uuid": "df18213a-cce4-4dea-9237-e4a6f1393e0b", "value": 125749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577429, "uuid": "48b30850-102d-467e-b9bf-f2ceae06ceb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577429, "uuid": "e908d7d6-88bc-4d55-9509-017b8605a026", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb946a6-b30e-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761553476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553476, "uuid": "8879bf18-8bbd-430c-833b-8ec1b43651b3", "comment": "Malware payload (a310Logger)", "value": "9c58304eae1e14e73bd6e208944f2d08", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553476, "uuid": "7f9ca298-2f0c-493d-878e-3a8d2d717b4e", "comment": "Malware payload (a310Logger)", "value": "2c3a611bea6cc4b910ba984a106510c25cfd40435ebdc45df46611603e0c1118", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553476, "uuid": "846387da-f294-4e24-aade-8b1cb20298bd", "comment": "Malware payload (a310Logger)", "value": "63ce67fbf58fad4909169483da00fca992825f5b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553476, "uuid": "94e7baae-2b80-4de1-8658-8ef751ad8348", "comment": "Malware payload (a310Logger)", "value": "d44775e8c3447a3cb323184e1a92bf031d517f49ce14bbf0e19d077b56a2e2bd0c01c326295dae26c1243cba2b74e134", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553476, "uuid": "b699df8d-55b2-4589-bce6-20ed60133b65", "value": "T13E0609E0E0F70092F147899450ACB99E0A7531A3EDC6083AB35D7BC4DFAFD457A85B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553476, "uuid": "c6c952aa-f1d3-40dc-be1a-bd873c17c2a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553476, "uuid": "2a806e59-5cd8-4223-8c00-f606d71a9913", "value": "24576:okCQjzibKOqV8H6TmuRdcODRuUljcg8yecuP70BxGPGZD52Agy1w5NCaW7ES24H:VB2mD5Jw5NCR7w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761553476, "uuid": "8aadd6e1-d725-45af-9484-a50fca78cfc0", "value": 3860992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761553476, "uuid": "a5a7a7e0-c0f8-4865-81e7-c951976a2225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553476, "uuid": "201da8c5-fe0f-4b57-9b33-0af015bc3d30", "value": "Complete Shipping_Document CTC27.10.2025.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e116d64d-b2eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761538661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538661, "uuid": "44954457-85f5-4a4e-b7e0-c6db1168c7d9", "comment": "Malware payload (Mirai)", "value": "afc6c43a32d62683443afa4a043ca805", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538661, "uuid": "f36161e4-d366-43da-a4b0-f4a92cbae5ef", "comment": "Malware payload (Mirai)", "value": "2cb55469c3fe3161a180107db273248c66e2eff138aad219a4bb9af01486d8ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538661, "uuid": "ba2ea63a-76fb-49f8-9e92-945626270657", "comment": "Malware payload (Mirai)", "value": "43d2acfd4e750635121d087065d5482390434c41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538661, "uuid": "e2abbe1a-088b-47bd-a72d-1924e332c641", "comment": "Malware payload (Mirai)", "value": "5dd75557e499ca39e6c498e856b2a6288db7bf35444d019b4b2c01625d3e2fe3b1c2063a1e33ca0ef25777dfb934b84c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538661, "uuid": "7b380ffe-30a8-4d46-9786-78a9c9840f36", "value": "T1D1932852FD814622C6D116B7FB5E428E372713A8E2EE72039C155F2137CB96B0E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538661, "uuid": "20257a9b-ea9c-4944-98f3-5548ce1292d7", "value": "1536:gFRoWT1FVUq3bUpQ9RAKryKJzdY9Ej5rXS4OZd1K697Nvf++7J:gFKWZFVUe9yKJu6FrX+HDbl7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761538661, "uuid": "aeb57e02-ce72-4de8-843b-4be4b86597b2", "value": 93356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761538661, "uuid": "0581716c-3207-4577-9f20-5fc454773624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538661, "uuid": "a5d84c12-8035-4423-9a66-c7de0fbbd221", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245cef0a-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577428, "uuid": "465545ba-57d2-46ae-870d-eb6ee6466b35", "comment": "Malware payload (Mirai)", "value": "866e62fcb91187b75c91397a633eb153", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577428, "uuid": "87e9c905-85c7-4b25-857c-14ddfcc1cfce", "comment": "Malware payload (Mirai)", "value": "2cbc923208c6c75c16f7420bb8be7fa09e173eef21c979f476e0fcf443859593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577428, "uuid": "9c594dc0-fd84-4554-9aef-7aeb81718a7f", "comment": "Malware payload (Mirai)", "value": "f864941f39919466fdfdc2b055b6fc5b3e9c3e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577428, "uuid": "85c5434a-8888-4a83-8d75-e366d02dbfeb", "comment": "Malware payload (Mirai)", "value": "275bea783de65577c602e450464df3951a6b7a71d0ef518840b41894b8a5cb2e79d8f6b7b49062fffd152d2ee2be409a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577428, "uuid": "7aed4fea-6185-41eb-98fc-e6c1fb68ee2b", "value": "T164A31A32A641C673D04306B1129B9F161D32FEFB1A9A9A16F36C7CB49E350C5B521FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577428, "uuid": "9a87a71f-2cb3-47ce-be0f-60ef09c37571", "value": "3072:he7EqeQUHfPyjRJ9rBFKqeBF1QmqoVcqq6GnQOT:heZyo5KqeBPQmqoVcqq6GnQOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577428, "uuid": "985a8019-d239-4d1a-9a24-c3ac41125a36", "value": 100607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577428, "uuid": "0adcae1f-448a-45e8-8ed5-f9921f7dc2b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577428, "uuid": "e320c4a4-137a-4dca-8f04-ea058b05f15f", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c5d123-b2c9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761523911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523911, "uuid": "200e8d82-1a7e-4717-9b40-89b1c18a27b8", "comment": "Malware payload (Mirai)", "value": "93b0afba5ff88b3cd616a88d07965e3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523911, "uuid": "8346a792-f477-4542-9884-86f341c7bd3f", "comment": "Malware payload (Mirai)", "value": "2d33c6dc8db345312784ae422f6d8640e00a3abd91a29a13d5a230ce2559b9d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523911, "uuid": "b6784761-63ef-4e35-9ba3-1c489e3a74d1", "comment": "Malware payload (Mirai)", "value": "d83091f955bd936669c40e45b7011c9cc499159c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523911, "uuid": "74192045-1df3-41fb-a769-25757ded96fc", "comment": "Malware payload (Mirai)", "value": "19fcda6476b0fd2ee8ef33a67fd90e253a29fb31966505dd0d4c4ffbdf91e2471e189422514bbbe7d2cf6fd851d7b170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523911, "uuid": "7bff844f-979a-4264-a4bb-6ef01ee82548", "value": "T16B13F276EAFD0D04C8FCB1B14EF53BC90A2015AED8DDC6E1A951E6370E1856A0471BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523911, "uuid": "f5072774-3876-46a2-8523-1b82a21ec805", "value": "768:Z7doaBxGabJNMt+i7AUCecO+ANx9EPQmyTWqjiyjYy6v1b87nbcuyD7UHQRjZ:BdoKxGabJE+EAUmO+mxOomydfk1I7noJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761523911, "uuid": "24ea4923-c79a-4d43-a0c3-6d5943df440c", "value": 42396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761523911, "uuid": "50056af6-b78d-4509-8363-9a25d5bc79a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523911, "uuid": "011efe96-c841-4d88-a587-38723ce01545", "value": "morte.i468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1c3f6f-b36f-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761595210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595210, "uuid": "699c6fbc-b2a3-435d-b8a0-fe6212ad0d69", "comment": "Malware payload (AsyncRAT)", "value": "c8e5903d595cdf05ba803f58b5873b60", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595210, "uuid": "cc58790e-cf3d-4fbb-bc22-d8ce809d171a", "comment": "Malware payload (AsyncRAT)", "value": "2d4921ff24d08ee8b244607ce22bc0b7ad477694ec12cdf6cb3873f53c27a379", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595210, "uuid": "038c322b-0686-4d16-9bdd-89e0fd459c09", "comment": "Malware payload (AsyncRAT)", "value": "16391eba90169a58a2b5375608525dc09483f620", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595210, "uuid": "de37458b-7391-4905-a8e6-5823f4d85f57", "comment": "Malware payload (AsyncRAT)", "value": "69beed2fabdd3480ec7b7fed2e88f959a0e33279aca88fb30d60057ed185cdfc3a8a22d2dfa39554799f41cad6349f19", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595210, "uuid": "7b61b3c1-f4bd-450c-a504-42b2825860ed", "value": "T144232C103BD9812BE27E5B785CF26141867BE2673603D94A3CC811DB5B13BC69B426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595210, "uuid": "2caa6e36-f6b3-4b0f-843a-dd67d600d8f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595210, "uuid": "8e4e80f2-74b5-4581-ab51-1953d7295795", "value": "768:jLoCweM0Nnn+4GVkJN413wRCn1OCDyjb5gr3iA2yO7dtcClZp2tYcFmVc6K:PoCweM0NiAUVebWrS33dthrpKmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595210, "uuid": "9e924e72-67a1-4c6c-af0d-d9068c072820", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595210, "uuid": "7a5d136b-7648-450f-bfb7-c4ef6dbfd0bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595210, "uuid": "936426ce-b228-43f7-a6c0-e6f72a5674dc", "value": "2d4921ff24d08ee8b244607ce22bc0b7ad477694ec12c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82698f61-b34f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761581452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581452, "uuid": "02c324c2-ee58-45d1-9f79-f5c2d42f5dfb", "comment": "Malware payload", "value": "39122a85a05894b4cde63546b6e2f627", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581452, "uuid": "90a403f0-3c57-48ef-aef8-2d83af0f1665", "comment": "Malware payload", "value": "2d527e634db5ade67dcd528122830d8845a504b6be77ea991ee753dda5206532", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581452, "uuid": "c79084a3-e8cd-4afb-b55e-f6e1aed3b36f", "comment": "Malware payload", "value": "c2ed98b07f1c6e5bf34eba83c6eede322f1efae3", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581452, "uuid": "470c487c-61a1-45a0-b411-df0db54fe9f6", "comment": "Malware payload", "value": "8fe59afce4651917a60fc130bfc93339406cd99785a8b58bd2b8b1107883b085437ba1cb44103fc2e99bc94880e693be", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581452, "uuid": "9794d88e-03e6-4080-a459-0d4d64806667", "value": "T1D88523D96BD6449BD470073A88E9498D5638FCA08F6505FBBB9147EC9B33A8C3670B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581452, "uuid": "9c84c7f9-864c-45eb-a48c-e86f646be787", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581452, "uuid": "8ba2540e-04a8-48db-a703-25303a3a3e2a", "value": "24576:ejNTF98ZpmV5CeevWBmXaO5q/36NW2/d/T1ajsXVSp44Z2C36bBiGEM:ej5EZ4H1eeBaaOYKNW2Z3XApgJbBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761581452, "uuid": "f1c4f875-bcc4-4040-81c2-26ec6f3467df", "value": 1810432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761581452, "uuid": "e948a08b-2f39-48cf-8043-18fd5fba17fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581452, "uuid": "ff0232ea-c79b-48d1-9612-82f56b26a5e3", "value": "revo_uninstaller_pro_v5.4.3_ _fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb85dc3-b359-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761585928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585928, "uuid": "6b32d8af-fa63-4698-b921-5bc4307af3fb", "comment": "Malware payload", "value": "65363a632fbc4ef807d8125adc62218d", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585928, "uuid": "4fff12b4-1cb6-4321-8315-9055ac6c119c", "comment": "Malware payload", "value": "2dcaa184a41e52f1d957f127a5847c26f4c3c8b88c6d464868727af1b1ac54b3", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585928, "uuid": "e2a57d0e-124c-426d-bedd-f107b61cebb9", "comment": "Malware payload", "value": "d480e30773a8149787a87c56ea4fcd2826481b2f", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585928, "uuid": "6ac4c75c-f85d-4216-a117-6d21b8678aff", "comment": "Malware payload", "value": "2a4d4c8ddf46c479ca7f3253b4e17b9ec43d829741e016a8e362921f05e3a746ef3aa149617fe4f361bc9ffa50e76024", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585928, "uuid": "097ee363-d60e-4a0e-b5d5-f78ca071faf7", "value": "T16F81B59CBB8470A04B8263D71E2D6907563AD9C27819964CB275FADCFE24B0CB01E978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585928, "uuid": "9efdb84a-7526-45fc-b1ad-1e78619fc964", "value": "96:c8mMlup4WaIKbp7T3cSP/0j1z2OJfwRG2eXkNC:cClupBaIKbxT3cCy2m2wkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585928, "uuid": "5f65a172-180d-454b-8ee3-1b0589728579", "value": 3966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585928, "uuid": "d9aebad0-85b1-484d-911c-bb78b3a80174", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585928, "uuid": "00bb088d-ca5e-439a-9156-df6a6056cdc1", "value": "Invoice_and_Transfer_Cable_Unit_GMISI_Orders_2025-10-24.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace833c3-b2c8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761523541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523541, "uuid": "c90797e0-7129-4365-900c-ebddf2090cbc", "comment": "Malware payload (Mirai)", "value": "b2d4ddee20cee021bcc6fb7f4594a410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523541, "uuid": "5a6ec63e-ddff-4c52-83b6-268bc9393923", "comment": "Malware payload (Mirai)", "value": "2f3c1b72643ee747267056728ae444038bdd216162155499138ce3c89fe66ba4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523541, "uuid": "5aa4874b-08b9-4f2d-a20f-7a75b31fc783", "comment": "Malware payload (Mirai)", "value": "509508e3adb5b7816ef5a3b951f16d05db38a11d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523541, "uuid": "80fbc614-a142-4cfb-8f91-c317e749a19e", "comment": "Malware payload (Mirai)", "value": "9bf0ab56242a0b96898b8c1e55b60f8e17eb3495b5911f90b5bbb215cdc20766c68199f9a132e4aa7795d8ec551d5c9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523541, "uuid": "6928567d-33a6-46b5-9d03-9823a4cdaf6e", "value": "T17BB3AE9BF7072190C86247F407C74BDE2E6322129E6BA8E76C1F2A7B15790DF1917381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523541, "uuid": "24f79e3a-d506-4ecf-8417-4f2a7bedda13", "value": "1536:jFl2EyPsY3q7W8dOyQFa4WqEzZkpxGCbTvZZirxZJUE8gW/LWU:5l2ElEq78yQFBtcmVxZiiTgWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761523541, "uuid": "68afc34a-3cee-495a-9ecb-e35609117e06", "value": 116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761523541, "uuid": "80ac6b1f-207d-43a6-add9-8399a71d7214", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523541, "uuid": "4af1aa13-57fa-4bab-aac4-0311ed2ac63d", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7470c611-b2ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761538908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538908, "uuid": "e01e9884-ec31-481f-80b8-7d828cb06ef8", "comment": "Malware payload (Mirai)", "value": "e229386f112ac13a0cb8cd6b9171702e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538908, "uuid": "471354a9-afc1-4821-8112-cf46aa061602", "comment": "Malware payload (Mirai)", "value": "326acd595d3c87cec6f1df6ae81ef2d62bf8a477e419800ead5f95e1d58a3155", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538908, "uuid": "e471d9c4-2637-4bf3-b952-669324a4a6be", "comment": "Malware payload (Mirai)", "value": "145189f68203b86e22bf1d520cf26cb2d0170b5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538908, "uuid": "9593c460-7734-4a66-812f-2b4f56ee66cf", "comment": "Malware payload (Mirai)", "value": "28277360c413524775de9d712e63b5d023fd68594d96355b03b22e2ed82db85b37a091469e347a08ce019cc96d001032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538908, "uuid": "4fbd4106-cc2c-4e86-b19d-10de9cdeb80e", "value": "T14D433C95FC92456AC7D117BA771A968A336223A9C2CF7313CC0C0B5176C9A4F4E6BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538908, "uuid": "21ba629c-9747-4e13-befe-b701310caaf4", "value": "768:cZRao+g6Z6nGYbl8d6s8n3WkZDJmr9DKukv4f76uwyMRE92FH0nzz:cZRao+ZajeAHWU1mr9DKukiwyXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761538908, "uuid": "ce78cfd8-8cd9-4e6e-8e06-745b9d6cec92", "value": 55344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761538908, "uuid": "c11a122c-d634-4902-8277-892de48abf2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538908, "uuid": "1dd02af2-e482-4d0a-8815-2f1ceb09ae63", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37d044d-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761557053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557053, "uuid": "e96a5e32-a5b3-4d52-9b11-85b36c4aa9e8", "comment": "Malware payload (RemcosRAT)", "value": "218b1d87e59399ecb0d25f355f8f0cea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557053, "uuid": "7ecf3ea4-d4be-4021-9169-3f4168ea5e47", "comment": "Malware payload (RemcosRAT)", "value": "329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557053, "uuid": "9ecf23c1-450f-4b86-a653-5c5d9800cb90", "comment": "Malware payload (RemcosRAT)", "value": "d89fa03dcc3b9b0217bd1d3d216cea7f23f12b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557053, "uuid": "b4510b2b-7ce3-4d0d-a3f2-4e7093a36b61", "comment": "Malware payload (RemcosRAT)", "value": "996fe5902703c10746ceee0f63e96bbe772d63d321b8efe036281e4f2dd9c99382a100477a7ac81bf74110d194893577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557053, "uuid": "c025cac4-7284-48d1-a04b-7a1e3a4c7a84", "value": "T1E2A412402530C5AADCA20676C9742BFF1A6AFD1EF656AB070B19FF173C712C96B0C295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557053, "uuid": "b03abb1c-9f93-473e-9268-f79fb6e8d693", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557053, "uuid": "7cb05f46-e800-4a2e-84be-bcfdfd7bb36b", "value": "12288:acE8OLszQv6BHpmZWMeRXXll3SEr11i7NBC1FsXq8d6f:at8/zU6BGWRJ18Er1sNB0saT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557053, "uuid": "ccb2ee18-0234-4c25-ad29-fa6cba5e564b", "value": 456880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557053, "uuid": "449236d3-c9ea-4708-93de-3a8e2f2b7a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557053, "uuid": "208f0477-ee7e-4148-a87f-f17901ac0ced", "value": "scan102625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc64045-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761579268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579268, "uuid": "190dd2c3-1646-4166-9fbc-7962bcc77aad", "comment": "Malware payload", "value": "ba964dfa3d16427f49d9012270a1b698", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579268, "uuid": "89fab867-2d24-4e0f-923e-4180312ecb57", "comment": "Malware payload", "value": "3388fe4e7f68b4ac96134fd716b1c43cce64ecfef92d4042d401941f72005120", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579268, "uuid": "15b4f8c0-eeeb-4500-a54a-f66f3ef09ba2", "comment": "Malware payload", "value": "7e604c03243b8614b107a972eb02949b592a384c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579268, "uuid": "3be9fba1-d950-4cb2-8041-9726afee9352", "comment": "Malware payload", "value": "b2b3e997188ff102179c9eb179d7b7de416e9bb128fb0cab4dff3f7c4f6ad6984afbbbed79b7f2867b7a6010aedd3cd0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579268, "uuid": "26dee19d-a80b-400c-9abc-fcfc8fe371bb", "value": "T1D9E0C294105635967E971E20762ABBC175806C46AA10083EE3B9AF234CBCF017B0E871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579268, "uuid": "9fadd7c6-2be9-4ad3-ac31-2cf110f4ca10", "value": "6:hdve0OXOZYzBqlQXZRlzTjafaqUZtL57bNwb:XoOZYzYlE/jaC3THGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579268, "uuid": "a23861a9-da38-4034-b992-2bc66658767e", "value": 325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579268, "uuid": "ac28b8bb-1ed0-46eb-85b7-8f45ea4e573d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579268, "uuid": "9d5e3bc5-b9e0-4ec2-8011-83f8808b96a6", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41f5ed3-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761557027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557027, "uuid": "f46b8fb4-60e4-48c2-9e99-9aea9cc34bcb", "comment": "Malware payload (a310Logger)", "value": "3cea674d9a151d1262f1748a3c56036d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557027, "uuid": "b8fd715e-a507-4e00-8e87-f98d80673e0f", "comment": "Malware payload (a310Logger)", "value": "34159f583493176fa487b30736078ffbf9394ecc7b3af5386e146d0144c26117", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557027, "uuid": "5810be98-28d2-430b-8d41-5b54be8df14b", "comment": "Malware payload (a310Logger)", "value": "1e39332fd2db346e71a19324b9e6fdea8541b84e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557027, "uuid": "1b954ea0-32c9-4f20-9aa9-f776eacb4edc", "comment": "Malware payload (a310Logger)", "value": "a6c772cd174a381e938de55811e15d6cb0bd999366745fd53267b0fc7a9a2adf8a20ba5eeffa6ab8acf424ab8ecffd83", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557027, "uuid": "06ab883f-3b77-4ea0-a3b4-2eaf463263c4", "value": "T1E61522113755D823CAA08BF418F2F7B50375AE5AA500E5C3BEC9ADEB3CA9F005E51693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557027, "uuid": "7b793b18-66ea-4f9d-8d69-4fa3d2966fc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557027, "uuid": "c2906103-fbc7-40b4-8a72-575090a627f6", "value": "24576:zchQK/wvb+OQLmXW/PqdjdgQyZyd95dWQbGwveicpI:tK/wv7dXW/mSRZyznWTwWicp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557027, "uuid": "ff254574-20e5-43f5-97c2-71e246ec6750", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557027, "uuid": "0380c52f-e557-42a8-97b2-bbb0da6c31ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557027, "uuid": "0b7a1b01-a359-4367-9dff-be0e87714eba", "value": "QUOTATION#V008657642.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97188245-b2f2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761541543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541543, "uuid": "6ad8fc4b-0b49-4550-a5c2-e82cdd7109cc", "comment": "Malware payload", "value": "5a1919047b8fac735b35bfdab378ccce", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541543, "uuid": "2d67b0b0-d6a3-4efb-aec1-2fcbe9bec603", "comment": "Malware payload", "value": "341e9cde3e73d4429982e3e4835addddb026bf4241f162d36f8d5495e72e880c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541543, "uuid": "30581d8e-23c5-439a-b00d-9cc07b9ed411", "comment": "Malware payload", "value": "4605fde2edd6e4bd98b55efd4a8d23d48949c9aa", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541543, "uuid": "422b250f-9455-403f-a01f-a1f5e521dfdf", "comment": "Malware payload", "value": "e3d0205976dc6bdabd5af48a965b7758f8fbbe06d284e21ac00dbf119580457e20174878fd9486f714e2bb19cd005ab5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541543, "uuid": "21c77a20-ac3e-4389-bf38-b95d3fd54a7d", "value": "T150911A36778670399BE110EAA07F6B58B53E8215310B4072E7ADFCD27C20A9B9096F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541543, "uuid": "9634095f-61b8-4299-be5e-e3b5ff5cd1dc", "value": "96:nItDJYtoAJS8ffKH1NPIX4rDIcQ0ucq4o5nZ2LqQWRI7BmaL:IVJYtoA1ffqzr/IcQ0yb+qQpoaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761541543, "uuid": "70033e59-c56e-4892-9f3a-6f77950e928d", "value": 4532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761541543, "uuid": "7ba85db9-67f2-45e9-b9f2-30288752393e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541543, "uuid": "4e47f88b-60ab-408a-97d9-8b67dbdfa1d2", "value": "seemybestthingsgivenmegreatthings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5a9c30-b35c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761587238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587238, "uuid": "32ae589c-9d4d-4ace-b6ce-95b78b5fd1ae", "comment": "Malware payload (Formbook)", "value": "71f34c7c1cc12c2c1206ce14d7c27870", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587238, "uuid": "2ffd84f7-3b53-4f8f-a953-7d6d749c2223", "comment": "Malware payload (Formbook)", "value": "3509180cd5a274a4af6da254fc5868bffc8a3be2219e0dcc92488606d48a9999", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587238, "uuid": "5d3a53de-c344-4f25-a782-5a36daa96b75", "comment": "Malware payload (Formbook)", "value": "12c461657cdcc05ab499b3e77cd8f7043561617a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587238, "uuid": "c1d4c732-7afc-4d1f-b8f7-367eee8dde2b", "comment": "Malware payload (Formbook)", "value": "5354be78aa34d31aa6901b63907fdb49418444e80364a928299a44d907b4e7f56c54bcb00aa507eaa44b46e7a2badcdb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587238, "uuid": "0f0d9343-67f0-479d-ab42-4f5108e36a58", "value": "T120F423C41E193845963786233A539E74021C9CE3CCDF66DAD26A2EF0F6A9FC16421E5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587238, "uuid": "e7d5d4b3-df85-4f7d-b69d-67d1dcab1a2b", "value": "12288:4yoRifg6tpeeRvTq3C5NVPZxsYRQ9QcuUKUiBf9A57dB5dJlfP+eBD05ebViGU:4yovuVxDZZxhReQccUiBVWJdJl/d05MC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761587238, "uuid": "280c859e-a8f6-4e37-882c-ebf0ec9d515c", "value": 786323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761587238, "uuid": "8263d160-8be7-442b-ad08-ca24dc1be540", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587238, "uuid": "57038a69-b278-4812-aaf6-ba92940c2184", "value": "purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d5ed23-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570827, "uuid": "58271cb0-a437-4904-88b8-24614e2d03e9", "comment": "Malware payload (Mirai)", "value": "dda9dca89a7fb6101b354c7ed21609fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570827, "uuid": "20554516-1e3b-4d33-8d76-70b2bb7dc18c", "comment": "Malware payload (Mirai)", "value": "3510f1efa5b36b64ecbbdeabe1e0563153b7db27778a763085f16c556d9d66c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570827, "uuid": "df5853d6-ceee-4b62-a7af-378a01f31665", "comment": "Malware payload (Mirai)", "value": "eed854bcd373ecd80d8186ecd0c986002171c234", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570827, "uuid": "f0a94827-613b-441b-97c1-2314a996daf8", "comment": "Malware payload (Mirai)", "value": "e2cc3c9332a9e64ebf75ac1fc944b6cd23bc9a9489123be9d403e94aaac8b8c52c8f2dd8dca8263a03d54f35cbdf339a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570827, "uuid": "0783917e-3d98-4596-85d5-ab30075b3dc8", "value": "T19E61D8D921E105F12DF56A2736E6D81DB24469A2ADC0D90A48FF3DFB3D4DF49B880742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570827, "uuid": "94a94163-67f6-42a2-88bc-96412e005435", "value": "48:pVoOHofr4WwO/0kA/IpblmU9YNgO0qw/8vs2t:Loc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570827, "uuid": "e003032e-8e15-4f13-84e1-9eb1ec1aaf00", "value": 3258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570827, "uuid": "1b4f05c6-ca53-43ae-acdb-531a4edcf61a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570827, "uuid": "59dc8060-4bb4-47e0-b962-56c4f045eb57", "value": "huawei.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8ae484-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595563, "uuid": "ab05a711-7a49-427c-881e-dc68eae56a4e", "comment": "Malware payload", "value": "9148f07e6dedce3e8e6a642fba0402d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595563, "uuid": "9896b21c-07d0-478f-9988-5540ce901652", "comment": "Malware payload", "value": "35bd82d881759b2aa8ef6dc6e26d0943a19593b2192d207b4440c6e1a29ba05a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595563, "uuid": "5367a658-5def-4a75-9361-c9f77e19ae8e", "comment": "Malware payload", "value": "2e403f6b65bf4519d0883ebb0025d77130105a1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595563, "uuid": "0270789e-00fc-4dae-8458-6808229bba53", "comment": "Malware payload", "value": "f156aef14df65e916cfaae7081cc757d0547c04b6f269630772f17484362c233dfb3f772963e0007a175026cd2256120", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595563, "uuid": "8301ae42-d986-49d7-a18e-af90b8c05d67", "value": "T100933A6B7B6481A5C11792BCC4A3CB42E3B6F5814F2297DF4364832E1FA7BE01E39561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595563, "uuid": "5f6b2329-a71f-473c-8fdd-333af80bee50", "value": "9acb88ebe18418eb1eae24983834770e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595563, "uuid": "48cdaee6-2e39-47bc-a72c-d70539c0d7e2", "value": "1536:kLWDi808Bs7rA/dLYVbTDayaNvrIuOQMI94oyfl0Yo733hHf:kLtx8Bs/A1khYNcuPqoyfl0t1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595563, "uuid": "914d6a9e-e699-425a-ac33-ee8a0d688673", "value": 88952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595563, "uuid": "075c87ed-9ebf-4b83-bbcc-ee705f781f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595563, "uuid": "e8020196-793d-4545-8204-d000d93a3399", "value": "atom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a095de8a-b371-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761596105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596105, "uuid": "0cbd015a-38ba-4ace-ab89-c246fd49de02", "comment": "Malware payload (AsyncRAT)", "value": "9384a71a7478a2175a79f389a212b24d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596105, "uuid": "796498e0-81a7-4f96-80d1-3a47841dd3c4", "comment": "Malware payload (AsyncRAT)", "value": "36588392a25ae18d4890d9f5e23fa4c88a233f9a4eb676c660bfdc5722fb6249", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596105, "uuid": "0e279863-61ec-447e-a6c7-366169293ab3", "comment": "Malware payload (AsyncRAT)", "value": "68fe87c6ad94f90281415d0b64ebe11f176e7a16", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596105, "uuid": "c59f2443-7846-4e4a-90ab-567a8c6eac55", "comment": "Malware payload (AsyncRAT)", "value": "70d466f4d3aa3b52b78af918898524fc82f08531aa0c678ad44c17733e1ca589463011466e2d26fca613e3a723e5831d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596105, "uuid": "1b9ca3ac-50e6-4cbc-8530-1dc5741363fe", "value": "T142450279F08AD555C96F103FC7F153A94FB68C375087D2022EEDA2AFA8277473A80259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596105, "uuid": "457dc433-a8c3-40f2-8582-1ed18ef86a3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596105, "uuid": "086587ab-a297-4bea-bc18-b27aef03b7c7", "value": "24576:11730V/rp30V/rp30V/rt30V/rlpwC6vmPzrvSUdj:1h3K/93K/93K/h3K/XwvmPzzjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761596105, "uuid": "4705b6c7-ef2b-418a-99a6-2d665843774f", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761596105, "uuid": "41057b09-8107-46f6-984a-1e4d6d1b87ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596105, "uuid": "4b1e4eb1-5fc3-4924-8315-a69d6d1426b4", "value": "36588392a25ae18d4890d9f5e23fa4c88a233f9a4eb67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a419d9-b333-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761569213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569213, "uuid": "dc2d324d-b662-49ef-8508-e2ff1d936f1d", "comment": "Malware payload (Rhadamanthys)", "value": "a24c87712575dda67d6199a1f4e1eb1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569213, "uuid": "9a98167e-d0f9-49b8-9928-7d98f42deb5c", "comment": "Malware payload (Rhadamanthys)", "value": "36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569213, "uuid": "2276aae3-cedd-45e8-b2b8-776c218a743b", "comment": "Malware payload (Rhadamanthys)", "value": "e0ad3e0f19ff2d6f0ddacd08351dbd1ff35a1d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569213, "uuid": "e88f8c58-421c-4cb3-91dd-26bcf2ad07a1", "comment": "Malware payload (Rhadamanthys)", "value": "5f1310875e4bbbbbd158e7d9654342ecf681f14551a97c9560967229676dbb7d5e2e11d331b8ddacd4ba2a7d00bda1cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569213, "uuid": "79f49f9d-cda3-43bc-bdaf-0bd9daceac0b", "value": "T1A855302C26FA4349F273AE364AD9B5958A1F76E2E5F6538B134C020B4711680CF91FF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569213, "uuid": "7cbae804-177f-4ddd-821a-52ce70b8f7c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569213, "uuid": "66a740ee-6f5a-4f21-881c-4ffa8d39f501", "value": "12288:sC7lquuNg18NEEa3Q2tJ1/5zRX77/3YBRNEiHNDTdcxsYYcRt2gdvU5dH:sC7ug15lrB/38LURtRvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761569213, "uuid": "04eb4b83-f3fc-42cf-8a1a-52fa72912b47", "value": 1357312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761569213, "uuid": "b76c93be-7c33-40a3-bf51-656971aa595c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569213, "uuid": "38a769be-e857-43a0-ab40-2775bf71f036", "value": "SecuriteInfo.com.Trojan.InjectNET.84.20142.27651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a254b8-b345-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577318, "uuid": "60b88aea-c56b-40e5-b6ac-95a39ed93849", "comment": "Malware payload (Mirai)", "value": "d9a0667664c3d2f331355b16f400f226", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577318, "uuid": "11ef0ff9-6cd9-4059-830d-637eb28ee457", "comment": "Malware payload (Mirai)", "value": "381a06421c1fac9769bad62ccb5e767213fcf01387b408aceb31f4c0065ed4b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577318, "uuid": "e1035271-9bc4-4a62-8323-dff69d7ab7f9", "comment": "Malware payload (Mirai)", "value": "2885c3656fbb7f9a094c32d8258bfa9ec23fa8d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577318, "uuid": "7492f0ac-cc96-4442-a200-96b4224f4ab8", "comment": "Malware payload (Mirai)", "value": "5442a61ac6d3624b6fc07aff738556e58a46098223307c7f93cb6470af1795ce0203e54557bb00094e0d86b07395ae1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577318, "uuid": "d7adb96b-2665-4969-ad59-77300caca705", "value": "T159041834E6404717C2E227BAE68B424A3F334F97A3D733155A38BAB43FD27995D22911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577318, "uuid": "b0eef61b-db50-41c1-938b-28e916dc44a5", "value": "3072:8dZPSsuX8azEwqCiYEQ4YNCOdQN1mrIzM/95WKyGmELwFBXAyNu:8XA8azEwqCPEkCOirmrIM/95ffmELwFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577318, "uuid": "576b6013-b6ea-4adb-9988-37e9fbaa5898", "value": 185183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577318, "uuid": "234f4710-cf02-46ca-a70d-bbe3c9f5ed47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577318, "uuid": "8aaee377-8d86-4af5-baea-77c4c7d6ad74", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7489813b-b33d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761573697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573697, "uuid": "d3747f37-fdf2-46bd-a353-f0deb3c55588", "comment": "Malware payload", "value": "2e6feb5fca103ab1f1b9fae46cd6e83b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573697, "uuid": "753a3d0b-9637-444b-b7ab-aeea50381f76", "comment": "Malware payload", "value": "38323c792930191df60acf22a36c60af2fc366456613d35ae2037d16d20ac680", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573697, "uuid": "aa431d70-d501-41cc-937f-6e9d3f125efc", "comment": "Malware payload", "value": "6cf60749d5f8c930d0b66432d9249c9426638d6f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573697, "uuid": "caf61fdb-dabd-4893-b549-de3676112458", "comment": "Malware payload", "value": "eaa0a9f4d95c1c255b1c836062ccf7771c38ef48ea93ea74dc005d6ba69693e8bb0083b1dfe492051f30c7d0c38e9535", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573697, "uuid": "0fbc595d-21b6-4930-ba87-45b7464e0725", "value": "T17495333BBC4CE1F9F2C783BADB7344853708AA6B0441AE85B40496653537FFB2A72841", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573697, "uuid": "0a339ebd-151b-4ead-896a-59c94538bce9", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573697, "uuid": "e9e02cca-e83a-4b27-8ddd-743703772f41", "value": "49152:Kha6kxB/kSzY1HkHUkDaVnsSBTKNg7WnP0xvZT7UJ+D:saPx1fY1HaDKsQKq1xp7m+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761573697, "uuid": "2751a9a9-f699-45d2-bcb0-bd7e49261378", "value": 2016768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761573697, "uuid": "0f417f20-f124-4418-a28a-fe8d5fb49ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573697, "uuid": "3f6afe75-f25c-49fa-918c-7a5f06468519", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d03c4b-b32b-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1761566155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566155, "uuid": "f4f88570-071a-4d0f-b513-af5694dea0d9", "comment": "Malware payload (GuLoader)", "value": "6ac60fb2d71944c75f6d28aa553e41b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566155, "uuid": "1f8e7d05-14f1-45c4-8232-4ea6747a17fb", "comment": "Malware payload (GuLoader)", "value": "397fe4ef3bbb8827014cc0a3a98fee725b181bb4605b8053a957225535ddb499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566155, "uuid": "52d3ebee-46a8-43f3-8d96-c9408d7ad957", "comment": "Malware payload (GuLoader)", "value": "5ba054b1ddc1ecb1c1badc10abffdb01643a5d47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566155, "uuid": "c461f91a-d8c9-46cf-a67c-d46c8e18e702", "comment": "Malware payload (GuLoader)", "value": "ca6ffb7827d301b7e3a4e1d90dd176704a8a1267ae1f3d193c73bcfe16029192920b8d39928def04ffbc87a05e7da305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566155, "uuid": "437145c5-651f-43c7-910d-b19a2164e3b4", "value": "T17175227EA652E4C6FCEB663E791181ED1759EFF16008346227B5B21816BF570BA0CC32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566155, "uuid": "183cf256-c3ee-4830-8cd3-a31408113e4b", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566155, "uuid": "ba997c98-7101-4c28-90d0-d4435103a33d", "value": "24576:a88BvstrLn3OKoXHoNeRbawhXg1Uxw8pN5gYfYJQyhLV6QAVe:a88tsruoGawhZw8+x4QAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761566155, "uuid": "d5f67f89-0151-4a96-a49d-d9a8d9e60f05", "value": 1614368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761566155, "uuid": "935a2685-3931-43d3-b3c9-0fdba3745a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566155, "uuid": "952f8fd0-9bec-44f0-b155-77c7f5d023fa", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9310c3-b2f9-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761544507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761544507, "uuid": "a1cc3faf-4401-4b0a-9d97-c03de1acf2af", "comment": "Malware payload (ValleyRAT)", "value": "92b6ecb8a7fe85a1b7e3a18619ff0f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761544507, "uuid": "660840e9-9c24-40da-be24-9063870a3579", "comment": "Malware payload (ValleyRAT)", "value": "3ab3e5e88a13a48c0b659aa7d1f40c9c8f396c9fad4dda3e297ea077638bfd90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761544507, "uuid": "2417762b-5ec7-4cc5-be04-984ec78bb9e5", "comment": "Malware payload (ValleyRAT)", "value": "61bc1ced1e72fcce12e5cfdc3682fbb40e30b52f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761544507, "uuid": "56e9fb65-dc0d-4027-b9da-255914639b42", "comment": "Malware payload (ValleyRAT)", "value": "3e4dd6c1e8fc610e977b897b3dc54750dedf026a894f0774129f708dc5adebf372139bfb8a0d586ffd2b25f0ed9ba9c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761544507, "uuid": "ef2364ea-d27f-40c4-8b02-7e69d6316128", "value": "T1AD947D2B735324F8C26BC07442D797B2E971F4190328AE6B4698E7322E60C554EBEF75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761544507, "uuid": "19bd7dc8-aaea-4ca0-9155-f222115e21f9", "value": "ec1957b613550da5f79f32111960fe56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761544507, "uuid": "605ca2af-48ee-439d-b2f7-44a23f38f510", "value": "6144:VkTtdpRwxLqUL09EWxyNRy2BxX3IPMZugRcLGHjANuARJ1yZ+UNtadHei:KTRRtUL09ETE2BFgcbNUNBJOah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761544507, "uuid": "38ef19e3-a40f-4658-8609-3dbb84269e8b", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761544507, "uuid": "072c8f2a-9d48-4e1f-9f05-fd285f97c402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761544507, "uuid": "2e970924-eb21-497b-aa4e-93419b1d1f5d", "value": "shellcodeloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48451646-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577918, "uuid": "a3572bf9-908b-435d-83c2-34af982fe977", "comment": "Malware payload (Mirai)", "value": "2ae5dbf7afbedd348e1dc06c5c47789e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577918, "uuid": "57a5046b-0edc-44a9-a53c-f997bed882a2", "comment": "Malware payload (Mirai)", "value": "3c7340de7dceaa155fbf117f5b099b83b5877f165eceaa9b2f91c91b659d9322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577918, "uuid": "15fd84c1-ebaa-4ba7-8983-e7d8a2a03b03", "comment": "Malware payload (Mirai)", "value": "664925537ab2bde949ced6ea5ae6c024aef59de5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577918, "uuid": "f274b536-987b-4479-89bd-dc633d077c99", "comment": "Malware payload (Mirai)", "value": "ad2826f8cc1a4228afb29d5acd05506a631b1e71f41a57b980d3ccb03439ed9e14ad21d4cde8d317da3fbcce69519aa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577918, "uuid": "dad800b3-6235-4ed2-a12e-0c5780e5398f", "value": "T1D903F254296BAA407DCCBC71D13CD0A3A356F4D4A9CAB41EF4908E7CE9D144293BDF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577918, "uuid": "b105defe-7898-49d3-952f-ac60f177767f", "value": "768:WwbECiq/w9Kojn6Vz3t/c5HKKFc8kPa1HLpTq6tU/bFbPiPDPRtJuC9T8tY3UQwf:Wso9KunKqdKykEVO6mzFT6l/uC9T8Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577918, "uuid": "57081135-367d-4ae4-aab7-2300b4756016", "value": 40468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577918, "uuid": "85fb6508-cf0e-470e-88c1-83a2d36c1a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577918, "uuid": "11115b83-70fe-431d-aee2-2e53c968cb80", "value": "kvm.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afd9cfa-b349-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761578755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578755, "uuid": "529d7e45-3618-414e-93b4-cb7c5bce6a46", "comment": "Malware payload (Mirai)", "value": "984975002d53b5da3b0e520cab240abe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578755, "uuid": "45097515-7d18-49d1-8783-135c6c6c36ad", "comment": "Malware payload (Mirai)", "value": "3ca613fb1bf284a241a44dfb7246b064ad3f6f3b81e9b3e8ae9cca0427f84d00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578755, "uuid": "f95fcb0f-2361-456e-b1b6-46fb82369b8f", "comment": "Malware payload (Mirai)", "value": "fffa222cccc192885c6484626d6a050983b5d7c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578755, "uuid": "414f6b23-3f9b-4c08-bcc9-b65cb7925386", "comment": "Malware payload (Mirai)", "value": "86cb961949968d6790aa12be88381154a18379bdfbc9b64025d92472afcfecd094771363b70ca57b2530ba9d24c6a15d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578755, "uuid": "445b23a1-4a6d-43b2-83d0-049c93bad5d3", "value": "T154935C13B9C480FCC849C13087AFB536D963F17E1279B29B73D4EA127E9DE511E6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578755, "uuid": "0e63469e-46f3-4c5d-ad90-8ef6406c7b5b", "value": "1536:yc50J45j1WS60TzxMJQ17TidyRgQQ1h1Ms6fuftHHZlmpnahs:vf5j1W0TzxP7SyR+1h1Ms6feHHXmQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761578755, "uuid": "b34f0d55-ab4f-4239-9f8b-3a7a70c8bf26", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761578755, "uuid": "b135ad4f-61c6-4bde-9b33-d9e5c7676a01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578755, "uuid": "50d1be63-c8b1-4de5-b640-1cb370494b30", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97944d92-b35a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1761586211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586211, "uuid": "07d4f525-a8cc-4ac2-bc97-b616b8cbc4e8", "comment": "Malware payload (Amadey)", "value": "17e96e93713cf1cc2c86f7194a4debc3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586211, "uuid": "ff101ea3-23c6-4e7b-9d9c-994f67389b51", "comment": "Malware payload (Amadey)", "value": "3d16e392fa1bc80d36687c28ee2a1ca81283e8c0d8da703c17fc8a8703a0e9f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586211, "uuid": "9032f9dc-0df0-4d9c-ac2e-95410fbd4d54", "comment": "Malware payload (Amadey)", "value": "c344b3c1cb8f45b4ff9ce4fa7c4e591c214b04de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586211, "uuid": "73b65f1c-7eec-4ef7-8541-52af2447e28e", "comment": "Malware payload (Amadey)", "value": "8a38d997576fe0817e333a5a4273843cc45606f2a8fcffa046ee53d221e9a03d6b773b2dde370ba1b44bdf9046a7e3d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586211, "uuid": "e7889576-26aa-4720-aa15-29816ac4f552", "value": "T1EAE6231AB3A406FCD5AB907CD9475A42F672B8560370DBDF03A042BA2F636D09E3D761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586211, "uuid": "7cc0809f-bd89-4abc-a1dc-15c82b4adbe2", "value": "e839b2b8c6a7d8e894d832a50c547c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586211, "uuid": "11742d52-44cc-4b88-9149-51294125c768", "value": "393216:a+qcVMBO09lbKGlIpEBl4LQ804e5/RCfwNsTGnX:aBPbKGlIg2h04u/RKSnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761586211, "uuid": "b66c03d0-85d7-4598-ac60-c50c1f4ff9ae", "value": 14496768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761586211, "uuid": "f4ce5a14-118d-4d49-b13a-a63f80cbfd0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586211, "uuid": "c162f518-1c5a-4305-bb2d-e8e606e2ae9c", "value": "Nexilo-CC-CheckerUpdated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38c02ce-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761578071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578071, "uuid": "ba5fa9cf-b025-4449-9511-32413cf188fc", "comment": "Malware payload (AgentTesla)", "value": "cdc184b39de972291d61caeb2fde2f32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578071, "uuid": "ece0e0d2-9466-401a-a4b8-1a32a375fb5d", "comment": "Malware payload (AgentTesla)", "value": "3db7b6aa82658f5724064d7d052cd570fc4601b43c9b039657c1c9a4bb8ea91c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578071, "uuid": "5e5bbe9c-3efd-4748-84be-3cb2c067ea42", "comment": "Malware payload (AgentTesla)", "value": "bcfa903bc638413bc86204da3857f97dcf7388f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578071, "uuid": "7624a3b3-26bf-4231-982e-1057c5d3be34", "comment": "Malware payload (AgentTesla)", "value": "98f4b73ddcb1a375e6f83107a33332cfff88ff6636ee46b2bcba167c30838226c3682d9fe66f9ed45697f05508b7d603", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578071, "uuid": "9f247d7f-257e-40ce-bad0-1152f8d9cf62", "value": "T1C50619E0E0F70092F1478D8454ACB99E0A7531A3EDC6043EB35E7B84DFAFD457686A4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578071, "uuid": "2c388e90-9273-48fc-8435-50fbbd0f9d7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578071, "uuid": "c920f260-5dc2-4392-8d86-039cc5ef906b", "value": "24576:0FT0lMkQAcCF76DTrDLwHVGlSzlxDAFWsJDDk0BxGPGZD52ASy1w5NCQWjsiiw:OB2mD57w5NCXjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761578071, "uuid": "5d2476d9-252c-43c0-82c0-f30514dc2624", "value": 3779584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761578071, "uuid": "398c231e-a0c9-4d5e-84ae-bcbc6df87993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578071, "uuid": "3ec225b0-d3b6-44df-9e30-4c758a1924d9", "value": "Swift_coft.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb38651b-b368-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761592284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592284, "uuid": "0bd8a242-87ae-4885-835b-837fcba6ae6a", "comment": "Malware payload", "value": "45ec85a2de014823c01eeb47c33c8196", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592284, "uuid": "ec65bc6e-bd32-411f-994b-128ea88002f4", "comment": "Malware payload", "value": "3dbe7faa7ead1e87e4995461eaa2ac147956dd3a4a9fd3b32627bed9e71a717c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592284, "uuid": "6a139de7-1b59-4515-b20b-041f2f6cede9", "comment": "Malware payload", "value": "5a013e2e020ab9800f72808f52d053f12cc73ab6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592284, "uuid": "983ca0c0-8b74-4628-86f0-c26c95b32d69", "comment": "Malware payload", "value": "d0f6bc6f55e2e5e02c40c352bda2685cd18aca84213dcfe6f7a5f6c4642070d5c079b179ebe23732659103184cf3811f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592284, "uuid": "4707a5bb-bad8-4071-aeab-60c645c033e9", "value": "T1012633434E4F2131CC6A50BEB8AF6C4C7D66747507FA2EA3245A8882DDA117EFDC295C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592284, "uuid": "ef6b7c66-fef9-4fbd-9301-00e5efeb6085", "value": "98304:qWc9RJBgIE3fF/Chx++bwhKgAh9uN8VLT6Zx9vCwzK8qpd:2E3f9CzBwhKPvuOVHyH62POd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592284, "uuid": "1e3b8138-75eb-4f40-8a8f-01fcece99370", "value": 4570231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592284, "uuid": "70500f6d-5331-4be0-97b3-3a96f85a6ea4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592284, "uuid": "d213c075-b5a5-4a51-a817-8cee09b0c229", "value": "190pcs assessment orders.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34091cc0-b326-11f0-91c6-42010a9c0006", "comment": "Malware payload (WSHRAT)", "timestamp": 1761563711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563711, "uuid": "c415cc1d-4749-4326-ad89-1a3eda6b9ba9", "comment": "Malware payload (WSHRAT)", "value": "935932f7f2107c70536918bebe0d03ee", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563711, "uuid": "1dccf587-f984-414d-82d8-19ec4e8c2705", "comment": "Malware payload (WSHRAT)", "value": "3df4108529c93e8f52a4477ef9c32de2eec1243ff7ff981b1f5789910faed3cb", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563711, "uuid": "1568bafe-57cf-4910-bca7-6f2f65358a97", "comment": "Malware payload (WSHRAT)", "value": "07c3d10359a8d931fefc7c3dec2d26c86ca0c98e", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563711, "uuid": "25c0f423-f1c1-413f-a3a0-138494f5a293", "comment": "Malware payload (WSHRAT)", "value": "b8628b1d0a1a82b32b265a361e50fe00921852ebae9bad4466a013e869e918703e987811dbdc3f209de4778ca1984f56", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563711, "uuid": "c001e76d-61e6-4624-8b51-77e737afe97e", "value": "T10F851C112FB9338BB95B295BDE6A96353076DF42CD522DCC235A700FD26FE099060D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563711, "uuid": "d28ead1c-9723-428b-b63e-3532011b13d6", "value": "12288:R9PSogi57WSSVDQYisvphPFZVGiohZzv9APAIaeiHzcJTqkFY8GJ9Zdb:TBdSV0YbxohZwAQiwpFubn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761563711, "uuid": "c7bde038-c51d-4ab4-a333-3294f7cf7bc2", "value": 1828708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761563711, "uuid": "70c6e32e-459c-437c-b6ea-46509b76eb0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563711, "uuid": "3d81e217-5c29-487b-9935-e5ceba3bc9f6", "value": "TTCOPYREF251088.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ed5e2d-b384-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761604308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604308, "uuid": "9a629919-30e6-43e5-85c1-dc7e7e428c43", "comment": "Malware payload (Mirai)", "value": "a92beda22f27714bda8389cebbcd8c32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604308, "uuid": "722156ef-5370-4c34-b357-65bf2aa87541", "comment": "Malware payload (Mirai)", "value": "3e3dcfb60c8d9a775913e202d25136eb50b4417c45b2d589618ca52c7434ed31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604308, "uuid": "0d24c67f-d7e5-465b-ae66-ee57a702474e", "comment": "Malware payload (Mirai)", "value": "e0e216dbea06a62e9f967b4f10987803840eada1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604308, "uuid": "701d2265-66e9-4f39-a3c2-b8f2b39cdf6b", "comment": "Malware payload (Mirai)", "value": "902a657f743899adf538693bedf075ce0a08b58297dabe5a5a6b201ba281eac735abc2557380798f3743aeba0dcfd629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604308, "uuid": "2dbbb31b-1264-4e26-bf85-cca1e5f9e2cb", "value": "T1A424D70AAB910EFBE8AFCD3706E90B0528CC652725A47F3A7274D518F54B64B49E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604308, "uuid": "57d125e3-892a-42f5-b080-79735afd7c53", "value": "3072:FiFjNv3D2wbtdmA37O5IywxPJ9GJPsxlPfLD1AtsLoAj+waZLRt4f/Y:IrbtdmA37mMdJ+PsxlPfLDOtsLIwEy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761604308, "uuid": "78f69630-e93c-44a4-9833-5a7c6f685de8", "value": 228932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761604308, "uuid": "50e513b8-f19c-4147-8f12-1108d53a2143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604308, "uuid": "e90148df-240f-4994-b633-db4757998ff9", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d26336-b329-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761565195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565195, "uuid": "c274674f-e34e-47da-aa06-897df7611327", "comment": "Malware payload (Mirai)", "value": "5aaf895a0c82958a4a2240b1df453a04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565195, "uuid": "9479f716-c491-453c-bb36-fa99e5632f45", "comment": "Malware payload (Mirai)", "value": "3eb2de7b466cf07c45f3a9694280485910deb45038c19cc0299044220b0a43a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565195, "uuid": "56200550-675e-41cd-bd08-1c1463f2ee4d", "comment": "Malware payload (Mirai)", "value": "5719c50c9ff47dd112089de7e6643018a96c62a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565195, "uuid": "6bdcb3b7-7136-41a8-a4bd-c2cf6fe8f7b5", "comment": "Malware payload (Mirai)", "value": "95258ec9d641fb4015aa193dac6680d6c4dcb3a23b20a9698c12244ef2ca3147fdef544806d173c14fcea18684db074f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565195, "uuid": "80b4b6e8-21a3-483b-87a2-5ee423b3a05e", "value": "T12C8328C1BA4BC0F5D90748304067F33FCB32D6394061D66EEFAA9E65EE73642522629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565195, "uuid": "6375a41a-24b7-46bf-9282-46be1632096a", "value": "1536:8l8IhK59kLMSbs6oz1WAcanWC8f4TxdgoXF6hKal9:8/hU9ktbC1WnfgTxddX0l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761565195, "uuid": "ed8beacc-a4fe-4d74-8f1a-4886b415d950", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761565195, "uuid": "bb9bbacd-301c-483a-b72a-31d6f706875c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565195, "uuid": "6ea0e243-9f0d-48c1-84f8-83dcda7ef06d", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741f5b73-b2e8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761537189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761537189, "uuid": "80bd2bc0-35fb-488c-a7c2-8798fae42ee5", "comment": "Malware payload", "value": "10cab1d255302cb65e37c4f8c8f00e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761537189, "uuid": "111d72e6-0d67-47f1-bb37-e5d0e9e68348", "comment": "Malware payload", "value": "3feb433eca53b2cd6f3a319ef87a106f5c8bba284a5a4a6fa8bb41f3a8a2fada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761537189, "uuid": "2cb69ad5-dcea-43ba-bbde-cc34f1f45877", "comment": "Malware payload", "value": "e7fe765e4981fba69c2e0b3048c380031ecb2d0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761537189, "uuid": "9154546d-a02a-4107-9630-5e6a06458488", "comment": "Malware payload", "value": "7a37f2daefcbf905f55358e8f05930f518e37d6f055626607e8f2d002a8755edb9b7245f0661130b68159b3abf1ddebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761537189, "uuid": "44382ae8-beba-4a2a-8a26-a03e7ee4a687", "value": "T1C3F612879A00CF31D0ED6575C7BFC8B013721E5AFA275A3F12AE7C5535620222927B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761537189, "uuid": "c2421a60-5ac8-412f-a0da-cb1a1e5fcf66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761537189, "uuid": "71f4fc71-2d24-483b-a0ea-450922a9986e", "value": "393216:tQc0fz8aCeLz85z84z8Xz8dz84z8Xz8dz8scEtu/Ioz8:tQc0fga5Lg5g4gXgdg4gXgdgQog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761537189, "uuid": "2862ac66-62a1-4c76-9abc-6aabab10f383", "value": 15643136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761537189, "uuid": "54a2fa14-acd2-4baf-ae85-9379a2b36dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761537189, "uuid": "af745a6b-21eb-4df1-8bbb-08becc8e1c4f", "value": "MultiTool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a8d246-b359-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761585673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585673, "uuid": "6d844736-f8b1-4708-b7bf-5852639af566", "comment": "Malware payload (Rhadamanthys)", "value": "8ef8166b258ac12f4157efd25ac73432", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585673, "uuid": "9881df9e-af5f-4041-ac95-25328c56d876", "comment": "Malware payload (Rhadamanthys)", "value": "409b646c6991a8e5ded7f029051fbaef531a5a7e228ad2342dd4280a61e3283b", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585673, "uuid": "f79a0084-bf7b-4c34-818c-3673606c3fba", "comment": "Malware payload (Rhadamanthys)", "value": "2cbe798d08145ce520c3221313e923edc0f9f801", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585673, "uuid": "30a310f7-05e4-431d-b85c-781d54854cb1", "comment": "Malware payload (Rhadamanthys)", "value": "398c866eef82f2033e3bf8eed3b4cbdc3d855bf159a51da8f8fe7c8ca4db79893ec1177da609732f191e940b907fa8cc", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585673, "uuid": "c8b644b4-cc4a-49f1-ab02-8b2f72260a54", "value": "T1E7366D4676951CF9EDBBC53DC9424905EB727C5647A0EACF03E00A960F27AE09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585673, "uuid": "78d8f04c-4a67-45c2-bba0-8d0274221090", "value": "7a30bacfd7c73383390074276a42a91f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585673, "uuid": "6e247a95-f694-4b7b-bc37-6532771cb104", "value": "6144:/RVj/uk8lP+8EBs8qUvULYPggufqEXLpYe+dYs:xm0rTvJPgguSEb7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585673, "uuid": "22031719-40ca-4820-a90d-0540ceb76219", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585673, "uuid": "790aa258-03ea-4d7f-b9db-2532ceafe4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585673, "uuid": "847fda7e-403b-4753-ad76-c114ae85c801", "value": "Crack Interium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d7e616-b318-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761557707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557707, "uuid": "285d1c52-48bc-49bf-8fa0-1a7705e21a58", "comment": "Malware payload (QuasarRAT)", "value": "07fb5ce9f1f567ac571fe4cf86d2a65c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557707, "uuid": "6bda154f-1e57-4881-b78b-5a03b0991985", "comment": "Malware payload (QuasarRAT)", "value": "436575800b95744469c08b2b05fcd3bda915278c57d1d890ce3288e82a88c32a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557707, "uuid": "0a8419ab-c7fd-47b6-89b6-c0d77cbebce3", "comment": "Malware payload (QuasarRAT)", "value": "b7c3a849f47b38c1552b40703204722598010ba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557707, "uuid": "8befd914-9733-4b61-85d5-e074a438d5c5", "comment": "Malware payload (QuasarRAT)", "value": "9f6947548021c1707a7dc555c27a01cc87c437c2b2c26f087dc974138d1e41534e46628fd3ea8d8b0d724e6afad3b4a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557707, "uuid": "ab1288f8-2459-4e1d-9a6f-8edfa47fb582", "value": "T193E55A0577F85E62E1ABD3B2D5F0541363F0F82AF3A3EB0B5191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557707, "uuid": "0c5f07f1-cf7a-48a6-a4a5-bfe8692c4b09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557707, "uuid": "7da245f1-ea81-4858-a3ee-f2c273b6caa3", "value": "49152:mvBt62XlaSFNWPjljiFa2RoUYIhgmAmzyNoGd0THHB72eh2NT:mvr62XlaSFNWPjljiFXRoUYIhgm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557707, "uuid": "5d925d0c-e1a6-4c27-a1dd-46a41551e358", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557707, "uuid": "d6365b73-1645-40c5-9ee9-c305fca230b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557707, "uuid": "b2dbb850-6927-4ae1-ac0d-92f19630593d", "value": "436575800b95744469c08b2b05fcd3bda915278c57d1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c449017-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1761588259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588259, "uuid": "d594c577-41b1-4c57-944a-3f98b8286465", "comment": "Malware payload (LummaStealer)", "value": "034736103481a3330c9784a86f0f567f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588259, "uuid": "d983f231-e4d0-4fb4-b6ef-ff21cb80d836", "comment": "Malware payload (LummaStealer)", "value": "438825ca5b1ffb704bddabc879647de566ba330be6a194234d1af121a01ad3c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588259, "uuid": "97f39702-686d-4cb1-9646-322109d434ef", "comment": "Malware payload (LummaStealer)", "value": "7b5244d269cb6773b99b538de158ddcc556e5a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588259, "uuid": "29de38ae-d8b6-4b07-95bb-2f13e23c6fc4", "comment": "Malware payload (LummaStealer)", "value": "5595b92278863438589bbf577b2eb93b9bd17f16225b33898bdb1ea47126098dc94aa183c4c182352f9d7e3d65465b84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588259, "uuid": "d6b545d9-d13f-45c7-ab46-34a3c81e046b", "value": "T160A5052DA894906DE71945398F6680513923BF4E3B2312C32960B678DF3E9DF793AF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588259, "uuid": "899b9472-33ee-4124-9b3d-db2dd6864e43", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588259, "uuid": "f55452b0-5d36-4421-a884-d5612c37d13f", "value": "24576:W7XQL2M+7Kudb0Mzvx0XZcjCQdrqG1W910zdY+Qdr:W7y2M+nb0kvx0JcjCQdrcM4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588259, "uuid": "fb8db676-bedc-4d6a-a6d2-ff2b7fb7a3a7", "value": 2161976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588259, "uuid": "24cf288e-b00e-4861-ab53-c495acd84829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588259, "uuid": "237f77d1-7a98-4f7a-be7e-d89e3b8dda53", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadd3d0d-b329-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761565199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565199, "uuid": "f786d4d7-2c79-48e3-8e9f-0f756812c8f6", "comment": "Malware payload (Mirai)", "value": "dd7b4c785582d9e898d7eba7dc0d63ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565199, "uuid": "452f56f0-b171-4c68-a354-2eb703c6cab9", "comment": "Malware payload (Mirai)", "value": "465ded7995aeb4bcc677f8f2ada7ef2544ba5e90e34f8ee203588c93108e8a43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565199, "uuid": "306985b3-fc64-470b-b19b-edf17573a51a", "comment": "Malware payload (Mirai)", "value": "ebc55a2b63a7b1d23fb049c8fe2649a01c1fc7f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565199, "uuid": "c0b2c039-0ad6-46c0-8112-74f1105110b9", "comment": "Malware payload (Mirai)", "value": "68f451c3d681d608922d199c1fe3696e4e28f6e59f0d904670638f5a1a84d973455f0015c2b5245032b68e3e8aab65f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565199, "uuid": "7545c64c-24ac-4fb1-80de-a135b95a8da0", "value": "T15AA338D7B401CDBDF84ADB7B4453590AB130E3620A831F36639BB967EC761981923F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565199, "uuid": "fb04f48e-d654-4468-ae66-c16f43290200", "value": "1536:MhzQ1QMfF4B+IOpnhNWBuvrT4ncBDx6q8n36HrQzCJ3GONN6KXL2NQkru/pe+q3:M+4UIenhNAuH+cBDx6CR3GQNZwru/8N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761565199, "uuid": "240a4548-5bd7-41d9-a45f-d8db2cb8c4e0", "value": 99848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761565199, "uuid": "2732d48a-f253-4f4b-9008-8c3fb5b33650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565199, "uuid": "8ebc6b93-4081-41d0-a060-0469392ed0ff", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c4461b-b373-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761596753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596753, "uuid": "cc62090e-179f-48a2-a407-860067e4bbc9", "comment": "Malware payload (AgentTesla)", "value": "cc3f949a95681938cc9efa228216a013", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596753, "uuid": "75145275-8dca-46af-a554-def82e672fb9", "comment": "Malware payload (AgentTesla)", "value": "481ad9300f937f588b444cecc823af80726f19ac7cc51859993df3e1feeda5b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596753, "uuid": "77e1e7e4-4f22-4415-907f-2bc01e42e1f7", "comment": "Malware payload (AgentTesla)", "value": "afeff720de709089a062751b8be42bcc5e258936", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596753, "uuid": "49685832-d390-4b1b-8012-308d557cb92b", "comment": "Malware payload (AgentTesla)", "value": "26ad081311043e7f794c88e2ed3b766de92f1bbe48ab021c9b6e1bd28c69289dae8d6a21310050e2763a4f242e603c7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596753, "uuid": "d91abae7-6cd6-48c5-be80-e729053fd4fa", "value": "T170311806DB039206F03B06BCA657AA7C62DC119B1970146E694CE3AA0EAD112867DFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596753, "uuid": "8b3a26bd-bfd5-4594-b963-0b6a558dc00b", "value": "24:9hYX/hPV8PHpWNE3dLl319G4UpOWzlq/8+1pNvqVM1dPSxR7afI2rKpe3AmUsu6B:9hqh98RdjXvNWzlr07vnFTrp8dCBPOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761596753, "uuid": "7ee7b8b6-4afe-4661-b003-d15165d9b9e6", "value": 1696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761596753, "uuid": "c9c70683-8511-4cf9-ab20-e37e7b7c2239", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596753, "uuid": "8275c83a-0e98-4614-983b-1ebe0d278751", "value": "Proforma_Invoice_Corrections_HSCO_2025-10-20.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a192994-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579129, "uuid": "bec03888-a016-489a-8df6-7c41c9a4f673", "comment": "Malware payload (Mirai)", "value": "9a11558dca26ef2f08c798371efdd1f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579129, "uuid": "947ac6e9-f4e5-49e3-bc20-56eaebf38b0c", "comment": "Malware payload (Mirai)", "value": "485c681ac6cfa9247cc5d0339443c3daf2856d9159ea6bffd55a04354d1eba1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579129, "uuid": "1dd341b1-743c-484d-83bf-abe0de4f912a", "comment": "Malware payload (Mirai)", "value": "5949c891e66091bdbbb7c4f06c476659d9ec7094", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579129, "uuid": "5acbb6c3-d24e-4980-b5f9-763a6e88c433", "comment": "Malware payload (Mirai)", "value": "45e51bbb1cae6f23d609fb956437010f443acbd412d8161dcadfcfdda5da56651a3ccb8e65f337c34fd5c78003dd6309", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579129, "uuid": "08030785-6cb3-49e1-be12-85172cd96991", "value": "T15B639209BF611FF7EC6FDC374AE92B4525DD641A21A83B397930D818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579129, "uuid": "2369bcdf-da8a-4196-aaf5-85f122f00889", "value": "768:CDScD5GY2naf8i2Sxt9yYExR15I3I5vTemle5Re5brvuX5XiANe1j9YE:CDSC5G9afb249FK2I5fl8RWb7Sq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579129, "uuid": "87594943-3961-441d-8592-7529e79daf4a", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579129, "uuid": "2c7a1f69-ef63-45b1-8d98-c84fae4cbd41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579129, "uuid": "f84eee69-50d4-458b-b048-c31bb6ffbe03", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0825182-b36b-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761593555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593555, "uuid": "66118f72-b4c1-4d97-bc6e-04687bddc328", "comment": "Malware payload (AsyncRAT)", "value": "0209e6d12d95353e0cf11bf7477d1b52", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593555, "uuid": "017c3112-d267-47ae-9e3e-0d41061d1044", "comment": "Malware payload (AsyncRAT)", "value": "4871c9614e5fc83321aa6b273fd3a9a28a8a5fd21685a1b4d76d3491b470d8ae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593555, "uuid": "3070e3a5-8f61-4876-9c3b-b0aeeed44e75", "comment": "Malware payload (AsyncRAT)", "value": "c6eef75fe289f56c4b6e7e02594b5c0ad120dcdc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593555, "uuid": "44fd3c77-6f3e-4d89-bc03-e6a79fa795e6", "comment": "Malware payload (AsyncRAT)", "value": "837cf5b71b6f9c484ec24e59f39f4ae18e894ffbdaa8446f6d351b58a18bbd537e541832929b3f466079c5c9f90ec7a2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593555, "uuid": "677e26ce-ae8d-4c3c-8d19-fb4afca8376a", "value": "T179259D0273D1D062FFAB92334B5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593555, "uuid": "e192e71b-7366-4b58-adbc-8d5692385ce7", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593555, "uuid": "ad0ac62f-b586-4be3-a416-a38727229496", "value": "24576:X5EmXFtKaL4/oFe5T9yyXYfP1ijXdaJEyY+:XPVt/LZeJbInQRaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761593555, "uuid": "0ed41fa0-a4c5-4e54-bc70-3b9dfbf02dbc", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761593555, "uuid": "eaf4c9ea-f8b1-449a-8934-f1621a2f69b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593555, "uuid": "81814adc-b62b-4ce8-8b07-ecf1d385e376", "value": "AVISO DE CHEGADA - LRAN16014S.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86760cdb-b317-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761557406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557406, "uuid": "6f5a1921-ab78-4027-bfb1-bc26aa46377a", "comment": "Malware payload (RemcosRAT)", "value": "c73ff7254d5d457d1584c5b20bc17573", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557406, "uuid": "f75f912d-5a96-4698-9d48-72411dbfba55", "comment": "Malware payload (RemcosRAT)", "value": "489a5a688ddfd308cf734d5f1f6242b40df3d9cda4a93153aaa10da1529dd837", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557406, "uuid": "95ea4c86-d754-441d-ab1b-e61a14750731", "comment": "Malware payload (RemcosRAT)", "value": "3c93bd0cca966c9cd404b9b1bdc88f7ae33e2c41", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557406, "uuid": "1db1c9ad-824a-4c7b-9df0-a7471e8fb26d", "comment": "Malware payload (RemcosRAT)", "value": "dd71970507273d852e2d46084d765a36bed6f28a44c6263eaba3aaaf0d1340527f0f7e444944e51418aa5ec31197d29e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557406, "uuid": "510397fc-923b-4850-b7af-4a91183c0def", "value": "T1927533200D567CBBCF2CD639607B9F1AE268C7D53A79D1ED739C14C602AF4C1C9AA911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557406, "uuid": "6997a5df-b9b1-4ba9-af6b-6d0c97eb4396", "value": "24576:ZmUClcUw7e+Gg/8ph+JEWb3JOYetrpY+Jr0gADpGxSwA3pZ2+JG81BbsBz90QXcZ:d7nGOnElFpooz+GtXJ8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557406, "uuid": "67ee15d0-1888-4489-b005-08e265e3e42d", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557406, "uuid": "f3308b08-5e58-40b5-8c09-27611e524295", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557406, "uuid": "b0965473-97dd-4e21-b011-2d4874de33db", "value": "n_418_437_432_435_441_442_443_432_430_45A_435__437_430.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07759a28-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607015, "uuid": "32449947-954d-4c9f-8e71-20065707a1df", "comment": "Malware payload (Mirai)", "value": "6a759c7d865c2987d16639b2b30870f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607015, "uuid": "bd55dba1-3247-4ec8-8ac1-3d7452773bb1", "comment": "Malware payload (Mirai)", "value": "489bcbbbcef1147eb1ea79ea9d14f87dae7976cf49a39613a91af345ac68eab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607015, "uuid": "ae3f21f7-ad40-4226-b5c2-9fa15c6e891f", "comment": "Malware payload (Mirai)", "value": "a065692e530440f48bebfb7bcf66d04c0ea8ecb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607015, "uuid": "d65fa20e-36e1-4caa-be97-8c4947e94b3d", "comment": "Malware payload (Mirai)", "value": "e6375e4e79e2f69e2eddb433c8336ec743985d29ede46543c8edb7ac77e9f0ecacf8dc9463f6f54af8fa2542fcb3814e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607015, "uuid": "0ca4121c-0a7d-4d56-aab4-7d0dcc833f32", "value": "T1CBC31B45FC404B23C6D611BBFB5E428D3B2A17E9D3EE720399215F60378686B0E3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607015, "uuid": "a2c7fd92-4aa2-4f7f-ae2e-9ad10e0f1da9", "value": "1536:pHK20FG5NCjWoZMcxZOqcW2AcRX4VRo6TD7hFzycLoRuqaXYvABPglHFwywDROb8:RK23k99jOfW2R446ThFzpLo9QYYFDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607015, "uuid": "8da4bb66-1409-440b-9ad9-4e5b82ab1c11", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607015, "uuid": "3df28aa5-cb23-4d3f-ad11-74abda5c7221", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607015, "uuid": "49b6294a-856a-475c-9819-9eca844cca92", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219f98cb-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1761577424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577424, "uuid": "d1b3ac43-532e-4bae-a469-10d9c443a0b0", "comment": "Malware payload (Gafgyt)", "value": "fbef3534216eab7ba740787e33ecf41c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577424, "uuid": "b8a3bcc0-d114-43b9-a24c-18ae7c8fa8fb", "comment": "Malware payload (Gafgyt)", "value": "4a20dde1108e2bce36366f7cd3841bac7b8f30e7482bc44195ee0a9720b275da", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577424, "uuid": "38653386-40b2-4f3d-833d-a318d25b1cf4", "comment": "Malware payload (Gafgyt)", "value": "440cc2efdc15e59906fee5fcffe10c7accff9474", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577424, "uuid": "a4fb3848-96bb-4de2-8b39-13408b377d14", "comment": "Malware payload (Gafgyt)", "value": "89399364189aa0fe80936eec49358996c80ff22870db22b64cdf769ac0793d39aee68a5ea61c1a86fe31e3f13e850e86", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577424, "uuid": "c579abf6-e957-448b-a041-f329c44ecec4", "value": "T1AF31B6CB71A14AB06CE5E967326B841878E6E98F15CE5F992DDC3CEE448DE04F400693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577424, "uuid": "eaa25efd-1842-4d90-8f88-6ea3b513dd19", "value": "48:v8b8P8lt4k8Tb8D8X8D84+8P8v38l3J8P8D8mbCoR:veS64kybOq22yO3G6GHbCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577424, "uuid": "b1cec27d-8b9e-4a56-b3e3-4b4d87d97d66", "value": 1818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577424, "uuid": "0f4869ac-3e01-4515-b86e-335061a319ed", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577424, "uuid": "c25f36bb-4775-4187-b24e-ab70d4aff62b", "value": "billjenkinbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b105c44-b2ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761524262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761524262, "uuid": "107aaf4e-b9f5-4926-a19d-214a992fafe9", "comment": "Malware payload (Mirai)", "value": "e2fdaae0b6aa3dbeab26d5cff2e379ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761524262, "uuid": "27a76a67-74d7-4ba6-b1e2-f076a47f25ea", "comment": "Malware payload (Mirai)", "value": "4aca9579b37153754583b028d4881ecc7e81130f2b675dd835c427352f1e6772", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761524262, "uuid": "e7998b8f-29a8-403d-bd64-040184b4a478", "comment": "Malware payload (Mirai)", "value": "856dd311a61477c653015bbd054cb000a9a288eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761524262, "uuid": "9d32ce88-8804-40c4-b904-483159c964db", "comment": "Malware payload (Mirai)", "value": "e275324db41f80e0efca71411f2ce7f36a2110b0016f876d3180a0d5cc8f7b791490029a3e5d19eb6c8bc4581c581cc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761524262, "uuid": "ee5e9a34-4b34-4ba3-bd96-dbe3922b302a", "value": "T17E03F22E23C854A0D5280A708FAD5E99A07C073423B63D374E06367AF75AF5E7CB2B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761524262, "uuid": "25fea2ba-4953-49c7-974a-6e808aff52b5", "value": "768:R2P9pYN9Alqhz5TrfEsGoJErGmVu+X9V+MFGA2CduEBjos3UoztY:EP9p89A6zpcs7Jau+X9VTPDztY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761524262, "uuid": "d744187e-45c4-4e2d-a000-e9bddc291ffc", "value": 39956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761524262, "uuid": "23a9ace9-c2cf-4df3-91df-0a0767fec7b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761524262, "uuid": "04e51e4e-0655-4033-92bb-f72af3a2d2b6", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2dbe79-b372-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761596532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596532, "uuid": "50b052df-39e5-40ff-a128-4c4463c91976", "comment": "Malware payload (XWorm)", "value": "14ed35f38918b67e54738a4054b61ce1", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596532, "uuid": "4336d4bf-01e1-4128-9140-615f570a9460", "comment": "Malware payload (XWorm)", "value": "4ae0ba628648385c328f649e326f0419e07b771677d60dd23f27d43a87617a06", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596532, "uuid": "f9c61ad8-4c4a-47bd-83d9-21cf8367cccb", "comment": "Malware payload (XWorm)", "value": "892290b4697f5ee214a9e9186c8d48d344903128", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596532, "uuid": "15bd332a-8b0b-4390-8e9c-6aa728224f40", "comment": "Malware payload (XWorm)", "value": "5b7e76c52e6fd031ab9b2aab1c13ddbd930975568dd166dc84b5f8a489373ca297ccf6bc45f82e6c3ff3f3d291707e05", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596532, "uuid": "b92253b8-4e64-429a-b313-6c19f0343f6f", "value": "T194B423BCAB62A078A0FE0B5ECFD5509B6640E4D16756CF7BF1E18F22258F112154F8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596532, "uuid": "d348bc3b-14fa-407b-a8db-a3f8717bb2d8", "value": "12288:Qr/cKXi6UDA98qhd3z98Fn3hj2XyDovx9NJWVHdAGKGgAx:QDrijG8qrD23hbD2VWVHd2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761596532, "uuid": "9198267e-9a06-48ad-b6b2-469154712e77", "value": 497416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761596532, "uuid": "83a93ba5-5a8a-43db-9f10-0de2c58ab686", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596532, "uuid": "c8b65e74-a0e5-4f44-b829-690b8fc04a21", "value": "ARRIVAL NOTICE 46.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1faea3eb-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579138, "uuid": "91752b1f-cada-4e4c-8509-9164b2e4a4da", "comment": "Malware payload (Mirai)", "value": "b9c812eed1a3ba4535e6a3d9df51b0cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579138, "uuid": "1a4912c0-f687-48a4-97ed-302a8c506d97", "comment": "Malware payload (Mirai)", "value": "4b5549002503f89f516aa94676956c2dab5b0a97dca1846bc01ae72adeda71c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579138, "uuid": "8865f07d-2fd1-4f3f-a09b-0a603e517628", "comment": "Malware payload (Mirai)", "value": "57fae188658c2b446072bc1a48db9cf81cbe5f9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579138, "uuid": "5a6688a3-0e8f-4d63-9e43-bcb9f5afbfb9", "comment": "Malware payload (Mirai)", "value": "d01b0f1ff1f3efcc63373aefa032d950121569f83a5e40540e8d4769804e90f04eaa39881bccba06796e5e22e7c7b371", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579138, "uuid": "20b41e62-998b-4361-8706-0440c4487e6c", "value": "T15F533922A9792A17C0E5F57B21F78324B2F5670E24A8C76E7D320F8EFF1854065076B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579138, "uuid": "5f212561-3955-4d16-a8ae-41f2a14e6334", "value": "768:47qtsAOUAo0q9jeCwRT4W8f8dwJOCgA+d9E5mp5ti0KcSGO+h9s8F40:wqtsGAhSjeCE4xf8dwJvgA+d9xcEhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579138, "uuid": "eb06780b-1724-4973-8867-2b695c049f0e", "value": 62484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579138, "uuid": "016e2d83-008d-4573-8656-91ed611b15a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579138, "uuid": "8e136b34-d774-4c0b-adb7-92584676ef98", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87428341-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588332, "uuid": "be8cf4e0-5544-4245-a288-a960d0647c95", "comment": "Malware payload", "value": "e7ee4411abe78839aa22bd8a1a36ab62", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588332, "uuid": "8f399196-cf7b-4f08-883a-ad2ed05ed2c7", "comment": "Malware payload", "value": "4d06b2ca9120d32c07f89d3994c4c95e281e7a527817b90cff2172adc135cb17", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588332, "uuid": "3664f206-8c37-472a-b7fe-6d39b528fd28", "comment": "Malware payload", "value": "5ad003558d0d3c82dd70960ae792427564de6f5f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588332, "uuid": "f693335d-fb8a-41ba-9150-c0603a367b5d", "comment": "Malware payload", "value": "cfef83d572b0e1af08ed630038976fbf301f396af6c14aa423bc2ecf3a1c86b9d3fe1534c1082732ea7866166b11f80a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588332, "uuid": "0bdd0a90-a7f4-41c3-b0c1-c7760265c4b4", "value": "T1F9C0120462A814A57125B561F5144493FC909824FB52BD74CBBCD2A9ADA590C93112F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588332, "uuid": "254fa57c-c8cb-4cc4-94f1-4ff912b0978c", "value": "3:voYAmoph2miCun5MJLKmcgFO4vJdFkuEFsovsoboPuEFcZ1FmvsbzCYIEFgAYoG5:voYUQPDgFO4BEuEF5soJEFcvysfCYIEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588332, "uuid": "ec950897-ea8e-4778-a77d-b1456d79aa64", "value": 183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588332, "uuid": "cd2f7de6-eb1d-4d9b-a785-a7070d33fc31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588332, "uuid": "f22f1dde-05ed-4fed-976f-d2739ece9c1d", "value": ".gitconfig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3080a6-b329-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761565197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565197, "uuid": "f6f9d93d-ed56-4160-8107-765406462d1e", "comment": "Malware payload (Mirai)", "value": "6f5a2931930ab631e4920ba300560d48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565197, "uuid": "eec2f36d-86ac-4fb7-b1ab-564050939cf6", "comment": "Malware payload (Mirai)", "value": "4d2d04b828c7c85aafc7a0de8963abbe7846ef27c6334b695d737ea635c51f44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565197, "uuid": "0a6e44a9-2eb3-42f3-9e51-18a7b5dbf1fb", "comment": "Malware payload (Mirai)", "value": "d8facb82ee1ff7d017839337a3cd0a18fced1ed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565197, "uuid": "be09d217-de66-4bad-9422-c451cdf996ed", "comment": "Malware payload (Mirai)", "value": "94dff71deda84f20cc56bb3ea99e10c4429142338af0183c9a80bc94e1808ec14d5e37282f6b7411ab8837425fb8f442", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565197, "uuid": "331e5dab-8e26-4018-81b4-b9f98ace5a71", "value": "T17B935C02B70C0E43D1675DF02A3F27D1D3EFA6E121F4FA88691E9A8591B6D321586FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565197, "uuid": "72d4af5d-7dd6-4fe1-85f4-76dfe72df2d4", "value": "1536:gwiReU18TQLro6XLio5o8lVBbbH7h5j0UvGW4BAfKMcBRWFMOXyC/D0QLl/HOo:oMa8TF2jbAjAfGSM1CNko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761565197, "uuid": "5198df83-9a4f-4191-ad95-1bd8162eca29", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761565197, "uuid": "740c4152-1ed7-4a9e-a0bc-413c84b8211f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565197, "uuid": "a7e02a18-0b8d-41de-94b2-b6dd69f5dd14", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603748d4-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595568, "uuid": "a8be893f-e3d0-4a48-8934-4824622bd92f", "comment": "Malware payload", "value": "594a3e3adcf139e7b20eddd1f16131d3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595568, "uuid": "8481b91a-2eb6-4c49-a14b-ab9a626e2d2f", "comment": "Malware payload", "value": "52163973b0cf8d46bcd1fb26c58f8ab2f7b31fb7e2b05ded2b59ae8d4e2332ad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595568, "uuid": "af3e0d25-d7eb-45b7-9b0b-34f1b445abd5", "comment": "Malware payload", "value": "7700c89b10e779fc6db72b42be0a81fe89378f9a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595568, "uuid": "13911508-1504-4987-bacb-a5b88f54a731", "comment": "Malware payload", "value": "4507c6d3600a56506be93e86f6e639d1bfa4e6cc2f5ea410e49b1aeb571d6ff9e8fa3e16e9d8e1a82feb5d01ee65d4b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595568, "uuid": "7d160117-bfde-4d5b-8212-0fcab6ce1ca0", "value": "T15D34181B7B688866C557823D95938B46F7B278104F22D7CF4291833E5F7B7E4AD39220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595568, "uuid": "ab032d9b-3b19-404c-b7ab-dc1d6135fd89", "value": "f326923155bd60bb7ee4ee4bae4fe8c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595568, "uuid": "ef579189-951e-4ce9-b99e-98cc16e50e82", "value": "3072:qXpgaHfqXE8K82tQyGErXG26enlqlfO/2wimZfoEkRob6Jlai+ffrTS0HN:qfiUm2B969YZ5kRoQ9+XrTSyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595568, "uuid": "2de1432a-7473-4116-b768-d2a013a09676", "value": 247160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595568, "uuid": "7250c72a-9cde-4877-8767-fb0d05046138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595568, "uuid": "338dddf1-ed70-43ff-a191-87d0566d86fe", "value": "brand.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a767fbae-b329-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761565193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565193, "uuid": "51fee805-8fbf-41be-bad9-0427ce56a56c", "comment": "Malware payload (Mirai)", "value": "eae7ba4e714bf880f4b64bfca7fe36eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565193, "uuid": "8793dbb7-675b-4895-8da8-306fed410f2e", "comment": "Malware payload (Mirai)", "value": "52571a36070ffbaecc97fdcb5ebbf0a38fa9908e9ce062b1443e842bf1a3df83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565193, "uuid": "9948ca48-7fa8-4dc0-9b0a-91baea78fbf7", "comment": "Malware payload (Mirai)", "value": "9bdb0aab4219ccb58c3a2716c4dfd6c2fed5cf39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565193, "uuid": "a5f2fdd6-0a23-4784-91df-d42f1dde8cac", "comment": "Malware payload (Mirai)", "value": "20a20356169f7eabe0945ea86d3655dfa01e46c0fca499d5363d517c0a73f1af9ce341425c91617b7ef9a48755a52513", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565193, "uuid": "d7e966d2-9dcb-422a-91d0-39464eb6b6f1", "value": "T14C936D42B70C0A43E1574DF02A3F57E1C3AA66A120F8FA89790EDF4996B2D325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565193, "uuid": "4309aa6f-bb62-42f6-8d66-0879ce42e030", "value": "1536:qf9jbHKubuZqESdJmL00C80MaIy3qTfl3GwT1fm4ymM/0l1WrFVfTAeG2+c:6/SHTfhGaymMyWr3+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761565193, "uuid": "93a97b9e-7a7c-4290-a53d-5c551d4419da", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761565193, "uuid": "9973cef2-4671-45f7-bef3-4c649fd18e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565193, "uuid": "ebe5bc5e-869f-482c-9ff9-dc8c50f292c8", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3630a923-b360-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588625, "uuid": "a4df963c-94ff-49f4-aa32-651dbee7e303", "comment": "Malware payload", "value": "8d8309a795cb4b5c7e66bf202d111037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588625, "uuid": "47b9c5c3-d6bd-44c1-8cfc-16d09b3ebcb9", "comment": "Malware payload", "value": "5376b0fea8d666fdcc1f330bd6f34aa5623dcbcad4b0ffed53087456ee849214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588625, "uuid": "bcef0823-b04e-4a14-a60d-f872b994ec7d", "comment": "Malware payload", "value": "5b3c7143d89938948f1df45f64d08d64b1e5177b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588625, "uuid": "9be3ada6-b4b0-4667-9fd8-22563dcf1f52", "comment": "Malware payload", "value": "6e3635be7a6514053da490e253e7c34a3c1f25177d1b7fb8eeff78b28e5a7cd35f840d5beebe0abe72d1549c440a2507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588625, "uuid": "c1a4cdba-dd13-4776-ad96-45faec69ed7c", "value": "T1CD0439CDE1B810E4DCA3E0B5DFE09ED9F178351847A865EB137AC5B093239E06979E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588625, "uuid": "6fca2aff-6a39-4eed-b5e5-93371e273d84", "value": "126d53ca0e805dadf70bc590950e90d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588625, "uuid": "614745f5-c30e-43e1-8260-b814f495446b", "value": "3072:pEqn/irEsrD3xo2vYsWwY6JOXnVvqAKesWu4OauYfI92YETrc3M7:l/irEgNWoJOXnVvqAKesQOauYfa2YETt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588625, "uuid": "6f74bf47-5813-4a31-ad48-61ee518eb88c", "value": 188936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588625, "uuid": "61f9ed8f-2cca-4288-ab10-94ea92c8ca50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588625, "uuid": "8a0aab8a-9ff2-4d24-976c-a6e3345b904c", "value": "1PO24S1458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61dc51a2-b2fc-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761545749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761545749, "uuid": "411b0c5f-e0e2-49c0-9a86-1f32c918ec3e", "comment": "Malware payload (AgentTesla)", "value": "3bad82e87f807e681082130a3c644744", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761545749, "uuid": "f7ab2da1-4cb8-4fde-a885-aaa839c48076", "comment": "Malware payload (AgentTesla)", "value": "53864e83655e52a17e3a9d3e588193218299055f930b470c134e606138426ca5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761545749, "uuid": "53c3bb98-9b9e-4799-b975-7fbc6b78b7c2", "comment": "Malware payload (AgentTesla)", "value": "c9dc395c6d576c315cd7f302543e8ade97338dd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761545749, "uuid": "816f52b6-57be-48d8-9cf0-b5883da8dc3b", "comment": "Malware payload (AgentTesla)", "value": "727d4a9ff8abe11147bb69466b0d10f4f1e14eb1a0e59d026d0279fc9e79852ba3ce48faf5852c987368779cb89e7d5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761545749, "uuid": "472f05f7-0c9b-4c86-aef0-ff2e5468268a", "value": "T100E412403B24D503C9619BF40AF1F2760779BEC5A510E3A2AEDABEEB79E6F141D14243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761545749, "uuid": "23448631-e49a-4064-8f6d-b2a3010b014e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761545749, "uuid": "f8a1f732-4ae9-4eae-8d74-879fec09c204", "value": "12288:lcVbQkQLApmpD4QIUropj+PhgtmgspF0tSp4C7uopByoqNjcRkR:lchQRGmZqSat5sF2Sp4C7PpB8NjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761545749, "uuid": "1a1bbc7a-eb94-4181-8803-76c7e57b2437", "value": 698888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761545749, "uuid": "93808956-0aff-4cb6-8d5c-1629f8497b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761545749, "uuid": "19ad13bc-5dd9-431f-8eb7-d610cb76ca4e", "value": "SecuriteInfo.com.Variant.Genie.8DN.1087.30170.21190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a407ee8-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607020, "uuid": "f675943a-61eb-420c-acf7-602f1b880473", "comment": "Malware payload (Mirai)", "value": "f9e0b89bc0ea142691365ed558dee483", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607020, "uuid": "6fd50e5f-dfa7-4c00-b801-45374ae29464", "comment": "Malware payload (Mirai)", "value": "53e22f5893624b707b0f1914d8624d5f5dcf33d86ad14272099b2c81c363d861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607020, "uuid": "76328370-7338-43a3-9eee-fcfa9b8bffe0", "comment": "Malware payload (Mirai)", "value": "37bbc15cf96557930c6f410251c3efe8e7c90bc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607020, "uuid": "007d6cec-4e3b-4e0e-ae29-3c54f66f7fb2", "comment": "Malware payload (Mirai)", "value": "b2c8574f26757a25abf82de6b86e3acd854e833a0bd36ba39e46750c4f1596cb8974066de99d6c80c102def84837fa83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607020, "uuid": "4b0a8740-fa03-4126-847d-27d42300c32d", "value": "T17BD35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607020, "uuid": "555b8884-c230-4bbc-bfe6-65bb46e9a5ba", "value": "3072:79eSuygEPjt6qkWqqdKmDnYMb0gBd/gQyVGsdqml67aj:79eSuygEPjt6qkWqZeH2la7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607020, "uuid": "960b864e-1610-4f66-95c5-aae123810007", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607020, "uuid": "e8d53437-7afa-4c51-ba82-ca13efd07837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607020, "uuid": "cc19f0fc-117e-4e5b-99a3-0ff7ad774900", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b33d3ec-b35a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761586191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586191, "uuid": "744657b4-87e1-4c1a-89d3-89842df4d346", "comment": "Malware payload", "value": "3c16abb3980747717758d25f401d2f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586191, "uuid": "a9944684-c7d2-46ce-8c2a-e1b50c56c9c8", "comment": "Malware payload", "value": "5545a23dfc8b49f7f8196de40c957895e6ac102ed24994fc00a9df45d2cc7afb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586191, "uuid": "e804d0f9-e15c-42ce-9d43-4bbaadb94810", "comment": "Malware payload", "value": "6e4a31fa4bd0980711c25900952bcf039e5878bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586191, "uuid": "0b6373e6-9252-4f19-8171-6e0a3a13a80f", "comment": "Malware payload", "value": "a9faa97342574021a48897618351f38d5d0dab86920a5d885b2d87a6f9586430fdd4d444117c79bd712697de5984495d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586191, "uuid": "b7285da9-7c21-4ab5-ae1f-3952efdcf2ce", "value": "T18DE5E4AE9894905CC6D542389F7A61413A727E4D3B2323C31A52B2B89FBD6CF7439F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586191, "uuid": "ad383524-a925-4652-bd4a-153847bbec89", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586191, "uuid": "9b41e366-4a5a-4ab3-96c4-e3e397e2e68a", "value": "49152:3cFKi/nX98Snfic4j6oyganrAFnfwUvK6MnG6UMbn3BR6:3+u6n4j6RgkrAFnf/RMnG6UMbxR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761586191, "uuid": "c20074ea-ba36-4aa4-a95d-605d783cdaf8", "value": 3130680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761586191, "uuid": "b7db4a65-916e-4fe0-af4e-a8df856e38a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586191, "uuid": "b67727da-eb02-4a9d-9915-b108bb854636", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1955c9-b387-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761605328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605328, "uuid": "1b652ad2-4eae-4e10-a222-f73f42c6f3d7", "comment": "Malware payload", "value": "7625d70a6f387e34c322b2beafbbcc1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605328, "uuid": "50e6abee-dcff-406c-8f9f-a1f1b8f8de5e", "comment": "Malware payload", "value": "559374f73405dc5bfd302f53f833e9ad7b9a77e64369af3b52ea9c22770064e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605328, "uuid": "44e65014-a6ca-432c-9d7a-3938cd544752", "comment": "Malware payload", "value": "c7715b4113bedb7497bab8e4c89827ee06365184", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605328, "uuid": "b44d096e-2d6b-4448-8773-71318361b504", "comment": "Malware payload", "value": "4ea085d677e4ae98c09bd6760b836519e6bf25c80211a29a6c2d2e783b0453a8d82bf0c74584f1336494f53b46403982", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761605328, "uuid": "0e89a9e0-3998-4728-b146-8b924031420a", "value": "T1615302B8C0940D12D5DDDDF97BA69A7A76E20E8D712F7CB2645C2F011017502BB2BACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761605328, "uuid": "05b1636e-79b7-45bc-99ea-c70d29932272", "value": "1536:lUPESzbkvjrHINfVbd3k/6v05e+BBvryS8XLMn4N4u+qgw09W:lUPGjIc5xraXLM84u+qgwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761605328, "uuid": "f4f97e93-49c5-4cc6-953d-d7487e3bad0c", "value": 64456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761605328, "uuid": "8cfebd8b-8a06-4d93-b505-5f29e42b2e8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761605328, "uuid": "5456726a-71e4-4123-b9b3-36c04fa36452", "value": "Orbt.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532b6fbb-b390-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761609290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609290, "uuid": "bf08410a-37b8-42ba-85a3-3627788dada2", "comment": "Malware payload", "value": "d4f90eecfa367ddcc7e6367ffc79e94e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609290, "uuid": "b0300d06-e15c-485b-892a-eede9682a129", "comment": "Malware payload", "value": "5683fd10065462890f8f481a8e55595883e1025d3d211164bcac8266d9aedf2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609290, "uuid": "9d020306-1134-4918-85a6-d9dbe27bc727", "comment": "Malware payload", "value": "c1218dd88966d843619038e6651295bf05ebd287", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761609290, "uuid": "0d68d7aa-bc5d-4425-8af2-5fa9aa1a6bb4", "comment": "Malware payload", "value": "8fd72a3c838cd43bcf6566a61e2071f76ee75e7a47d370557e675659740472e5793af9fac49f5d8284119b56bd2efb0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609290, "uuid": "69f78c98-e463-46f1-9686-c476102ae0e5", "value": "T1E16302EE32C3E89BC86A3E31282E5763131472E1EB29C54F6D4642195D6CD9CEC254EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609290, "uuid": "273de9bd-eea3-4f2b-a89b-546d08110dba", "value": "1536:OZlyQnI87tGwJFmEItnsTjrBBgdK7WRdIO5iIrZh3vCjWIqihN4E:g6Fw2EItsrB81iIFh/CIihNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761609290, "uuid": "77093463-7028-4313-8b63-f8d378c5a180", "value": 68408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761609290, "uuid": "bc6f9fcb-5f58-4d8e-809b-cad94459552c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761609290, "uuid": "f8120547-43d6-4c02-8500-85a079bf396b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34eb2e7-b388-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761606122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606122, "uuid": "657282dc-ce54-45ac-9cc9-34de8b519073", "comment": "Malware payload (Mirai)", "value": "4157c9ab54597794e09281a0869922ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606122, "uuid": "d92b9b36-9105-4335-afbc-0bc436c1a1cd", "comment": "Malware payload (Mirai)", "value": "57da206d52ce839e78ad5fc2c78b45e369930fef7d6573cb7e8a2ca61a793200", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606122, "uuid": "8b4eb24a-091c-4439-8a25-296ee729ff65", "comment": "Malware payload (Mirai)", "value": "2eb1fe3c9ce528db4345e303dbedf6bd5d208dc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606122, "uuid": "2a175a19-9bdf-45e8-9606-24fc87a246b2", "comment": "Malware payload (Mirai)", "value": "d5eaade09d8ff8bd0153d619163cb41ed9a2510946463edcb3d94b4a7070b55a9b0cf0a2a71e02ea8774741dbfc7768e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761606122, "uuid": "0fdbcefc-f1e6-4616-ac78-b8d64235a155", "value": "T1F2F32A85F8C19E12C6C212BFFB5E428D372657A8D2EA31039D266F21378B56B0F3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761606122, "uuid": "c4c259c0-cb2f-41cc-b178-9274c35d3f92", "value": "3072:slmye/ipIuz/lHOjCMri9T4W1wNEDIEeVZPdM:slmye/ip/liRrGT4ywODzeVZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761606122, "uuid": "15be636e-91a4-4646-9aba-4d0ddbbc3163", "value": 172288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761606122, "uuid": "d7a78def-8924-47ee-9aa1-f005379c4961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761606122, "uuid": "e0d0fc34-4a7c-4767-9ae7-8d7a680c953f", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc19af1-b2f7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761543705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761543705, "uuid": "1cbf0fcb-da03-4a8d-8144-e2d78e0bbae5", "comment": "Malware payload (Mirai)", "value": "daa7b60c28c9ac8d3904528b2365f71a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761543705, "uuid": "5c77f67a-e02c-4774-be80-e1e68b824f39", "comment": "Malware payload (Mirai)", "value": "5833c7490a147d84d6b12dbed69c21133dc6fe5b51b94e54c94d55a2ed30ba2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761543705, "uuid": "376efee3-7735-4d92-9a91-7b33c6d909e7", "comment": "Malware payload (Mirai)", "value": "5c4d63655384415d18ed8915591c0c957a51b97f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761543705, "uuid": "6f28ade5-6ddd-4001-aae7-baad881c8f43", "comment": "Malware payload (Mirai)", "value": "bb7629585e86879b1ee6751845517a9eeffb1653039b97ae53e3295d1176b241d49a912a68d121b2917b4e7be35a3f00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761543705, "uuid": "98dada99-3b0f-4d43-9f51-51c76f0156ce", "value": "T19C433B95FC92456AC7D117BA771A968A336223A9C2CF7313CC0C0A5177C9B4F4E6BB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761543705, "uuid": "b661e18b-709d-4b4c-9f5a-6eeac691b4a4", "value": "768:cxao+g6Z6nGYbl8d6s8n3WkZDJmrdDKukv4f76uwyMRE92FH0nzz:cxao+ZajeAHWU1mrdDKukiwyXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761543705, "uuid": "7aa2ecb2-eb22-4535-ad55-bf066903b880", "value": 55344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761543705, "uuid": "9b8f9bc1-200c-48b7-a3ac-6034966f8b8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761543705, "uuid": "e56e304c-2f39-44f6-bfda-3b9838fa7007", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0145ec97-b339-11f0-91c6-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1761571786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571786, "uuid": "6f6c6b1a-63ed-4194-8d3f-d40b2cabfb0e", "comment": "Malware payload (Phorpiex)", "value": "c7d975498cad9977201729f512f966c3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571786, "uuid": "8cac17bf-6b15-4fc4-a603-9cb9dbbe68b1", "comment": "Malware payload (Phorpiex)", "value": "586a29bab56e5d7be8b7a783256b0458a4eca167c7d519fdbc8467ba2331e7e8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571786, "uuid": "2d65c97c-1c5b-4ad8-a7d8-c56e5e70dc22", "comment": "Malware payload (Phorpiex)", "value": "ffbbb8281f64a3b7fef293f3c7bb88ab30d668b8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571786, "uuid": "4f8661ba-7232-4cc5-82a1-4dd86a822f69", "comment": "Malware payload (Phorpiex)", "value": "d1ee2d849a5ff38c8234eadbd2b8325421e5bf6f14f95a88351675e73c1c7bfa81ce61293dda07ca840f157518e39b9e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571786, "uuid": "40985104-eb1f-4c39-9537-7560ad857ea3", "value": "T15F22F807BD868061D3D448F017B5878A8BBE0473279272DBB3B3955E4B74386C47BAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571786, "uuid": "d8c4ad03-dfd6-4bd4-bcd6-85cf3b113459", "value": "abcf9709e3eeba582adf1cd31d5fae48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571786, "uuid": "057c853e-584a-41fe-a2c2-3a568033b6b8", "value": "96:3TO8uVlz6rfKUIYYdRWrmDi8R+58bw3wpEzuJxGENXRh2qhRC7tCEbYi2Z4:3TWlz6fPI+riR+ibyCJxTNhhthybHo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761571786, "uuid": "7fbfb68e-e9c2-4656-bcff-a4256eaf9a47", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761571786, "uuid": "84d4bf17-a1a0-4039-8a0d-fc428dbac135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571786, "uuid": "638a5f62-ad4a-4292-9043-d599df00aae3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d7b927-b350-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761581754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581754, "uuid": "9dd8a661-97e9-4e08-b8fa-c83fb33b8501", "comment": "Malware payload", "value": "74d0ae51c66f2108472bce7a757a3622", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581754, "uuid": "3edee0f8-f1d5-46d9-b288-ee7fe848ee2e", "comment": "Malware payload", "value": "5921f23c8f437f47efdeabe70fdceb0924dd084bf098a00af0b3e2ee27dd2dca", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581754, "uuid": "36c0b5b6-66d8-433b-ad72-453c7d0bfd52", "comment": "Malware payload", "value": "1fa3967970f100f9b62f15d579cd4cabdd59c809", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581754, "uuid": "c6d7be52-8b86-4322-a6b5-85c2a2bfacce", "comment": "Malware payload", "value": "cd01198e850a73b631f4d5a54f7d7eec739cf73014fdb95f9f06118b55a3a11fd4010133aa6832a6b5212cb0acec0237", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581754, "uuid": "669b6691-c091-405c-9111-cbc3da51992e", "value": "T102E164882FC57024C72662332B7E75279516DD80E65F84D9E035E6A439A0F11FB6F6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581754, "uuid": "a8c98a30-43a0-4dfd-844a-f18eae244e9f", "value": "96:/wPmM2XZbXZUyfugcl5vlEABX0mBOYml+YlvwY:BM2FXSwclllEABX0mBOlhJwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761581754, "uuid": "7fc71367-ebfa-41dd-a44f-965bddcc9e0e", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761581754, "uuid": "351be272-c52e-40c7-adf8-e261a3a5eee5", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581754, "uuid": "96153d99-25e3-4f43-8c06-27d3413921ad", "value": "Shipping documents.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f64f09f-b35e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761587943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587943, "uuid": "296aeab9-f2bc-40bc-86d4-70c3b06378c3", "comment": "Malware payload", "value": "92d4924a69e6d3e2009278d98dc95806", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587943, "uuid": "10c9b6f4-c157-485f-b75f-097a49f407f6", "comment": "Malware payload", "value": "598917a3fa45998de232528476d88ade09f18e828e96a5862d9484c0d5f31599", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587943, "uuid": "11f80a78-4347-46ec-bf36-a5e515846060", "comment": "Malware payload", "value": "6ff4479db7aa512beff827263bde390b110abc49", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587943, "uuid": "1aabf88f-babe-4043-b65c-0acba2ec9064", "comment": "Malware payload", "value": "4e3dce643b60b954046db1e35bb9917260cb2c8826a53c3c5bf54236d59adfd80aed8705592e05a95e74ef1cf2be4ff2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587943, "uuid": "800bccb9-255c-4089-9142-e64c8a4dca41", "value": "T11AD533AD7EDCF8A89CB7931E32B07D4EEE9B00D61E5C953611C56C10A1102FD86AC9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587943, "uuid": "d340315c-03e1-4b20-802d-72cf82380e11", "value": "49152:H76eq4hoQNIBoxI2YSxNVc4nUshKPE+YbDdnuGBgTpkWbFDuVbgNgdUKGbghmW:HWeq4okSo1YQVhnUxE+cDG+WhDuVbFUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761587943, "uuid": "45cafdfb-54e3-48d1-88a1-635eb2369a46", "value": 2977029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761587943, "uuid": "0e94559a-11d5-41b8-aa55-35760e536676", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587943, "uuid": "ab2a42cf-65ff-4970-baf6-085fb01163f8", "value": "20250804.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3134a9-b2f0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761540641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540641, "uuid": "f37de014-0e32-42ca-9bd5-1dcc163b598c", "comment": "Malware payload", "value": "b4db0a929ae06ecc4b7f3cce8a173ba2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540641, "uuid": "956f38c2-3538-4dd5-a2c5-44a0aeb9eaa8", "comment": "Malware payload", "value": "59b1c8f6dfd481a3d75dc657876f97e3c54ba3e5e839820df7112344be0c8751", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540641, "uuid": "e462e40c-7b4d-4723-b7c1-e7e2dae4c7d5", "comment": "Malware payload", "value": "6bc71c50cf1021f329982ebfe9179a963553ead6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540641, "uuid": "f8f4352f-075c-4c65-97f8-24b20b91f873", "comment": "Malware payload", "value": "a8f52a78de3e3e90d6921c7c9141bb05414dc57d9a30af631be3e8665ed0588796afabb35fe0f2030cf86d283c75a227", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540641, "uuid": "ad899f4a-f1db-4854-9abb-aa75e101b2d8", "value": "T185B63342F782998DD5F3C3350D799AA25522ED62CF47978BA920333C19BF8D80F662D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540641, "uuid": "1634021e-6987-4725-8b2f-ae648b5acd5c", "value": "196608:Hie9ULza3wzfodBpWyrZGMDmMIuFkFWSjrYUiK1KLHcCFWo:Ce9GJfobpWyJQWIra4qFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761540641, "uuid": "f146f078-3ed5-4793-84f1-90e2deb92273", "value": 11014407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761540641, "uuid": "ce25d06b-77f5-4ccf-8b78-321b8d2f50af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540641, "uuid": "1a5e2c99-670a-49f3-98f7-cb716e286be5", "value": "DESMANCHEJULIANO.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df7e7e7-b2f9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1761544454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761544454, "uuid": "96eee448-193d-4641-9f8f-fd6fc8e0dce1", "comment": "Malware payload (Vidar)", "value": "6dd213a88547262600f44c0198c1ef17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761544454, "uuid": "ffc2a546-879e-4916-8efa-e3591eea5343", "comment": "Malware payload (Vidar)", "value": "5ab5de75dfc87a1bab6440fb669179c34f27fcd9e7e6107a24cea2425f6d08d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761544454, "uuid": "7bba19b4-59f2-44a1-a543-cd78a7b05857", "comment": "Malware payload (Vidar)", "value": "af8a5746040c9ea0a77a3a3916501a575dd86976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761544454, "uuid": "e651c07c-e3ae-4f56-a223-601b99820591", "comment": "Malware payload (Vidar)", "value": "5c74a5deab34da3b256f9fd3730be90c28542221c6fa58f238835f345184a105d65331448c771a9a35cef3ff06fa97a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761544454, "uuid": "45c1c02b-6490-49ed-b9fd-5c4c3a936622", "value": "T1AE84182587EB0A56F413DC398493D727D771BA6683C1622BD3B4CAAD2F23923916DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761544454, "uuid": "11c2acb5-7793-41aa-8dd2-80e83e704018", "value": "9734d9835797d8b9d0342c1ca5c04bb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761544454, "uuid": "9750ac89-4c3b-4067-88f6-c7b99f8cfe08", "value": "6144:8J8gf3w084loQZtqGMaO1AhjXuIEmt2GdZtpJyGB5VFdeFH/pf4:g8kwgXGGJO16Du40orpEGFOFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761544454, "uuid": "f0f3a7d5-8f6c-460d-840c-e426d659ff4c", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761544454, "uuid": "2659a38f-ca6d-405c-845e-76b13713ec72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761544454, "uuid": "920dc7f8-646b-46b0-a898-d3518f9edb65", "value": "5ab5de75dfc87a1bab6440fb669179c34f27fcd9e7e6107a24cea2425f6d08d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b959c3cc-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588416, "uuid": "6fad868c-d1cb-45c2-aa9e-bb1450bc45dc", "comment": "Malware payload", "value": "91ee55eff29510eb1b40af8561a9e6a1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588416, "uuid": "2a13a32d-88d9-40f0-a4b4-042563cb6036", "comment": "Malware payload", "value": "5b41b750ba5ffa27f9fe06da1819aa5e77a0deba89ad08d64af5ffcd0a4407dd", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588416, "uuid": "a9f648d7-8bf6-4a4f-9a97-72ba463d2509", "comment": "Malware payload", "value": "633b185d65fa29bbe0d1fb2a4d0e824545cf3b28", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588416, "uuid": "00bac8fb-19d6-4619-ad49-9f6028a532a7", "comment": "Malware payload", "value": "4858dc4f28012ab718e27bd60e4de5ca87094768ea0c9f9fa3669d39371421b4f990ffdb52285f983bd18a85ebf0aa5b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588416, "uuid": "597692b7-2b40-4f1b-8c7d-50d40f41f2d5", "value": "T1D021C1145BEA5721E3F20E3758B6E6369A36B803ED52EF1E4081814C1972B51A935F1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588416, "uuid": "13f876dd-4adf-4355-a209-59902ee9600c", "value": "24:8IJ8JsPZAO7ypgAM6Ji+/xOSuOiSuzcYqVwOtab/cm:8IWJG/yp3xOSSSRBvtaTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588416, "uuid": "533b6053-3b30-49bb-a49d-eb661e3a28ae", "value": 1411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588416, "uuid": "da39cecc-1019-47b3-998e-76aa60e05445", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588416, "uuid": "9ef4cad3-0717-45ca-b456-c6ddf92e3463", "value": "R58903401.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281a8c8c-b2ec-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761538780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538780, "uuid": "5af938b8-db7b-43a7-a12c-1072b87dede2", "comment": "Malware payload (Mirai)", "value": "b7fad7e944707560af8d01441ea6bb75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538780, "uuid": "8f21f0b3-5adb-498d-9148-960f2fbf980e", "comment": "Malware payload (Mirai)", "value": "5bd318db44498f0bf2e0a3c985527fc03c24fc24bca2d2472352280c84271c6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538780, "uuid": "3bf37f06-dff7-4496-880c-cbd38498450b", "comment": "Malware payload (Mirai)", "value": "7713ce45a6a40f0c44b667e83e506646393951fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538780, "uuid": "e4bf34c2-bd18-49fd-ab47-7faef90feef2", "comment": "Malware payload (Mirai)", "value": "815fe672c366c8cf1284331b82358fb251bf08e36a4e7038e4a2a19bc1dba1e70ae0cc54491a223567d2bac3d40816b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538780, "uuid": "56d03971-dbfa-4363-952b-08e4f062bded", "value": "T101836CC6F743D4F4E8120A71217BE7318A73E53D502AEE83D769A832BD12641E75A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538780, "uuid": "93da948e-eca4-4818-8f40-779199c9d07a", "value": "1536:4NGfle9cPS4ZS96E+XVE143RrFUCeWtsrswWdZa:4cEWSkS96E+6143RhUCeAszD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761538780, "uuid": "6e4a273e-ce2b-434f-8dbd-64846666ba9a", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761538780, "uuid": "5406651b-cca6-44d1-b2c0-845b5f703fbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538780, "uuid": "2313fc3f-408b-460d-bf53-50de6c158bdd", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e80d2a-b386-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761605085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605085, "uuid": "82944c9c-c8de-41ce-a932-117025f48a14", "comment": "Malware payload (Mirai)", "value": "995bda822e14fef7ce8425d97b4fa75f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605085, "uuid": "03ef0e4d-4865-4051-bcce-e0c9b4135f2c", "comment": "Malware payload (Mirai)", "value": "5c474d37dfd472ff726b1b6c830f19a25d314cd27f22c07d61b440522f33fae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605085, "uuid": "8cfc272c-e7c6-4ebd-8772-c2fc2a76c4ab", "comment": "Malware payload (Mirai)", "value": "7cc6082a8dada732247ea3e1a977421b5ca7de4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605085, "uuid": "bef2b202-4396-4c2c-8574-75e50d45e05f", "comment": "Malware payload (Mirai)", "value": "ccfd626c846fd0ca3bff05b65bbe9f2048e879dee89765cfa01af9cc1f619ce769489c58a2f9b3ff028d4b735aa5a829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761605085, "uuid": "cfa9d117-b436-4571-849f-9510a255931d", "value": "T1160439CBF800DDBDF80AE7764C534906B130B7B254924A377257796BED3A0A84927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761605085, "uuid": "4383e953-2521-4b9b-a656-46fd1f5ca65d", "value": "3072:pG2B+LwVQHrRK/ta5wmphLWn2y9uYNtPBY3N2LAzOaiBcfVKjbiWL9vB6tY4:c2B+iAQ//12y9PNtPKN7JiBc0L9v2Y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761605085, "uuid": "cf48ecc3-1734-4719-a682-b2bb38b9870c", "value": 189856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761605085, "uuid": "4e66c057-2a5a-4d6f-8a97-8aec3f069d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761605085, "uuid": "72423218-d8f5-4aa4-a316-8d834628fe44", "value": "Orbt.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144c1b7c-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579119, "uuid": "da95f88d-4b3f-46d4-a22b-6e4df6102f18", "comment": "Malware payload (Mirai)", "value": "1e22e612ae5e44ee98c776fb4f8880b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579119, "uuid": "7b1c524a-7722-4816-8a75-c5f3f7def603", "comment": "Malware payload (Mirai)", "value": "5c78959912576d22f43f8329a85d17a422d062fa048be54ffa258f6b463ddbb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579119, "uuid": "261b6893-4f82-4b37-be5b-e566522b1988", "comment": "Malware payload (Mirai)", "value": "08a76158a205443a7864bcffa28c88b129bf23cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579119, "uuid": "0b6ddc21-db23-465b-aef1-cda599b14beb", "comment": "Malware payload (Mirai)", "value": "6c1351aad9a3c82ec15b45f3c728b2c20d9fa587ed6a77d881ad7cde563d9ce116f7224661d72193da1f95a2c55b5410", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579119, "uuid": "91376a77-ed23-43c7-b6fd-87e295116c12", "value": "T191435A02732C0A47E1525FF4393F27E083FEE99021F4F689664FDA468275E73158AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579119, "uuid": "ee758708-5014-4599-99ed-31d10acfb82f", "value": "768:MsfizT3u6bC6mf/co0ytRn0pa3uTKpG79Lqz5q0CuoAYa/A3jv3HcutZAIs4sJJg:M0u37bkco0KZ3G96q0TdT43jEajsHJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579119, "uuid": "82833bf8-8984-47ea-8efc-5a8e5a33cc92", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579119, "uuid": "6ec0ac7d-006a-42ca-8017-da65598d56be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579119, "uuid": "a443d6ac-141e-4fda-a03a-31ade5fa1630", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb8486b-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607135, "uuid": "3cb11b23-af07-46ed-9677-7ffc5eadd6c5", "comment": "Malware payload (Mirai)", "value": "09428f33e4f5c6754dc6bb0423cc84c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607135, "uuid": "81b4d3e1-7a0e-4e38-8f3c-1b8f1215553b", "comment": "Malware payload (Mirai)", "value": "5ecfdacba55a1eaa6e35dc9952ea02b3197957255cc39036c107cdeb3543fae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607135, "uuid": "ce79b23f-5bf4-468b-a03e-c878f6c01cfc", "comment": "Malware payload (Mirai)", "value": "9911e03f2a80ba7f7dae749200ef83b63d85c1ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607135, "uuid": "a01a7f95-8a83-4908-b423-36a63b14013f", "comment": "Malware payload (Mirai)", "value": "a31dfcc2aedf94c58b5bcd5413aa0dd17e21c6bbd2215931d1c21e48997837a3a315f1aec0a48f602854f56242809d78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607135, "uuid": "6fe18970-4d43-448d-b047-b61b2a8297b4", "value": "T11FD32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607135, "uuid": "e92fcc3c-a633-40c8-b0a1-71cfff9e2ce9", "value": "1536:troGHNTUZNx5IBUiCxfytKteQQvhDajwso7lbEJvAhh3rp+JuQfqAE87fnJ:3moUiCxRteKwF7lLhrMjnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607135, "uuid": "3c1eee8b-a254-4cc1-b7fb-f1f0770c64e9", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607135, "uuid": "3b79823b-f7f5-4011-846c-9a2bb1873434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607135, "uuid": "02938f54-3557-4323-8a75-fb8d05d99e9a", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00442cd7-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1761579086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579086, "uuid": "d34e67ea-40c3-4e46-b37a-c7f900614e83", "comment": "Malware payload (LummaStealer)", "value": "4d22b4f0128953b9894db214a5e18217", "object_relation": "md5", "Tag": [ { "name": "202-71-14-164", "colour": "#A541D1", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579086, "uuid": "feb7b3e2-6c08-4abc-918b-e5443d519c4a", "comment": "Malware payload (LummaStealer)", "value": "5f935683458d11476a410b8bf09e74f569d098b7319f43cf299f5bac84f05ca6", "object_relation": "sha256", "Tag": [ { "name": "202-71-14-164", "colour": "#A541D1", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579086, "uuid": "08a88755-f705-4731-81a2-ad2a2971e49c", "comment": "Malware payload (LummaStealer)", "value": "b36632f4c3adf9317cf6067c52fe44ef82ed3485", "object_relation": "sha1", "Tag": [ { "name": "202-71-14-164", "colour": "#A541D1", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579086, "uuid": "7ea3d74e-344a-439e-b409-f737b16af8ed", "comment": "Malware payload (LummaStealer)", "value": "9c66228f253a74be40cece56c5d57ca3802c84de9dc0b1ac6a8892918ccdd49560515dd1d6ba4165a0d81ff959fc120e", "object_relation": "sha3-384", "Tag": [ { "name": "202-71-14-164", "colour": "#A541D1", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579086, "uuid": "06d1cf1a-f0c1-4de3-874f-2e513160e900", "value": "T1B177D011F6908071D8F7017485BEAB26D67DB934033486E753D42AFAAF326D22B3A717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579086, "uuid": "174573c5-288c-4ab3-9992-e35d19adc598", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579086, "uuid": "f65ddf39-41d0-4029-8931-9f7306b85cc3", "value": "393216:YC4K0QuBf7yWqZW/iLfXGIiqEe0UElz3PmWvYB1nlhCCZ9tpWFATXOfAFpOFLSzf:Yz5fyU+iqcUElDm7CCWV4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579086, "uuid": "b6606a16-3795-4ab3-84ae-bf22e6c35b58", "value": 34037760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579086, "uuid": "3043d3a8-7ca1-4f9a-9e5e-a661f7b9b125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579086, "uuid": "46b354bf-fbf8-4646-b8f7-6d90989904aa", "value": "revo_uninstaller_pro_v5.4.3_ _fix_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c45aa5-b2fc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761545863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761545863, "uuid": "86226b94-1db2-4dde-bd5c-3a5ef1554c04", "comment": "Malware payload (Mirai)", "value": "1beb065a9fa028c12022e9b8e9be078f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761545863, "uuid": "4d55d3e6-8344-415a-869c-42a3a62c2506", "comment": "Malware payload (Mirai)", "value": "5fd5d16d98d7ccb8e11ae537248677c5c40934a4f40a953a747a11f67f32d70b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761545863, "uuid": "1685f752-3c5b-4def-ac30-738ea91f2d89", "comment": "Malware payload (Mirai)", "value": "cdc34b03e0b11229d5f802bd8d0cbaa9f138fb81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761545863, "uuid": "e0b11813-b8c8-4986-9a49-25c6ae8d9eb3", "comment": "Malware payload (Mirai)", "value": "b6bdb40323efd642081245ffb28b10b194a0ea1741d1daacee965d4da30f32bc210f12626f2ea2bd4abeecabf508440d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761545863, "uuid": "be5ca784-920d-44fb-adca-dbf2014b504a", "value": "T122833B01B30C0B43D0A75EB53E3F27D7D7EFB9D022A4E688255E968991B6D321186ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761545863, "uuid": "b58ade1c-abc9-4d7d-bb49-c96995978092", "value": "1536:BKiWyh5/jB9f+1qUXT+wwpepl1m6xl3E9pqfM1K2em/0:BmC/zf+PEepl1Rx6r0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761545863, "uuid": "d3468179-b319-4d8c-94ca-1258e92fde9f", "value": 85744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761545863, "uuid": "8ef35b0c-1dfd-4ca9-85c5-077de65f72c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761545863, "uuid": "d69565ee-0dab-4f82-a5bd-8f4888298304", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf22ee3d-b2f1-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761541208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541208, "uuid": "8160dd6b-3552-414d-8cbb-8ecc40362ebe", "comment": "Malware payload (AgentTesla)", "value": "5d24664d62e7f223cf966ce318fe17bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541208, "uuid": "70e7434f-1599-4af1-8a9a-83b2691f96ab", "comment": "Malware payload (AgentTesla)", "value": "6034c2dda8e46db288c3eebcc8bd35467f6ea949293eb587fa731b18d48638bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541208, "uuid": "1513cd34-6f45-4eb2-a163-94250d63847d", "comment": "Malware payload (AgentTesla)", "value": "e61ea022feddc897d6c12a735e18456126b87254", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541208, "uuid": "6a4efba1-5b8c-47b5-b330-e67eb82366e2", "comment": "Malware payload (AgentTesla)", "value": "4c97ab8bbcabd42ca1cb04d0735bb53bad86d3797344eecea7b277277c17ee97bb5f73e0bb7c4035110a28911d2c0d42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541208, "uuid": "60e1365f-1652-4a75-a57b-b51fec83abda", "value": "T17882228D6FC2B291D233B0B32D6BB059737A2C41F58DD175F33581A0F9A5718E8A6878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541208, "uuid": "1f625653-0d22-4e5d-92db-d7ed84c3ba72", "value": "192:I2jRv+D5g0pf7N1qRM5arIYAiCLfhFamFoGbO13caNvecYdqXoBKO6:rjRvy1vqq5l/JFa+Z6xIcS/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761541208, "uuid": "d50de324-b747-4cde-9bb2-f8a5d3698239", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761541208, "uuid": "eaebf910-672f-453c-85e0-9869fa450191", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541208, "uuid": "1cb09ccd-0e8a-4f5a-8b32-c0185516562f", "value": "npayment_silp.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d430a2dd-b313-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761555819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555819, "uuid": "571de9cd-531c-4e74-825d-a0e4e4c8c307", "comment": "Malware payload (Mirai)", "value": "c1377a18be9e9a53ad29e92ee675644f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555819, "uuid": "61c5a849-4761-4ad5-8390-362cf095c61d", "comment": "Malware payload (Mirai)", "value": "613ee03dc00af3134fd5d469b293c1347f963facfdb77daee558aa8184432999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555819, "uuid": "95961dae-87bf-4fbf-a73a-78a08018c4ce", "comment": "Malware payload (Mirai)", "value": "3e17ddb53c98deb94a0d93707078417e9c4a40a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555819, "uuid": "2bf268cf-a3b4-4889-a2f1-d062d67c521b", "comment": "Malware payload (Mirai)", "value": "d89ae9e53d32e4a821a73a3d238c0f9204177f6b4c34193ddac8e58bc98d2215d5bf11c1c064b09559d3a7cc8ee505ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555819, "uuid": "b1664f64-cee1-48e9-ad2e-b0aa6a451929", "value": "T1D0B33A37B551C67AC08752B02BDB96519D23BCBF1B32214B33E87EA52F368D85D19B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555819, "uuid": "09d918a6-2001-499c-b59a-b078331995bc", "value": "3072:GZQMf63hq7S3OHKUayixXNJuKLmNonVqfHXF/4Nb:jmMOq5TBLmNonVqfHXF/4Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761555819, "uuid": "3c8f24df-7b15-4f61-b7cf-81999aba23bc", "value": 117204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761555819, "uuid": "1dbe6bb3-d695-4bd6-b1cf-3f0aa8815ed9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555819, "uuid": "ce1052d9-e9ff-4767-b009-b17978f226ad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04481f3a-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607010, "uuid": "0fff0994-e05b-49ba-96a6-2eb5f3374c1e", "comment": "Malware payload (Mirai)", "value": "a41f53c30db967523b51c70ea38001f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607010, "uuid": "efbccee7-f0c6-40ba-8c3b-9fe1d6f28f65", "comment": "Malware payload (Mirai)", "value": "61b4b24fe63a31d3dd2751bca4c7cdf88410788942397861e79108560b84a8e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607010, "uuid": "0cd4b34e-0783-4601-9d73-5604e4c47085", "comment": "Malware payload (Mirai)", "value": "2254647a21b387e8489695462424072c2822be2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607010, "uuid": "4a13a268-02b1-4d39-971a-687f70f76182", "comment": "Malware payload (Mirai)", "value": "27be82ad4bf8a385d77a894b2c79edbf73a5fb3ef69364d6f2d6ca659fac3982624f86303ecff952cfea52d88972d950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607010, "uuid": "d8fe00c0-4410-46a3-846c-c2505411534d", "value": "T1CEE30A46F8814B12D5C111BAFE1E528E37131BB8E2DF72029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607010, "uuid": "e87730b0-8ac3-4eab-a4cd-31e17fa83ad5", "value": "3072:6/eayC9UqIK/DX0j8L7BaZz9WQ8Ln0/LKLt:6eFC9BzDXW8LtaLfi0/LKLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607010, "uuid": "a236c4df-7e47-40f3-9626-6f888529ba53", "value": 144124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607010, "uuid": "48ab3433-02ac-4183-b500-2e93de08afc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607010, "uuid": "72eb291a-b318-45aa-9cc1-e069e178cb3d", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4b4ff7-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570815, "uuid": "6fb60501-dfcc-47c6-ba01-c3b6dd177797", "comment": "Malware payload (Mirai)", "value": "623691f491799b2baa13d86214e19725", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570815, "uuid": "de7f6690-a9de-4e31-b464-94d18bba3d94", "comment": "Malware payload (Mirai)", "value": "62230b662921d67bdd25c8e395dd94177afe24fff7abf8f557124df23f500149", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570815, "uuid": "ed5cb9a5-a9f1-44ac-8a9d-c99246d72680", "comment": "Malware payload (Mirai)", "value": "88f559836ae87d48f407e99b73cba7c91ba41e1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570815, "uuid": "6b5907b3-203f-4685-9927-c9839be145dc", "comment": "Malware payload (Mirai)", "value": "fb8067e1801da4f2c41482fdffe8b571c698b5c05b7d0a3bec1b44f0000b1cdb069dea9f98b82f69aaa90620591d2539", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570815, "uuid": "a2761934-d269-4ed8-b3ab-dac062670838", "value": "T17F5173C522E108F239B5AE2776E9D809B3C4E952DDD4E90A4CFF3CEA785DF486480752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570815, "uuid": "c055e0a8-d104-4784-99c4-aa2b51e3e138", "value": "48:vDVvpOv51frv9WvNO/vtkvUK/vDnvTpvdsmU9vfNvVOvTqvb/vLvvT20:vxM51bg+GbTFuVkuD7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570815, "uuid": "b0f5a76c-8ce7-4e3c-b6a5-e4a988b7baef", "value": 3014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570815, "uuid": "255bfffb-16a3-4924-80a9-c247d0f14ac6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570815, "uuid": "3c328544-8ac2-4549-b470-2663d28fbe84", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051f9b5f-b384-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761604005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604005, "uuid": "cf3348a1-8d41-43d3-8531-adf32ebe05db", "comment": "Malware payload (Mirai)", "value": "8b7f77ab5526698ba867aca1e6d6918c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604005, "uuid": "21140fad-68d9-4985-a882-c5aec174b57e", "comment": "Malware payload (Mirai)", "value": "62a6b6d1de2c6b013ab8f1382766a40b68b11e88133950bf81242f2cdbf761f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604005, "uuid": "b2d80378-0dda-43e3-9d11-bbb0aea78ce2", "comment": "Malware payload (Mirai)", "value": "c3e787811c3fe29bf2a5fed976a2b6bb7878188d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604005, "uuid": "2b151175-ecdd-490c-ab46-7aa23251bcaa", "comment": "Malware payload (Mirai)", "value": "e8a06ddecd17dc966631674c69d9bc1ca91ac561b62e15c6bf20eb0ce14783fd1e995d50cf6e7e8db43aad57d39cf2b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604005, "uuid": "1d516785-4a28-44cf-9130-3227da4c4964", "value": "T141D2F13B15FA6173E6102D7DF8FC848AF3BA1AF7D2D6F54614845E04394A8464DBC346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604005, "uuid": "1f6cf4d8-9242-4f18-9b87-dfffd5d9fcd3", "value": "768:otA+o6v9QOdVSpSQaA6yoydUP3HC6LC+s3UozBI:so89QOdKsA6yoNQz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761604005, "uuid": "7d93690f-9b85-4095-a761-db263a9aa178", "value": 30584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761604005, "uuid": "c730ef4b-9f0a-4f32-9929-7fee5ed2b60c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604005, "uuid": "ed0cc335-fcac-4c0b-b3a2-26b7a0db3064", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd73c12-b35b-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761586677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586677, "uuid": "86aaf7c1-8cf8-43ff-9a69-0b58ffd7fba0", "comment": "Malware payload (CoinMiner)", "value": "d73e105c9debea30a637294f3113d86c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586677, "uuid": "955c97b3-9b82-4fb6-80bf-4940fe11a820", "comment": "Malware payload (CoinMiner)", "value": "635ec1090ea10cb64b55a7915c971ef06174cacc81d3084c3199dcc7dfcda932", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586677, "uuid": "6a1e0879-1a1d-4d26-a979-cd0e8a5066ac", "comment": "Malware payload (CoinMiner)", "value": "365eade9eb57baae37bea682491c6d85c5d21f64", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586677, "uuid": "ab042a3c-887a-4137-a520-9c72cdb8078c", "comment": "Malware payload (CoinMiner)", "value": "c2b2d1addd2634f791317f0a5a8a03973092538ab373a644361e38a923e772fa2560c22ff9ed4c5e2a9a3a17d8692583", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586677, "uuid": "9629c8f9-f184-4cb2-bbca-f3dc26010cbc", "value": "T15EE6334477D148A8E8EA513EA8D1942BBAE378750BE4C2DB93BC0A920D735D0FF74761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586677, "uuid": "ec1bcfe4-b236-45b3-a575-879477aa5e81", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586677, "uuid": "e2e0588c-e8e9-4e93-ac1a-d4107af334fc", "value": "393216:mCeW8PXMCHWUjqjx5WsqWxT45xHMrl7qTrwtju/0IDw:mCeW8PXMb85sqAAMh/tjucIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761586677, "uuid": "c98137b4-6898-4f2e-88a7-00de75639653", "value": 14179435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761586677, "uuid": "887599a1-6b88-407d-a428-fa6907c63ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586677, "uuid": "845db165-2bc5-4fac-9d71-46cc9666dd74", "value": "Injecter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3774814e-b34d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761580467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580467, "uuid": "8392f694-2985-4427-a5d6-d6f4a64f1a41", "comment": "Malware payload", "value": "2174bb3f0292ae01d555dcfcbdd25d30", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580467, "uuid": "c4af11a0-f3cb-4cb5-a9b7-ef43a4d2ce34", "comment": "Malware payload", "value": "64c3ad34cd322bfe3147eeb0d2c40f4e6fea831fa58dbab3b15451e04193d430", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580467, "uuid": "5f26cff8-ae3a-4dd7-9cf3-70e330a8f1cb", "comment": "Malware payload", "value": "75c93e50569936dc60c089374fd90082ce0bf5ac", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580467, "uuid": "022caf0b-5da0-4f36-8c3e-012825fa9481", "comment": "Malware payload", "value": "616916b8ae238c914c280b38b023328735a7c96938e9231af46cfe756b63c799438f7abaf88e3e3add94624355772f43", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580467, "uuid": "8e5d7d98-e183-4a3e-a19a-349fa545396e", "value": "T147D423E2B9FD8F0C50ADD4759FA4505B584BC190992D98E82A383580FF7DC62C72B16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580467, "uuid": "5e23c38a-f425-4c1f-9271-426ee5de19a9", "value": "12288:tE4c65Kkodi128NCpcH/l4u7NlN/c4CO3Q8VnD3seaYAQWW7Z:tlc68twCpcfl4wNlN04z3rxs4VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761580467, "uuid": "29d3c689-7790-4476-8c62-4ee347de93f4", "value": 623203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761580467, "uuid": "ee51651d-6b8c-4bca-8ca9-cde5ecdf2d58", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580467, "uuid": "cc19a7f9-0a33-4384-bd10-e63ab576443e", "value": "Request For Quote.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad5f8ab-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579130, "uuid": "04152ba0-c4d6-4839-acf8-479c551f14df", "comment": "Malware payload (Mirai)", "value": "dd8ff5956643216df6c5a3b952836a7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579130, "uuid": "09e2d34e-792b-4459-950c-06e34ba6f4ef", "comment": "Malware payload (Mirai)", "value": "6515313825b3e42ffc16981e5d8171ba161ac0d758d312fb28cae0f8dd5213d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579130, "uuid": "7ab547ee-bb2a-4074-8f3d-ba1aed97a610", "comment": "Malware payload (Mirai)", "value": "4d6dddbb40af2e3e88440a6c99aa435c2a8fae4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579130, "uuid": "0d874c13-0cff-463c-930f-bb4e0b22f818", "comment": "Malware payload (Mirai)", "value": "3d33b558b1d24c15e2f47814b85b166d20b9ddbd8fa4548f0bb387244413ecc8d48a1c4c4bdbea6db18235356a55702c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579130, "uuid": "02131fdf-5441-4322-9396-d49d414c2a23", "value": "T1B3230752BCC28A56CAE42376FA7E12CE331173A9D1DE7267CD105B103A8991F4D77B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579130, "uuid": "a442d736-5dbd-4e98-a6a8-ebe263a7af78", "value": "768:dbf/A1RUGzxhmlgrgrqEVlwYrLOnsiduepi0eRAI1V+6og2cNfBN3EtE:BXAnF3mmrg7LOXd9pi0eRhP+Fwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579130, "uuid": "55e13f33-bab8-4f13-837a-ca7b5ffd5a03", "value": 46320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579130, "uuid": "da9a0498-4975-466d-97b3-5dbd7617ace3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579130, "uuid": "d2a21c09-6c3f-4981-9303-cf33f4425f70", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74248b85-b38a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761606768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606768, "uuid": "846c162c-b58d-4f1b-9c60-5ca8e4048ce4", "comment": "Malware payload", "value": "73bdc352b9ca7b40f5a1df8eb5ca249e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606768, "uuid": "5ea111c7-f5d7-42ab-9697-51be0756a786", "comment": "Malware payload", "value": "66c2450f5ee661cdca00d47410b83fa14f94d050a4ee698bfd8344fb8171084d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606768, "uuid": "855f871d-c1c0-4013-934f-b12e4bc4f188", "comment": "Malware payload", "value": "23c8159f96580564bf5927223f4c39886503120a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761606768, "uuid": "c331c784-65eb-4673-80bf-8ee509731b1f", "comment": "Malware payload", "value": "ef5bb3a81b4d3f88ee8c02fece6ff6c3ffb41ce33c1e0c48be9c4b2ec990533a9c2c9e6f2dd56223e9f50482b946eab8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761606768, "uuid": "c2d7cbad-227f-40fe-be47-14a149bb49ae", "value": "T1308533FBB26D46F43B9066BBF03265F50BC56FB4B0AEC5C00A8A521844646AFF7548D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761606768, "uuid": "291d9fdc-1d9d-4ae3-a489-812552e75fd9", "value": "24576:RLtS+levQ+WhPvSSWfS9FDPgzExI8DP57Q7eHXEsrrN6X6G3WIBRiuaQwuTkH69Y:ZZj+iPvYilHFXEsNKJraQwFHPQyELs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761606768, "uuid": "fd03cf26-f861-46c9-8c90-31a9f438c992", "value": 1746244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761606768, "uuid": "69b568e8-75e0-40be-be13-3246ba1feba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761606768, "uuid": "d7721e9f-dedc-410d-bed4-bd4f8fdefb35", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29db984-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570902, "uuid": "33d6c41f-f54b-457e-91e5-72be341a0ee1", "comment": "Malware payload (Mirai)", "value": "7a0a02ef8eb34fc247a692fbe8729bfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570902, "uuid": "b58ca86a-3376-4ac4-aef4-b32db50edd8d", "comment": "Malware payload (Mirai)", "value": "68033e77e66addd2e56fde23731d150b771b67fabd898dcdf496c58909eb7bd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570902, "uuid": "612478b6-1af1-43f8-b07d-12a5f743e355", "comment": "Malware payload (Mirai)", "value": "cb53a6c00d59254d564351406f4ed821df245e7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570902, "uuid": "55a4483e-ec8b-488e-82a1-48f7b65d417d", "comment": "Malware payload (Mirai)", "value": "762c4614646098fd80fa53c4cc85708eb82fe7863b4f09db6723cbc0678ae489a021098522ec4b7d44594caf59b30be7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570902, "uuid": "22941560-b1de-43ef-a04a-5dcaf4da6132", "value": "T1D9C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570902, "uuid": "47094ef0-ccae-4281-bec2-372ee0088ad9", "value": "3072:cowpuQyNSG25Ra1styK9flTQPHojrScVM/9OAvjik:cowpuQyNSG27a1styKdlTuIjrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570902, "uuid": "d42677a1-f782-41fb-8b12-b918a7de7695", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570902, "uuid": "3fdff35b-3f73-47ef-b09c-c54896ae4d6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570902, "uuid": "fb29bac3-5633-40c4-9709-12504ac190cf", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1e83fd-b375-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761597953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597953, "uuid": "fbe88ca7-e637-455f-b337-b0a406da5f4f", "comment": "Malware payload (NetSupport)", "value": "26449f6b68ae83d72a1d7668428512f6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "generationkasdm-com", "colour": "#C2522F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597953, "uuid": "2820a7fe-3335-4e18-b753-265cdbe6cfdf", "comment": "Malware payload (NetSupport)", "value": "6982331475b56c059b0af900b33572534e0cee7b9e0cca647278846ff64e6506", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "generationkasdm-com", "colour": "#C2522F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597953, "uuid": "48389e50-2622-4444-9a22-98a0379248d9", "comment": "Malware payload (NetSupport)", "value": "065a6e3c529f753da298ea375e5f0b8e05cbf6f1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "generationkasdm-com", "colour": "#C2522F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597953, "uuid": "9496bfd0-d3b0-4f0f-8532-b29bccf7d5f1", "comment": "Malware payload (NetSupport)", "value": "dffb79d8220c62ce23ea073aaa0b775b40bbe4782ac2b53264cd00e690e81a8936ed9b8cf7eb06028933b68dd53fbe8e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "generationkasdm-com", "colour": "#C2522F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597953, "uuid": "4f47c7ac-a0de-408b-8519-fbd9603dc693", "value": "T14E769E31C4277C793F9D794690082E824EB92D8B5B18CA45DF50FABDA0D4E757E3C8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597953, "uuid": "f1b268da-89d0-4d05-9fd4-f3ba2752d8af", "value": "49152:M5y5csnXueg2/HGkpHz2yknecWN/fGPFdBzFK4lDdhFY5c4gs8dWRQ/j6Af4AMLs:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761597953, "uuid": "8ed51504-e481-4e84-91b9-3784b32e0ecd", "value": 7608961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761597953, "uuid": "f1fc513b-be44-4f84-9565-4c301730b098", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597953, "uuid": "d385dd16-47d4-465d-a651-fe166011e64e", "value": "pfol.wav.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf4e0b9-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579134, "uuid": "4f9d5f69-3d88-4936-b910-8d9232946e48", "comment": "Malware payload (Mirai)", "value": "2d1aea1ca629ca1dcea4912f615be762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579134, "uuid": "baf1ec4e-6bbf-4bd5-92c9-5c53a19f1f8b", "comment": "Malware payload (Mirai)", "value": "6a1db710a134bb507f9f098fbba366a0c01a08f08d7077c6e7e5297965733e27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579134, "uuid": "ce0e97eb-38e3-46fa-81f3-4d1873e79309", "comment": "Malware payload (Mirai)", "value": "a8269496ab64f8d09061186fd8c37a1146f67d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579134, "uuid": "792418fe-67a6-4fe7-8916-e4c34219b9bc", "comment": "Malware payload (Mirai)", "value": "c779ba01611382e5b6252b03376094e0f22f7201d8abb498466568c809da38e0b79fb37b89bddc1b5bd5b962ffaf4614", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579134, "uuid": "e94c2c30-6dd0-4031-9e50-6f1d72a3beb3", "value": "T114338E73C42E7D94F24AC278B9204B385B23D40696833EF5968AC6974047EECF6593F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579134, "uuid": "e26fd516-bbea-4bc3-86d8-b30fe82f319c", "value": "768:T3/zTfpYtWja5FLM5aswtAObkt7qRDo9LtQnZC6lrSeF74uJCZAoqrcCILcEa:T3/vpY6OMaswtAdOoXQZntSYJiIcCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579134, "uuid": "806b2d09-ee3f-458a-aca6-ac62be1fd11e", "value": 54680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579134, "uuid": "84a951c6-1644-4f2d-9cd3-f1e4a6ce843d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579134, "uuid": "83c9f730-c7d7-412a-b1fe-c809acde3f5b", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c90027-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595602, "uuid": "6f7569fb-78b2-4071-a516-2c73c267a550", "comment": "Malware payload", "value": "1fb2d95283a113bd550f28dc4eee576e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595602, "uuid": "1c07b89c-b926-46d3-8d86-19ca6ce449b9", "comment": "Malware payload", "value": "6ae53c013aff7e12b5a15e0e089eae94e98930c6d7782eae32e2d4802ae07ece", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595602, "uuid": "6372e697-85f0-4483-b3f6-c94909c723b3", "comment": "Malware payload", "value": "cc625b4c81acbbd98e41f03544b1b9645fe0b7ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595602, "uuid": "43844d6c-91ec-4a9f-ab90-5fb02fad8620", "comment": "Malware payload", "value": "0620f616eb6e6f78634cfb4c298b65d4d48e9ed9afb9aaa44c46e6e41648c00a77c77ba1e34dbd87cc5c72ccffac1b35", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595602, "uuid": "4269eee2-504d-4d59-9421-6ddb4b1ceeab", "value": "T1C3D43B17EBA887B5D057C17998A38A56F6B238458B31DACB1294973D3F377E0493B320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595602, "uuid": "7fac35b0-7366-4f3d-85bf-cc4388acec50", "value": "72f400bc421dda67c3530d43c7c0bd62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595602, "uuid": "c53acd37-34d2-43ad-b832-9350db10fb97", "value": "12288:lEBVHABUkePzMNdgk6Z6KFZUn5aLad1yDE5P:+BVgBpePzq+k648ZUn5uaYE5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595602, "uuid": "07746723-02ef-490c-a065-9bf7d9d6a3d5", "value": 604536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595602, "uuid": "e06526d3-0096-4a68-972a-a5b06f04e12d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595602, "uuid": "bcc9a39f-0387-4b89-9a77-cd3a3c745e58", "value": "ui-service-provider.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e10da2-b2cc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761525109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525109, "uuid": "bb34880a-761c-4166-b7a4-73939fb27060", "comment": "Malware payload (Mirai)", "value": "b2569f116a1cfd1779184143c109cc1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525109, "uuid": "e3abd3b6-8117-4812-8d80-190a9afd41cb", "comment": "Malware payload (Mirai)", "value": "6bcdf7350b19465658dc493a8bd035b636a4ff7c89b9201ce1ffffa1480afe39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525109, "uuid": "0ecb4c06-53bf-4c58-8ce6-0c36f87a9f7b", "comment": "Malware payload (Mirai)", "value": "f5dedcce70874481fc2ad9475da2f7acaba9f08a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525109, "uuid": "6e047db1-91f1-45bf-973e-e080f9f008e3", "comment": "Malware payload (Mirai)", "value": "e269a7cb147bea2674370145d5a594b2a76985f2a20f08ba65e071fda772640cc767df9642d533616d01d6c85f881d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761525109, "uuid": "a0a0e263-2fbd-4a73-b25c-eeca7b9c8d9b", "value": "T15903F171D6F1EF8EC8AD4734676D530E48E0F2C924298A80EF8146274D64A4B5B3EAD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761525109, "uuid": "5e6361ab-f41f-43f8-a7c1-bd7de1ace35e", "value": "768:YUM6lHz72X6460M8Yzs8wrOaDgd8JnCc54wZ/jdU00anbcuyD7UHQRju:YkH/27e3zs8QJC21X0anouy8HyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761525109, "uuid": "ddaa0bf9-1912-4ae0-a6e4-349195e136b3", "value": 39408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761525109, "uuid": "1b73fbfd-4afe-4e04-ac21-4f477ac4e873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761525109, "uuid": "908a4c2b-478c-467d-bc18-c61bc5fda566", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d93c1d-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761577703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577703, "uuid": "ee146718-bea2-47ed-bf9b-2af7f593d2fa", "comment": "Malware payload (Rhadamanthys)", "value": "199ced09ef0f7e56cabcb953ad46ddea", "object_relation": "md5", "Tag": [ { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577703, "uuid": "d6931440-76b3-47b1-9ce3-1c09a8de8dab", "comment": "Malware payload (Rhadamanthys)", "value": "6c969219005e7cce09cf851811a22d7a839111b31ba4c12bbe7471e2c3e44fea", "object_relation": "sha256", "Tag": [ { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577703, "uuid": "0165b73e-ca3e-4e56-89e2-0e303469e4d8", "comment": "Malware payload (Rhadamanthys)", "value": "6cd78c17d5facfd6ce5eec0982b438f585d28ad7", "object_relation": "sha1", "Tag": [ { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577703, "uuid": "9c9135c3-9675-44a2-83c9-622b02286c76", "comment": "Malware payload (Rhadamanthys)", "value": "2856e2ee91662954196f0221771b0f2b28c8960b701e0ad1a3ad045f3358a2af4c22b88fdbc99c42196099e4a8d0bb4a", "object_relation": "sha3-384", "Tag": [ { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577703, "uuid": "d059523a-76a3-443b-992d-6f88eb5918d9", "value": "T1FE97333A925CAAE0FB0F4AFAD566C54C84D5B94170B3F8A77B1826054C9B6D09B3334F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577703, "uuid": "e417396e-3893-485d-9748-2ac485651590", "value": "786432:zwNloVGPyLs4HmgDAeCvCVGXPasXhQOsYseq71o+cA8VYQue6BDI:ENluGK5HvDoY+Q7Y6KDYQQDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577703, "uuid": "665ec39f-f6b8-44bd-a746-aba7b8cfe6c7", "value": 40587468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577703, "uuid": "d88f371d-37a9-4f5b-a879-e88cd2969b24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577703, "uuid": "bc4cd354-7bfa-409f-9890-a01c3e42f59a", "value": "Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70f7c1a-b358-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761585378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585378, "uuid": "8e67fb06-a97f-49e7-8cc9-3e89249820a7", "comment": "Malware payload", "value": "cfc78e1f51e146667c246eda3259f8e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585378, "uuid": "c5845872-e6ad-48d4-bb06-c7d83acdf9e2", "comment": "Malware payload", "value": "6e64eb97cc46d6791a9d9d80d42ecabb57f2a6fdecf972db4801333baf55afa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585378, "uuid": "a5c1f0c9-ac38-46ec-a553-f72d15f9dcad", "comment": "Malware payload", "value": "b8139ab05fd2d2ab81a0ea45768d9cfdf24d3806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585378, "uuid": "c40770f3-f99d-4ecd-9eff-a9dc50002831", "comment": "Malware payload", "value": "1783af2cf65416baf2cbeb7b583b9722aa1f047e3799cf79bd2638941bbae78640fcea33ccedcfc9a5317bbf1a941381", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585378, "uuid": "9effe443-4173-476d-bfb2-7c4b72cdab97", "value": "T185E5C22EA890985CC29D4538AF6A814175727F4D3B2733D31952B274AFF96DB383AF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585378, "uuid": "2aeb7a6b-90da-4694-b809-82aaae3d95d8", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585378, "uuid": "571d7cc9-c51d-4a19-a725-4b9e4295efd2", "value": "49152:q4gZKpkwa2RcN0F/7Yxc9TS49VP0gvmb+W3s9:qnp2Rz/7YxcVS4XP0RbW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585378, "uuid": "7af1f586-1beb-4884-bf2f-e3ff012eac79", "value": 3129144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585378, "uuid": "d915e045-4a47-46ac-9aee-8669b72244b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585378, "uuid": "acc3050b-db83-449a-98a7-9bd3284d2f0d", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fd7faf-b36e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761594769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594769, "uuid": "9fd6996c-abc9-4574-9ebf-d9816ad25050", "comment": "Malware payload", "value": "dbfac1e56482a4f4a7a17a3aee363b86", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594769, "uuid": "9e7392e3-7edf-4e8d-80c9-bc45a76c4b2d", "comment": "Malware payload", "value": "6ef3af8ab980b000ba27bcb872cdf97311b6d5d2dee6c96302fce3876abddfa2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594769, "uuid": "ae3dac7b-b2af-4d75-bc61-ae95c8affa1f", "comment": "Malware payload", "value": "c1b0761e444b3ed63d80aa18c58e6a8fb49f0bcd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594769, "uuid": "d8eaaf90-9ad9-4236-91f9-894c8f607cef", "comment": "Malware payload", "value": "e252f3fbe9a1f8ce4a99b56f6594ed40690eb8affd855755f380fdfa4d9d9a41a28ff63b1897870feae8ad3a0060ef9a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594769, "uuid": "8551d7e2-1d0e-4431-b746-8eef04811858", "value": "T18BB423A5D9E825132CB7D5A56B7E237F9E52832629FFB1F117E14AA239D5BC03384030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594769, "uuid": "c3ccd67a-ed4c-4a29-ab4e-1b8142fe668e", "value": "12288:hqcnVdFMSLifohKYGi4IQM//Fk7uMcVCTfiso4v3OvVDT9oFxYgXW:hqcVdmSLurti4nM//6uMc0+bdgOgXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761594769, "uuid": "b861732f-7e45-4e54-ac1c-09be4c222dd6", "value": 537886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761594769, "uuid": "1ccd3249-3401-4af5-9d25-898440b9928c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594769, "uuid": "1fef73e1-53ee-4c90-b37f-4bfce27f78de", "value": "new order00778893.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23b4d03-b2f0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761540703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540703, "uuid": "9f0993a4-523d-41c0-a864-03781db5ffa4", "comment": "Malware payload (Mirai)", "value": "de7d2b2d9a3ee89930427430d6af3cd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540703, "uuid": "d07d1d7f-7ced-4de5-aa7b-16daf4af62d5", "comment": "Malware payload (Mirai)", "value": "6f330eaadc2520989e97446fec20c48a7f17395d54efece8fd64b6f797d5edf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540703, "uuid": "be249046-c058-4bb0-b483-8061908715ef", "comment": "Malware payload (Mirai)", "value": "0cce6df524a949e61ac772b01d6a956c8e3da979", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540703, "uuid": "2cadfb69-67eb-4a54-8098-9b06490bbf1e", "comment": "Malware payload (Mirai)", "value": "2d35600cb5809107b14f5a7dc95a4924581e6c5b87d8ec36b7d3b494f699cc848586ccc56bffb4082edf92b457f4a1dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540703, "uuid": "4cb5dbed-2b20-4f48-ae8d-2a1fb2e122c8", "value": "T127839C23C9361DA8D84804B0B0B48F755BA3E515C4572EFB599AC63AD483EDCF68A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540703, "uuid": "d4aecf67-d91e-458d-9ceb-94a6021565be", "value": "1536:KxD+xE86+GxaQPshbEKRvyQV+XRCaW9x7IHyk:Kl+xsxVE1rRz+XRs9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761540703, "uuid": "2defecb0-2c6e-4f86-ba90-6b012d7c04f5", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761540703, "uuid": "b645d636-4408-44d6-b229-b34a17866600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540703, "uuid": "52fdcc23-497f-425a-bee7-975dd0036d5d", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bacc772-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595560, "uuid": "e7a51dad-eaa2-4cae-8acf-479bd17e03cf", "comment": "Malware payload", "value": "73eac84d767cebc5bd04a5502e609ef3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595560, "uuid": "e3048611-86d2-4d95-9aff-99988d904ce3", "comment": "Malware payload", "value": "6fd9b2c51f0bce170b68ece10cfd35936dfa6bd5b478369e86dc99d0e6dd2da7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595560, "uuid": "718d9628-5b0a-4aac-a9e2-59508a6026e8", "comment": "Malware payload", "value": "984d8c2a2199139898ba4ac0f6c89278ab8a54f0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595560, "uuid": "ae5a2b56-a22a-4368-b623-1c1dc980819c", "comment": "Malware payload", "value": "9da463fe354a6accef60502e7e67da199a406d0c30f675d945ce7b80ecf5024807877ecbd78b14fb486c7107fb4ad1b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595560, "uuid": "9f13ce30-6b16-4453-b6fa-c3e8a7281a14", "value": "T14D76336629CA09B3C9B9C73AC5FD2CD8EE016A107600547E11C278F95D43FB2DEA365B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595560, "uuid": "617196fb-7c5c-43b6-bbb9-fd0a564beeff", "value": "98304:M/OFnYHfZHyU2OsFVai4t4Go5PUmq6HUvLMJr1DYRXooWqNGGPunY1VgjL5LKI68:NFwR4P94t4Go5PUA6gAR4otrz05eF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595560, "uuid": "1bc3eefa-93af-4925-8b3f-f80a921a0996", "value": 7739761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595560, "uuid": "f5890fe5-a755-4368-a0aa-2e329e45f64b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595560, "uuid": "b437b36d-5c4e-4935-ba93-4b69326dbd5d", "value": "quot53535.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9047e93-b326-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761563907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563907, "uuid": "f58e34b0-d120-496d-bb67-7f137d49f59e", "comment": "Malware payload (Mirai)", "value": "2d62f38349b075e37cfdb236643a4eea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563907, "uuid": "76f1453e-e770-42d9-963b-065f89dedb2c", "comment": "Malware payload (Mirai)", "value": "71b437e852a7b828b645a987e90b32960749b3a48d50582da56227a4b9cd46f9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563907, "uuid": "1a68e4d8-54bf-42a8-92d6-abd4d2f11795", "comment": "Malware payload (Mirai)", "value": "44daf3ee1cc0556bc15d35ae970e7cf8799bb8a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563907, "uuid": "048a7eb8-1c92-48d7-9f29-068638804a13", "comment": "Malware payload (Mirai)", "value": "8101235408ad5cf50f4d0a5cad90a7dcb1110ea476790e55ad9a9693fb338f028e62b0bc7eddfcadd49e05f15011f73c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563907, "uuid": "9186b168-e331-48fb-b6b5-f038e07f8f67", "value": "T1110122CF31E1037D1909865930A7C719B82CCAAA0EF20B9CE84938792388994FC0CF72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563907, "uuid": "25ee10ff-7286-48c5-aa33-0708cebd557c", "value": "12:wJ36srPu6oRYBDAGXEENonIIjDCI4EENonvD6EENoniW82dJ:g3HoWBnEENuIJ3EENuveEENuD82D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761563907, "uuid": "cc9dfc68-b38a-495b-827a-8d50554f1ea5", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761563907, "uuid": "26bec86a-a05e-48fe-8cf5-6c2580de7878", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563907, "uuid": "8e313d59-9910-4ec4-b1fd-704b9a14dd26", "value": "tvt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0660ae37-b320-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761561057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761561057, "uuid": "ca52e9c6-60fa-4812-adb8-2159a5ef771e", "comment": "Malware payload (Mirai)", "value": "433fc632b06d68a13b904ff9a7cd40fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761561057, "uuid": "f4031a64-91fe-4339-a610-8379bb61ee77", "comment": "Malware payload (Mirai)", "value": "725959c926ff5dd15f88cedb2d50db0dba35912f8a0ec52d6baf0ff029ef496d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761561057, "uuid": "ba07803f-7470-4296-b5aa-1ed48a8f6d80", "comment": "Malware payload (Mirai)", "value": "b05bcdb1f9b7cd601cfbf5c16fd602141a47dabb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761561057, "uuid": "8d532df7-bdab-40f7-8843-40a7530fcb89", "comment": "Malware payload (Mirai)", "value": "0aded716114153a83c64ebee3be84983c57fc6d90a2f3ef240903a60b62cc791a0e6008a7f26befe161befa816b1b75c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761561057, "uuid": "561dc37c-eee8-4532-a851-093b3cea27bf", "value": "T18AD31845B881AF20D5C626BBFE4F118A33135BACE3EE7213DD145F2427CA95B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761561057, "uuid": "30e4cd47-db1d-4666-87f8-6619add4b18b", "value": "3072:7C+uzhnjjtRbHz6P6D5rV9vkHIrxTgdjrcJE0PVatzZBkIa1PnzrV:e+uzNjjt5Hz6P6D5PvkHkxTgdjrc3PVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761561057, "uuid": "f071cded-542d-444a-9340-522186fad757", "value": 130684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761561057, "uuid": "b288b9f3-7fe6-49cb-9159-b4d32f4233a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761561057, "uuid": "fa9d4618-4147-46d4-8018-47badb3ab726", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fe7234-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577426, "uuid": "a01c7579-7912-451f-b74d-c16da1303ce5", "comment": "Malware payload (Mirai)", "value": "2f06b9b32b4d8e46bd1ca7ed39342b9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577426, "uuid": "7e6f9d69-b4dc-4184-8287-73f353c30598", "comment": "Malware payload (Mirai)", "value": "72668ded26057a237c837010f0d418d04181a2b149ef6a930443bb9f54acd23a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577426, "uuid": "54500ddc-ae16-4c78-838d-d2096d91f7a3", "comment": "Malware payload (Mirai)", "value": "9410d61c9ab503e8b83d9899b1ad98eb79d7b5c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577426, "uuid": "6181aaea-31d0-4b4d-ad30-d3221f1d3859", "comment": "Malware payload (Mirai)", "value": "46af5fcbee115e1d5896aec5a28dc475fec296a2fee3106c9aafc6b1ed7ffdfea6f2809841b9f36b518a5f658cfa17c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577426, "uuid": "0963ee25-f914-42f5-a13a-5e78acac9da7", "value": "T1A7E30934D450472BC2D223BAEB9E464E3F221FA793DB33155A347AB42FE179D1D29920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577426, "uuid": "a791f773-cfa9-4108-acac-583fb47913ea", "value": "3072:YqFFH8oB0aLIT3oIzE++PPbPBXwwL6xKFmnqQwobnbNu:YqXuaLITOPPbPNwwL6xKFmnqQwobnbNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577426, "uuid": "38814c95-96c9-4ba9-ba6a-4a32da84eddc", "value": 147760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577426, "uuid": "f1db1d2f-4adb-4bc5-8a3f-ac700e4b6187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577426, "uuid": "9b2abfef-8dc5-4f24-a1d5-6d8f1980c30c", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435742b5-b332-11f0-91c6-42010a9c0006", "comment": "Malware payload (AMOS)", "timestamp": 1761568890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568890, "uuid": "b4513050-e269-423a-a717-5803c4e0acde", "comment": "Malware payload (AMOS)", "value": "5a71600ba6c2b39d61c2be92daad5f27", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568890, "uuid": "6fb8a28b-2e51-4d7d-9437-6109301e4292", "comment": "Malware payload (AMOS)", "value": "75a80931c7922dc9be151361cd27f5caf2d1bcc345838b27e8b7df126d300358", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568890, "uuid": "04df87da-382b-4637-b6a9-fd44886fdd29", "comment": "Malware payload (AMOS)", "value": "390605aefdf8f14fc4df45d474539f89e33ef52e", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568890, "uuid": "0bbd6be8-a83c-409a-a8a9-ede80683e546", "comment": "Malware payload (AMOS)", "value": "9d88f9334c108bbe0f768c5913fa8e4e28bb695848c53dd14306d32db3562ed583c3443294a049e937df90949a23aba7", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568890, "uuid": "000499b7-e457-466e-95cf-0212e14728c6", "value": "T164C08CC1443CC0B157350A5EB228F1F89A5368240FA0B8A2D808890420240700C4F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568890, "uuid": "53590f91-bca4-4c4b-8d83-56e6c30ce41a", "value": "3:WFBIx8sv3uy9Fb+dNMfRKNyGbeeymHgmQmk0QQHFxaFOd6HhC:/9vrbsMfUlebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761568890, "uuid": "dbcaa062-d7b5-409a-a6de-fcca89b3fb42", "value": 157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761568890, "uuid": "13a13ae6-557f-44a8-8d72-f275ac4bcf69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568890, "uuid": "7f2de6fe-94da-479d-9017-40cd5e62f13f", "value": "7ii4tkuke1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e693c162-b32f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761567876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567876, "uuid": "e9d1157b-7463-4a3d-b2c5-662daf1b8b0c", "comment": "Malware payload", "value": "edac64a566acced4ce6e282be0f08e3c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567876, "uuid": "dfdeeb1d-03d2-41ec-9d58-b62c5dafc609", "comment": "Malware payload", "value": "76293e8fab7325b86c9b25f659936ce0ded395d776a3f8db7e9d87256aea7e5b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567876, "uuid": "3cb49b45-777f-474d-bb4b-fdea333fe601", "comment": "Malware payload", "value": "1d1a31eaf170523fc689327f1ee8b7f29437c2bc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761567876, "uuid": "38f039bc-6dbf-4e43-b371-b9ad96182ab5", "comment": "Malware payload", "value": "9f04a1811ddc74639e2f9256dcd59f79753270198ede3a3e105f3e85bc373ccddb1d42aaef5db0c51ad1409d96c81213", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761567876, "uuid": "f4f0a94d-f27f-4348-b746-c63b0ebd756b", "value": "T141963389BCA04957CBE14116AF531212DB8A69B189F9B53C07D84CB3F8C79FECB71858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761567876, "uuid": "795b341c-f05a-46ed-9a05-0b0d5b40a49b", "value": "196608:iXzgGDnz0UzD1hcBROMIDdrrJ8W5RXn22Px+C6pp:GDz5D1hcmDdKWbn22PF8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761567876, "uuid": "6720ef79-030d-4484-84b4-ecf8d58fcb5a", "value": 9093542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761567876, "uuid": "2512b0fa-67c8-4203-9ef8-215d2ca75428", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761567876, "uuid": "c3779d6b-32c2-44a0-bde3-4c6e18a7e178", "value": "stand.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be049ef-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577924, "uuid": "b76fcb65-220a-4df1-8a4d-4d37e0a25f4f", "comment": "Malware payload (Mirai)", "value": "449ef4b96233ffe487a9cf6b6a37eeca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577924, "uuid": "0e795230-59c0-43f8-84ce-377163ce82d2", "comment": "Malware payload (Mirai)", "value": "76b2b204a2c33b0e94216f8bc2ad76b348221011741221585c9e7c43f7848848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577924, "uuid": "36bf88d3-8571-4cd5-a83d-5ed9af1d4852", "comment": "Malware payload (Mirai)", "value": "93ff9103f3ffe66a2187d6426afdc084f27d595e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577924, "uuid": "3270eacb-b153-4a7b-81ed-aa1d725de1cd", "comment": "Malware payload (Mirai)", "value": "323e36d5df7cf8b000839004420768551f839f70a03dec926d08811010d5f7bae0aaa9f60d9308ae1ce2c21ccacbd10b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577924, "uuid": "7dbea876-18b7-45ff-bca2-d7486d6024ba", "value": "T1F7F2E1D4564A90845DB20CB1C17FD642972B6BB8CABA3626432086149EC785B78EEFC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577924, "uuid": "46813b5d-b820-490d-8fc1-255a980eaa9d", "value": "768:/o4Ip6R66BvqMiERN9i2qyVVN2WQt+ebiaET/+Xtdg3UQeB:/56e1vviERNQ2qyVbQxk+dd6eB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577924, "uuid": "ad93bf01-c211-40a9-858b-5e8a6e5d432c", "value": 35976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577924, "uuid": "e843f24c-e45a-4591-9e1d-eeb821751429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577924, "uuid": "c039e959-4443-4496-bdd6-d6632bf642f6", "value": "kvm.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0319a20-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595755, "uuid": "cc073cc8-95a1-459e-a76a-a62113de9b51", "comment": "Malware payload", "value": "c2babb587ceeb36bd8fe62a146601d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595755, "uuid": "b46b41c5-f59a-41c1-ae74-77cdbf68a5f8", "comment": "Malware payload", "value": "76fc32110c0dfdfef80fb1eace52d05567c79fe58a538b3831e542c12cbfadd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595755, "uuid": "1725b713-4b6e-42df-940f-6fab5510e522", "comment": "Malware payload", "value": "d8e64f57556150c4ce91ab26b1769f2045d09f2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595755, "uuid": "3bdba53a-d6d6-4bc3-a886-702db7d549ab", "comment": "Malware payload", "value": "f349131b76fd5e556125659b9b7fb2f0274ed2db5a3a848bcbac23b6cc8674f923585bb43075bd9fba448dd9acb0b335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595755, "uuid": "f8c4bb9b-e500-42a6-bdb9-a12567cb2013", "value": "T17DF41268675ECE12C8D12BB50860E3745338AF4DB610E2524FFE7DDBB07AE24284D392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595755, "uuid": "a6a9357d-12e0-4700-b298-20d94e288893", "value": "12288:g3GiGfZ8aUyaGlrvPV0CcRdMkKHFef+LBxP6EuPa9vJVbULU9qKs5WeJY:oGiGfWaJJLu/KHE2L9Z9BVALUQWeJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595755, "uuid": "ba77d0f5-f683-4351-a4f7-77d07f3355b1", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595755, "uuid": "27579b29-1c1f-414f-b245-fe7d07cd8144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595755, "uuid": "fe25efe8-db25-4e5e-954e-1731aea13b61", "value": "DetalhesSEPA (78).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace09f7d-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588395, "uuid": "6ee2b9c0-cbe9-4c9b-9978-b6bfe92d4f08", "comment": "Malware payload", "value": "3d0dbe5035e56066d34e0e67b0979db2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588395, "uuid": "50158be8-e6b2-456b-910a-82fe954ea94e", "comment": "Malware payload", "value": "78cb4b9c61bf83d9d49825ff8315f2b8dacb92323f21a05e5cfb66aca77d381f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588395, "uuid": "c724c530-893c-4697-b908-a6c8644a3dfc", "comment": "Malware payload", "value": "1b7d5396efa4500b4c7ccf4780531a74f3960d21", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588395, "uuid": "70f8c271-d744-4d39-a164-c18d7bf57213", "comment": "Malware payload", "value": "9f30160ac6d4e3684b249f322304afd86918182811b5318afdfc3285139e3f2881866f503fa48b9cc61cee6aa9440daf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588395, "uuid": "cf6f0ee8-ab7f-4d4b-b135-23737e4162ca", "value": "T10A2121145BE56725E3B30F3668A1E735CA37BC03E953DF1E018181881472A52AD25F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588395, "uuid": "cef80d9f-9607-44cc-b995-cd206a6f5510", "value": "24:8IJ8JsPZAO7ypgAM6Ji+/xH7W67KcYqVwOtab/cm:8IWJG/yp3xqwBvtaTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588395, "uuid": "e37d667d-47f6-41c5-8a8a-27623c53bedd", "value": 1429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588395, "uuid": "efbd7bbb-a36d-4347-a58b-3434a1604ce5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588395, "uuid": "46bcd883-8763-459a-bffb-cccb8f024c03", "value": "SC-54093743.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8ec8ee-b350-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761582031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761582031, "uuid": "7ad618cb-10c2-4965-978d-e6d1752a8a51", "comment": "Malware payload (QuasarRAT)", "value": "f2fb5741ba4194d45161b55a52db0016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761582031, "uuid": "e36877ff-afd9-4b44-935c-f2d3dfc1efc2", "comment": "Malware payload (QuasarRAT)", "value": "79bcf99e5c1a3c82d9de611adecaa580350711916e22f9f019d80ae90b3ef24f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761582031, "uuid": "d941d45c-c02c-40d9-85ed-c253daa63c21", "comment": "Malware payload (QuasarRAT)", "value": "ad1e7a5d54bfbfae283ecbd69c0ca5c35bb76d08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761582031, "uuid": "8db0d6b1-f2fe-44e8-853a-32d72e3e965f", "comment": "Malware payload (QuasarRAT)", "value": "5aff94d7db1eb474293c77a6ac7a5d518aeb9542d71bd483a2bab258e01251bcf6a740c4d8039e5f2d853442ec978d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761582031, "uuid": "fd07e1e2-d498-4495-93ee-197d81b05dd6", "value": "T1C2E56D343FFA5A26E27BD272C1B05546A7F0F96EB2A3E71B21D172681C637409C016E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761582031, "uuid": "b0505a97-660d-4716-91c1-e5a1c68dd64b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761582031, "uuid": "906acd60-de60-4da6-8cce-cc9479b51a03", "value": "49152:8vWI22SsaNYfdPBldt698dBcjHf2dINTHHB72eh2NT:8v722SsaNYfdPBldt6+dBcjHf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761582031, "uuid": "b9d5e8e8-ec53-476f-9b82-c7e8c97783de", "value": 3054592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761582031, "uuid": "f66947a9-0c72-4c47-8b16-1d70a2980572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761582031, "uuid": "2b1751fb-0231-44c7-ae12-6ce746515c30", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec6eec5-b36b-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761593552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593552, "uuid": "a9a2c50c-4abd-46f3-b0f4-d405418f34c8", "comment": "Malware payload (AsyncRAT)", "value": "279da8d1118c1dd0988c8d1601d6998f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593552, "uuid": "a4b118d6-a08d-4df4-b38a-c21a1bb9de27", "comment": "Malware payload (AsyncRAT)", "value": "79d7a87a6d4a4620320cc51644db10a3f691b0ec27fdc7b05bc5b91edfed384e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593552, "uuid": "f60767bd-a626-428e-bab1-a737572e3240", "comment": "Malware payload (AsyncRAT)", "value": "af015f1ef52a6b0ed9d5ccfd6806256ee89a2699", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593552, "uuid": "c98f5f35-587a-4689-b95f-fa1be5eaa064", "comment": "Malware payload (AsyncRAT)", "value": "c8c0750ea6d5ac58dbd15774fbd02b43fc58c02f09186a6abd69f0772a00f6687fb87977dba128f92e3a2f869444c1e1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593552, "uuid": "8ddfeac9-4a48-4422-8917-8a42a0141a93", "value": "T1D7A42334DF91633C94BEB87CCE524047A35281E75E66D6E572A39BB73B7710312618D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593552, "uuid": "a968875b-f1ca-41ee-9de4-faa73e5e01ce", "value": "12288:xngqi6UDA98qhd3z98Fn3hj0d0Z76FAauo53tqf:eqijG8qrD23hX56Fruo7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761593552, "uuid": "1ca3e80b-e5fe-4722-ace2-6ad0d502b8c0", "value": 451930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761593552, "uuid": "05b7c0c9-3587-4e9e-8f90-4aa754d0e779", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593552, "uuid": "f0fe3bbc-abb7-4109-a588-2c1f0febb40f", "value": "AVISO DE CHEGADA - LRAN16014S.pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd94c6c7-b323-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761562707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562707, "uuid": "6524c7a3-e96c-489e-9442-d76d81997e98", "comment": "Malware payload (Mirai)", "value": "105fddea993e54595be98b9d3ae5a7f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562707, "uuid": "9fe1b0d1-21c1-4c82-9869-78a2198d398b", "comment": "Malware payload (Mirai)", "value": "7a46085869de5c5ddfa0690aee3917250044bc2d4733bea81017af0cc2e284af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562707, "uuid": "04946b95-137f-406f-9250-b16c66b81845", "comment": "Malware payload (Mirai)", "value": "022b0c43e65adac4c4fa8800dc73cf7d8dc43456", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562707, "uuid": "edadc95f-5d1d-4012-962b-0199f9e1e7f7", "comment": "Malware payload (Mirai)", "value": "575b267397abc733ab40c33fbee34a85ecc5e1ee2571067048e61e9913e7fd9c4bed1c712ebf952572ce7e1982aa2acb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761562707, "uuid": "fb9987c3-b381-439d-b31a-c07d2b8db892", "value": "T142C38DA47A4F7C91E3C7E37DCE484E72711B75F4C26192B4BE12431EC4DA9EA8AE0941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761562707, "uuid": "a452fd59-06b2-4105-90f1-1509af74468c", "value": "1536:IHes5/qUE0oyGNG/vmkrQVf/skKYBoZEWEHdJ8BpVsPQlcevG:Op5/nGNOSFLBBoZEWEL8SQWevG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761562707, "uuid": "11ba49cf-92ab-4530-a729-c9beb2825493", "value": 124768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761562707, "uuid": "29e877bf-4adc-445b-a413-2f5de3f3dcd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761562707, "uuid": "1ffa7560-9caf-413a-80c2-1a035b7df91f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acd25eb-b31c-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761559508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761559508, "uuid": "9931314c-96ae-4756-896a-82e8ecdc515f", "comment": "Malware payload (QuasarRAT)", "value": "7c5da768a4612916d9babea2dc9a3a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761559508, "uuid": "185cf512-9f2e-44ee-94d5-2aee5d5fd448", "comment": "Malware payload (QuasarRAT)", "value": "7a5be1773b8383037113747990bf1798b072e8563773f3de3c23e3e99f2da25c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761559508, "uuid": "060bf590-08d5-4781-9ccd-a7dbfc80d65d", "comment": "Malware payload (QuasarRAT)", "value": "1085faf9f1aa22397cfd47962c1fa9a408170dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761559508, "uuid": "c72ed93c-dcfa-442a-8dad-7fdbf4790379", "comment": "Malware payload (QuasarRAT)", "value": "2ff07d9c16ec16791814af13dec4216d1ac623b128ff9e1fbd8660a455e8df78312f5ef293ac217f3f6916ace8567baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761559508, "uuid": "31fed7f9-909f-44c8-a7db-ca300d002adf", "value": "T16BE55B143BF85E37E1ABE277D5B0041267F0FC1AB363EB0B6581677A1C53B509842AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761559508, "uuid": "e23b8356-9f74-471f-b657-10ecf162c7c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761559508, "uuid": "cfb4e4ba-a499-4987-a9fd-18568c8de5cd", "value": "49152:Ovkt62XlaSFNWPjljiFa2RoUYIWGCqsbR0LoGdFTHHB72eh2NT:Ov462XlaSFNWPjljiFXRoUYIW3qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761559508, "uuid": "ee6a95fe-0863-4eaa-a4c6-98daaf8037f0", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761559508, "uuid": "6276ba7e-5208-4ef2-957f-d7e69110a778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761559508, "uuid": "beb1ee01-b516-49e1-a21e-994b584d66ed", "value": "pB8TeMO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3218489b-b35b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761586471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586471, "uuid": "bac00085-c671-4790-9b2e-753956b75000", "comment": "Malware payload", "value": "4e054db5ce4e7c2227fe1ea892b90076", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586471, "uuid": "4496aa4e-892b-4710-a03d-b82cba9f4ce9", "comment": "Malware payload", "value": "7a8fc48ce4df4448b91a1e6b66410cca6993ac072cb12860b9cfa6438b25ed8e", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586471, "uuid": "e5d00eec-a4bf-4076-8dd5-499d5aa7fbc3", "comment": "Malware payload", "value": "d3d6e3d46efda4762a63747f448ac32c6294a6ef", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586471, "uuid": "90826f34-53bf-41c7-acbd-00748b51f1ba", "comment": "Malware payload", "value": "1ae41e43cff1777b0eb5f47ea594e8e1c3d332ecd3a8948872178ea14914fdd008d72f5d75981dc43efdb3070e27e161", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586471, "uuid": "c193663c-a58a-4198-aae4-f364ae419442", "value": "T1DEA3842947186572C18CCB3941D65317B223F28A4AE2961F77CCD12CBF86398BA70D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586471, "uuid": "381d8bec-f736-49a4-b70a-3933e5242d23", "value": "96:dwpqXsyieRzG9b6SBDB7kr9OLHy5iDUyy5AAKj3hpkhyieRzG9b6SBDB7kr9OLDr:dh7SBJksLHywzyaF3vR7SBJksLDyuy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761586471, "uuid": "573cf611-39bd-444c-acaf-082c749c6a48", "value": 101536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761586471, "uuid": "f952c9d7-b68a-44b6-8ca7-2385fa5341ef", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586471, "uuid": "6f0c4880-f2cd-4f0a-b9e0-be28b14200e4", "value": "apps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723a32b9-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595598, "uuid": "4b16c57f-03ff-4256-ae99-1a1487c63967", "comment": "Malware payload", "value": "62dc606e7f85f8f15a582a045e394d19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595598, "uuid": "6a6f9961-7075-46b6-aaa7-2365ff6ca3c3", "comment": "Malware payload", "value": "7a91d83167c864b5381667370b95fe6081290c61356c90def9a25cf7b3d9c411", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595598, "uuid": "74755165-7cd8-432c-bac9-9f8c7092a35d", "comment": "Malware payload", "value": "bad647ebb9207e2b20d464c6b420c84b971519d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595598, "uuid": "77e1059e-3cb1-4ed3-ba5e-6aacb2585a60", "comment": "Malware payload", "value": "c3efbbf9c3e142f5ad06602d6f0839decfa1c7eedbebe3b52051a3110409b6f5c5e5c658306716233198b05f45330bd5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595598, "uuid": "b6280d61-ee62-4bf4-9ca0-d991bc6ceea8", "value": "T161E43A95ABB514A8E9F6C17C86534A33E376F4141330AFCF166189390F5BBC82B3A358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595598, "uuid": "9f870341-d11d-4839-95ce-707046b761a7", "value": "3eab1ece0b65f85521e04eb7f1ed1097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595598, "uuid": "7681b0a9-015f-4467-9fc1-ad953b2bb7e7", "value": "12288:cqSCEi+GBzd7z/HDCuzeKbOf6Phd7lRrKZ2voFpZvwyXZ77H0XlvOSMm:pnD/HDCuZKZ2v6Zp7IXlvOSMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595598, "uuid": "cb580719-13cc-4b5f-a21d-eefbff4152a2", "value": 693624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595598, "uuid": "173b0801-1e8d-41eb-af6a-b4bd3c306ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595598, "uuid": "dcf7b7ed-4998-4329-be6a-5a12d6bc5e14", "value": "libssl-1_1-x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f759b690-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761557166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557166, "uuid": "832ee800-d729-4694-876a-9c82f5ae1d7a", "comment": "Malware payload", "value": "b22b00b9c7a4e3211ecf9bd1c27da8e0", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557166, "uuid": "674d8d24-86e6-423d-b34c-6ad24e757bfd", "comment": "Malware payload", "value": "7b65cf782881267e48afe3a4997909b922396e3896f8379e13ad145eb6a61d72", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557166, "uuid": "a82bf096-2a6b-4dc1-933e-41c21751ab0c", "comment": "Malware payload", "value": "d85222e41e3f2ca2846cc2df56bb22b6984b03c4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557166, "uuid": "a29587fa-1e08-4644-9cfb-e8dd55710930", "comment": "Malware payload", "value": "bf444fad2b4413f106c7add5460d43f7cc640d9ca279b55731b3665a77a74f32d4361c12b44cbeb9609cb7e3d0ce1934", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557166, "uuid": "0d40bde0-beb3-41bd-a50e-289b70671f3e", "value": "T115E4122010F6217EBE9C8D34FB7F09CC96EE80112A395B1B4D45F591611736A2AFB2ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557166, "uuid": "c3f7fc7e-81b1-465a-b959-0e4dc47548f8", "value": "12288:Sf1WMfLDi4Bl+HqcjB7Ciyp0vKHOal3PHgv9/FWDNiSJO920/ih:AoMjfl+HqcN7Dgj3/gVFCiSJY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557166, "uuid": "c765e8c9-900e-4e1b-98a4-657315bab5a0", "value": 698168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557166, "uuid": "87e1ac87-160c-4dee-843f-cead1f6e44a7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557166, "uuid": "af3119fb-d7a8-47e5-abc3-5dced3c7c7d8", "value": "NoticeXofXCourtXOrder.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ec97a7-b333-11f0-91c6-42010a9c0006", "comment": "Malware payload (Fuery)", "timestamp": 1761569212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569212, "uuid": "5a791e40-9211-445f-b365-fd94f3fdfeb1", "comment": "Malware payload (Fuery)", "value": "1be6dcdee7163fe74a66d78c675ceaf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569212, "uuid": "ac5df642-c6e3-46e0-93fb-52d6f9e293c4", "comment": "Malware payload (Fuery)", "value": "7c18a23856fceb5b26192ec3d1720527f742fe2853767100b50447af831284a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569212, "uuid": "9b70d9a2-4676-45e2-b7e3-29294dfa7c54", "comment": "Malware payload (Fuery)", "value": "854f913e698a90694289373a2ec98e21c25e3260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569212, "uuid": "9d0c1da2-841a-4664-a14f-ad9498db227c", "comment": "Malware payload (Fuery)", "value": "b9c9ac2b576140e76bb0cc016e35dd7416c2ea5b4c616e130604e27654b37181147efcf054a198a65c862a4a63470f2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569212, "uuid": "3ac67f1b-715a-4d6b-9c33-e42ee63f3591", "value": "T18FE401687659EA26D67523B40CF1F2B007BD6D9EA822C30A6FC97CEB7466F148D40353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569212, "uuid": "27c64bbc-0251-4210-a0ab-6904965188bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569212, "uuid": "2c930c95-ced0-46f9-9fa6-7dc2d2bf79ca", "value": "12288:Zb4DSUdhGINC62qN2BTWQp4IUz+gfXwScQH2:9SPY62u/QqBfcQH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761569212, "uuid": "9ef00eb3-8298-40b3-8c09-1ff638e640a7", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761569212, "uuid": "68007c3c-e7f7-422f-9635-567d50e35283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569212, "uuid": "b6d30b5b-cb1c-4692-826b-3d3913b3b524", "value": "SecuriteInfo.com.Trojan.PackedNET.3148.29738.4257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8c5944-b368-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761592021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592021, "uuid": "bd5e5f59-e3fc-4bf6-a7e6-e4cd15ced8bc", "comment": "Malware payload", "value": "a8483db3a18eaa4de1f9fe6b630a95cc", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592021, "uuid": "69f57489-65ed-4545-99cd-aba500555c41", "comment": "Malware payload", "value": "7c1d0b557ca3dd74c81db81cd0359d1ec3a22128def691a06bf0e7a501f5aa94", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592021, "uuid": "d6141284-68ae-4881-8bfd-cc4747c75e73", "comment": "Malware payload", "value": "b02fe592a8baae00e27b429eb6139056af08b2d8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592021, "uuid": "baaaf40e-b747-4001-b6e8-92f281ac096f", "comment": "Malware payload", "value": "77bcbb838c9a85762427302ad59a70dca58b2f1e81deda42cb967ce56b2fba617de81d1233a4cda62c623e565efa9884", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592021, "uuid": "543217a3-393d-468a-9098-9faeddff18f3", "value": "T100F0C00CC815F10D049C9694257300B2A5D2964769CA69202246F33B2BFA14EA655894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592021, "uuid": "9a4e38ca-a24a-4032-8b06-7f500003c7a2", "value": "12:oEOrn6MEnYgyd6CSkesNlKfbTkGY0zrXVWpKQQOT8w:ZOr6njqvdKbwiMhYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592021, "uuid": "dfc5ac5e-b0e9-490a-ba9b-3ad6a15b6021", "value": 503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592021, "uuid": "40ad0724-5eb6-4b8a-9da1-688285f83b11", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592021, "uuid": "b93ad09b-d3ae-4d8e-b351-4b3d621c0268", "value": "Factura_9484_JPEG File.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d872f1-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570821, "uuid": "fa27aecd-a1d9-4287-b305-d11c24d47de0", "comment": "Malware payload (Mirai)", "value": "a648536197e07e044ceeecb698285d30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570821, "uuid": "941511d9-68e5-4c6a-b3b0-bdd8cfd85a41", "comment": "Malware payload (Mirai)", "value": "7c3a572cc63b34d02fef63d6f2657f66c26e71bd18b71cc6e686565c4e05420c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570821, "uuid": "b23ef6d9-eb31-4e6f-add9-0b4d62098e5b", "comment": "Malware payload (Mirai)", "value": "91ec3c2485f24018967cceee22c2cfccc10935f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570821, "uuid": "ce2e0c7e-a60a-49b1-9a63-2a6d755bac74", "comment": "Malware payload (Mirai)", "value": "9e2cf4817c3328ba4511d2fbb7e4c7bdcde934f726119e7f62acb52d6992c5f8e0e4e09c1bd81ea9ecf250b6f1e047cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570821, "uuid": "f7753dbc-88f0-4c58-96f5-69c2144bc17f", "value": "T1C5A2E0A9FFA6C189D0C6413C19D3A96B2AABDDD3939C026F5D91E9C605D38CC904EC31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570821, "uuid": "2b3bf648-2282-4c11-a152-9c6a7e5d49bb", "value": "384:jDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbXrhNuHfmmcb4/N7KbxTKqdcuiFqcJW:jDZ5Dw7RjFjcU+O24sDTuuE/Nmbx+qdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570821, "uuid": "c5736fd2-2f88-48f1-a650-93e5de3e06ce", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570821, "uuid": "408d54eb-e632-4bc8-bd04-def0143bc329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570821, "uuid": "09038e9d-a876-43e1-8a42-4d7d956c736c", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a86deb-b373-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761596756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596756, "uuid": "66a1e651-21ed-4b5c-a35d-b0858e1d714e", "comment": "Malware payload (AgentTesla)", "value": "c6de13a7caf392b6b19588b32c81c1b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596756, "uuid": "0a4af01b-9dba-4555-9fc4-40ec72b60c7f", "comment": "Malware payload (AgentTesla)", "value": "7c44a6b10f668945f2d2423008ac02d5c9be26c18daf599e6c875e3dd943c5ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596756, "uuid": "2e291c42-3abf-4411-8f1d-2dd77b06e0d6", "comment": "Malware payload (AgentTesla)", "value": "3d0b63f475b6847fafcce209def9e1d1dbf5a719", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596756, "uuid": "77ec79b1-0684-4670-ad9b-2ff1a56ce40a", "comment": "Malware payload (AgentTesla)", "value": "67588a81c43cb26156769f404778d565a7f77b522d2c39e42ada7a5a91438006d7f57fee436102a36dff6d76f33b6d1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596756, "uuid": "9ee55633-fabe-4505-a74b-b29067c33cd1", "value": "T1D161658669C5B0AC8702F1632A5B248AD21FDC40681F4A94F630F6D87CAA3147A7F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596756, "uuid": "7e9dd4b5-b773-4161-9d55-0142a1b05390", "value": "48:1kHEKrwMBgZnIeSq66R6SCCk7LGXXLM4O5WI4oF2NtapwxHIXLOVgHArdjlAJ/4/:uTwMSXX448Q/L9IIYodU7ITlTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761596756, "uuid": "c5988324-798d-49e7-be60-ca0b080a1070", "value": 3359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761596756, "uuid": "0499dcc9-3903-4842-90d6-4458a8b8a73b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596756, "uuid": "ede2e89d-9c9f-447c-b5a1-e1b0abb341f0", "value": "Proforma_Invoice_Corrections_HSCO_2025-10-20.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57dee20f-b2e0-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761533706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761533706, "uuid": "5f31eef0-62cf-4cf8-b39b-b3179adf9a5d", "comment": "Malware payload (PureLogsStealer)", "value": "d11d8c745be508dc1fb859ea8adc9e76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761533706, "uuid": "217019b9-4801-4405-965b-bb21086d0972", "comment": "Malware payload (PureLogsStealer)", "value": "7d4341732ef5442ec456c78b82b92912cec787d884b8ec97d620358a341c7478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761533706, "uuid": "8033b723-cc91-4d16-a8c4-d680a37facac", "comment": "Malware payload (PureLogsStealer)", "value": "da95b43bc37b9b8e10e1642d0669f9a8be93e8bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761533706, "uuid": "2cdc381e-3623-4458-a642-69f4e67abcbc", "comment": "Malware payload (PureLogsStealer)", "value": "5f059b50ab3da0278e87dbaf86aa2e20c389a850859d476d182f93f49c33331aea240492f4086f3e60411d9897d80d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761533706, "uuid": "2dc4400a-8991-4d68-868b-b49789183e6e", "value": "T1C32523953B29E807C48297B809B1F2720B793ED96112E686DFD26FDBB9D5F004D21783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761533706, "uuid": "530255c5-8d95-466d-affe-df4a015493fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761533706, "uuid": "6dbb19b1-0d12-46c7-a0e4-c8e8d851b03b", "value": "24576:IchQQwkPXWBC0Y5XLEgce4527ujjNcX/9r1amFia6vupLVjmD022e3:SQwkPmxYtEgce41OXFr1awi7vupLBmDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761533706, "uuid": "1705912a-29f3-47f3-a36d-4bf03014613d", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761533706, "uuid": "2fc39fad-eef1-40bf-9765-8e7c1a578340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761533706, "uuid": "207ae92e-5321-4804-a6d9-fcdeb433c103", "value": "Quote Request - Project FMD2025UOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8effa0-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588288, "uuid": "4adcda52-e04b-4cb8-9725-2a06c1f56790", "comment": "Malware payload", "value": "56ed2428afc605b4ffa61c70aac51c64", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588288, "uuid": "0a2e5b32-f90f-4dfb-8c46-74999a3c9dc0", "comment": "Malware payload", "value": "7d9b17842b9fe46b78df6a7cd0ca771fcd696c3ee0c303361959abbb22040d3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588288, "uuid": "6fc0b82e-bb4f-4146-a708-38814b84a285", "comment": "Malware payload", "value": "2ba5c63b61f56e1d2782d567605c11f437ab04bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588288, "uuid": "f84e2d71-93a5-4fad-a719-05cf04988270", "comment": "Malware payload", "value": "b0cf8ea9476d5ef189bbdc15fe1b6bafaed7a9106a3175c11a47238906ad2863ac8c2d6f3393f186a478194a2bfb4073", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588288, "uuid": "ce7337a6-4ce2-49e3-aead-cc025d8fbf51", "value": "T1EF41FF27DA56AE7A19B9C0788C54A445ED60439B23842D2F72FC821D1F3AA333987659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588288, "uuid": "7426849c-371f-45a0-8a6e-0dcb86a545ea", "value": "24:n95Yhv6l92goCGjDqY/KnSVAryCPJi3JFIuY2yTRRiPC33+YdfdMis/Ai6g0qIlM:IhKkFjGQyMIdF1MJAq4N/W6FXvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588288, "uuid": "f3f5f912-395c-4372-a0c1-8f471e4c94f6", "value": 1881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588288, "uuid": "00a3a7b1-d70a-4128-a6ba-902b0fda1e76", "value": "application/json", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588288, "uuid": "fdaf9504-f7c8-404d-bb3b-b49abd675b1c", "value": "tslint.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210baadd-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579141, "uuid": "19227113-e461-4323-b870-633721f7eb3f", "comment": "Malware payload (Mirai)", "value": "73449560680baa55092fb91743ed4ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579141, "uuid": "3fafe7ab-f416-4b3a-8522-bdf9a0cf35a1", "comment": "Malware payload (Mirai)", "value": "7f6b8440182c46122e293cb8cd14752372ffeb21fcaee2835c468069b79c4780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579141, "uuid": "f138939e-9b82-439e-b27d-0cc788076a55", "comment": "Malware payload (Mirai)", "value": "fb34cdf82484b26279faf030d5e6c71ce18a8f58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579141, "uuid": "6776cf0a-8730-45a0-bab9-0c2c584d35ca", "comment": "Malware payload (Mirai)", "value": "87bc8234a31a8e796d57e263a56804cfdf0bfd40e4ec5a2ecc1b9476abf8d689e30398cbd8c8d987f7e814b0b57a34eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579141, "uuid": "e034e3db-7984-4f13-8440-8cc731fb0b6b", "value": "T13C53FA46FC818A11C5C513BAFA2E118E33136378E2DF72529E106F6477CA96F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579141, "uuid": "cd4a54ad-4d00-4b05-bae0-762ff2e32e5a", "value": "1536:0pnZdQzsIwIKWQAwkiE+o4nZnsapaczKxWRqVcEao3eL9IBiDemlZWk:ISwIOABibo4ZnsNczKxFVCtemlZWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579141, "uuid": "ee52d249-e723-4f39-a32c-045001eb9e3f", "value": 63184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579141, "uuid": "6584022a-1a89-43e1-a097-77b3f6d3fdc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579141, "uuid": "83cb16a5-2aa6-461b-bb6b-1e9df6857bda", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017e0d9d-b360-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588537, "uuid": "f6fca0fa-2ab3-4897-a87a-fd9b384f0e4a", "comment": "Malware payload", "value": "7be9e089375f6b0cfeea8649f520105b", "object_relation": "md5", "Tag": [ { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588537, "uuid": "834a5471-3f6a-477c-9901-5b5da821f179", "comment": "Malware payload", "value": "7fbd49e8a964eb1a065641220dea6230fbae32045d986905fd147f7e00c5b65f", "object_relation": "sha256", "Tag": [ { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588537, "uuid": "f445c09b-38a9-4b46-b75c-c5cf83bb8f8a", "comment": "Malware payload", "value": "52c0e6db0f907989714fb504955b12dfa559fb60", "object_relation": "sha1", "Tag": [ { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588537, "uuid": "95d8539a-0130-4375-a67d-af0ceae5040f", "comment": "Malware payload", "value": "98c568cf67c568a01aef2b3e8df926c678388b4605d3861edb388a40ec2a0f6241cf060efea91aeeae43b59ee7ba169b", "object_relation": "sha3-384", "Tag": [ { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588537, "uuid": "ec4f79b0-a71f-4720-94a8-3fb010aac637", "value": "T12251637BC8A04EA744F97394A8794B53F2B0036F5554398A39BC5B4C1FB68137D86E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588537, "uuid": "ff8430f9-daed-4e8f-b33f-1aa741cac487", "value": "48:GIMs/w1BZBBlZSIOYzovNoCy63IoTaMayjrvoj:ho1nzRzINCwD/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588537, "uuid": "e2276923-38a0-46d1-b072-059176ab6168", "value": 2868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588537, "uuid": "30d58a7a-dcd5-45cd-8a51-1c9002be26a3", "value": "application/json", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588537, "uuid": "b352217c-42a3-40da-8896-581e5a90c29f", "value": "coffeelint.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eceb39-b317-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761557236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557236, "uuid": "7ed26186-fdc1-41fc-81a8-16e1043bedab", "comment": "Malware payload (AgentTesla)", "value": "376809d4de1459576198b40a875a5114", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557236, "uuid": "83f32c9a-5524-4b22-85a6-59422a45eca4", "comment": "Malware payload (AgentTesla)", "value": "7fc90f92f50d98b3bc737f0de1fd17c2f24ae9a72fa2ddbb67c55f8dd73d700d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557236, "uuid": "19b4f7e2-e582-456e-85cc-4c2aa558b7fa", "comment": "Malware payload (AgentTesla)", "value": "8889ce674618564846048cd46d25a8fc051cbed5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557236, "uuid": "9f690c06-55f5-43d4-8ae3-59f8e70861d9", "comment": "Malware payload (AgentTesla)", "value": "3938293c0fdeab1040103dba0bc363d84052d3f0088fc8a36147e39ee4a0cc2d3cf8b6e8312fb0b4a25767de157e1827", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557236, "uuid": "bf495733-53c9-43a3-ba72-6ba5e84acc20", "value": "T1E8D56A3DDE18112ED2B7D23DD1864906E8D84F6F223CAC4651C73E4B685A542B8AB3DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557236, "uuid": "32fd1425-af54-481e-b534-f2e3d591b908", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557236, "uuid": "955913e3-8466-407e-b561-bdb094460ab4", "value": "6144:3FBCIG0+U15EFpT/bpDI3S/7866KKfxwAtYSRY0LxP6:10f3o5KpT/bG3K6BJtYSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557236, "uuid": "de3d8ce9-2a32-4d9f-af32-91c90527a373", "value": 2879488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557236, "uuid": "8fad3b11-3ff9-46c9-b32a-167066c8dc1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557236, "uuid": "d660197a-28ff-455c-93f5-8fc564c7879e", "value": "New_order_23102025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbcebc7-b36c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761593924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593924, "uuid": "70adda80-cbda-4fbf-8652-e4e5687995cf", "comment": "Malware payload", "value": "699b6a5e096451487d42f6f4879d11fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593924, "uuid": "a39e6305-6550-4a3c-8dd9-a0f3d535c268", "comment": "Malware payload", "value": "7fd6604ec49bf1f44b9533b3f2a299e42947353c74a0dea8162f30a112734feb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593924, "uuid": "7ae598ac-7685-43ac-a03c-1d9c60aaf59d", "comment": "Malware payload", "value": "7ad6b2d2d8c16254422095de3fa6a8e81882c190", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761593924, "uuid": "e2b0a736-e17e-46f1-a41f-d7f749d3cbe6", "comment": "Malware payload", "value": "a7e90e8d90264804c0f89d04886f2164ecafe21fe48e4c8452d47b4e7e2df49e85ce827d1329cb3e769dd2ec1baba351", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593924, "uuid": "e8f868e8-19ac-479d-99d1-2e0eef3bbfd8", "value": "T145C08C91843DD433A23E0E5EB281E2F8AA86A4280BE039A1D4298A0065640B00C4F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593924, "uuid": "9b331377-209a-4ddb-b4f7-039ed8a5a94d", "value": "3:WFBIx8sv3uy9Fb+dNMfhibocmEtUHeeymHgmQmk0QQHFxaFOd6HhC:/9vrbsMfh0ocgebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761593924, "uuid": "0307bcfc-e57d-4460-9b15-8784bc570c9a", "value": 169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761593924, "uuid": "024d4917-affb-42e9-982d-8d9e9f9d23a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761593924, "uuid": "16a08cac-7450-453a-8d6d-ed088ce7257c", "value": "3d0gg2zo5w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ed82b2-b345-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577317, "uuid": "68346de1-27e4-4e5a-aecb-830524384a9b", "comment": "Malware payload (Mirai)", "value": "d026f5c540590f4d29e5dd8baf1807d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577317, "uuid": "24267049-813d-4990-80ed-d430cccdd5d4", "comment": "Malware payload (Mirai)", "value": "80033fa8925dcc31f268a822d613060886b2c6faaa765a0920d6151de8332d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577317, "uuid": "ae622dab-e1b6-42c4-ab2f-e5eb7e0fc23f", "comment": "Malware payload (Mirai)", "value": "f7c8c79098950180452c0a31d7fe843563bdc00e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577317, "uuid": "26db6ebc-0907-41d0-9dd1-d1d41747efcc", "comment": "Malware payload (Mirai)", "value": "517e0dd1924e8abf710735d199f81350136177fb39116ec3d2c53257f78b0d22f27862bd9009d33f52862e091648a5e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577317, "uuid": "8a263d10-d2cc-49da-b71b-d13441f70ab1", "value": "T1C1D3F930F904472BC2D227BAE79E468D3F351E97A7D733125A347DB02BE57982E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577317, "uuid": "fcc48458-61b4-40cd-bc58-11ece961af40", "value": "3072:UWfI1cFSlW+eUe52cmfyJKmRj6aQyfLlfF9Nb:1IOSlRm52cm3mRj6aQyfLlfF9Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577317, "uuid": "d42ec327-4be0-4387-83a6-2d28a043fc93", "value": 133183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577317, "uuid": "d57040d3-9215-490e-a4e5-e66ff5b5e87b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577317, "uuid": "2fa1cba3-6e63-4e6a-9771-53ef7d78ca7a", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd50983-b31f-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1761560643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761560643, "uuid": "c906ea3a-d25e-4502-8c09-dfff0f860e8f", "comment": "Malware payload (DarkCloud)", "value": "27f187aa91f0b0fc16de3d8813067921", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761560643, "uuid": "412ee462-1cd9-4d37-b92c-0aa6b8d5fa93", "comment": "Malware payload (DarkCloud)", "value": "80446673564bcd3cb76917d82d05ad8d7b895475e5641bd14930dabae98b6895", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761560643, "uuid": "5dfcbc16-4e2c-46d7-9a5f-05d60fc0da60", "comment": "Malware payload (DarkCloud)", "value": "af048ffdfa31118c8bfb6bab1a4c9c0082c62282", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761560643, "uuid": "295bf21e-2a37-4f37-ac2f-678d896bd0f2", "comment": "Malware payload (DarkCloud)", "value": "55332bf5f164af72eaad2490e2e6aa89a320f635edb8aa482d8358805d00343c363a86e718553db2bd39092fbd685338", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761560643, "uuid": "5da20025-9756-4e50-8f60-513aa43a3dd3", "value": "T12475E891F5A024A29147A6BD90AE054F8F2931EBE9C6901FF19C6BC42F1FD81B5C7E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761560643, "uuid": "70884bdb-b9ec-4b5f-94c7-56bf8d385b60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761560643, "uuid": "92fbf7bb-cd49-4af0-a2bf-3ba0b9d5dfe4", "value": "12288:xTUtoAzHNXc70BxGPGZD52Am2RhSHIp7bGt4w5aYETUiZhxAYMWr/b5HxiqFMEOY:qBHVE0BxGPGZD52Agy1w5NCaW7ES2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761560643, "uuid": "51134864-7516-4c8d-a5a6-0d82fa232775", "value": 1670144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761560643, "uuid": "7f43f877-0da0-4daa-9cda-c2b0f8c42bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761560643, "uuid": "82024f82-e382-4e87-a459-06abe344af6e", "value": "RFQ 15102023 SDX400GB-HG938B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e40021-b314-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761555907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555907, "uuid": "2936b5ff-df5e-42a6-8fe5-5279bfab367d", "comment": "Malware payload (QuasarRAT)", "value": "28f9c04459f2ecac07c84eefb1c90d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555907, "uuid": "b433688a-2095-49a0-9002-f5c0632ed14f", "comment": "Malware payload (QuasarRAT)", "value": "8056a37cd65f2a24c5ddb99843cc744d8f78f7befd95dcd77f9c4c5bfc6f45d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555907, "uuid": "a9416cb7-0e2c-473a-92b7-f0b875ab038d", "comment": "Malware payload (QuasarRAT)", "value": "8f390ab5ad5c89667e90baa71f946be3893d3c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555907, "uuid": "e4903431-a3a9-4de3-aa7c-2be2c5c81fae", "comment": "Malware payload (QuasarRAT)", "value": "e7c34d2faa7a107b43b48f05d80eb6a918a94b896ffc2508f0b5982ea3a6859966060b3ae8fe8560a21c858d8feb50de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555907, "uuid": "d5f59f58-a63c-43a1-894a-a9351ab1a14b", "value": "T133E57B0437F85E72E26BD6B7D5B1501263F0F82AF363EB1B6581A37A1C93B5088416B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555907, "uuid": "6aea6277-e898-4f7e-aa3f-6abdd6a202b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555907, "uuid": "fab78b63-d9b0-4cf8-a59c-6bd2263d6c76", "value": "49152:GvBt62XlaSFNWPjljiFa2RoUYIBTe1LoGlqTHHB72eh2NT:Gvr62XlaSFNWPjljiFXRoUYIheN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761555907, "uuid": "84a2d7dc-3079-47f7-b02f-b314180c7094", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761555907, "uuid": "dda490c1-d1ce-4677-9674-ad18fd440b89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555907, "uuid": "dc6c5c5c-28ab-4abd-95e1-5fb5a53de5a1", "value": "28f9c04459f2ecac07c84eefb1c90d97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161914a4-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579122, "uuid": "6ae68189-84c8-40bc-a353-336fa5f19a10", "comment": "Malware payload (Mirai)", "value": "f6157639ede1b9c6166e9d33fdf1a4c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579122, "uuid": "e1965ff3-e53b-424f-82a9-e420c4d9f0eb", "comment": "Malware payload (Mirai)", "value": "83aafa13e65dc0b1a0ecc3235033f6f03882450e281d41be871c139932125cbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579122, "uuid": "ac3d9ac0-c6e2-4344-9865-8c1968eccb09", "comment": "Malware payload (Mirai)", "value": "97f428764db2857bc1fd8a939ca0532a49f5c704", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579122, "uuid": "ecd36a6c-f9c1-4fa4-8a7a-4fa3630cadc6", "comment": "Malware payload (Mirai)", "value": "27c4baa70ece13ea2d54340353cc6539bf1fe6ea5f0d0da7845d73bf547fbea4ea3486a9d9fbfd4ab75c253b808d5001", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579122, "uuid": "062d5df0-96c2-4854-88c2-f169716a7f06", "value": "T194531855BCE28A12C6D462B6FA2E418D332663E8D1DF3207DD216F1137CA82F0D7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579122, "uuid": "e8c6319a-2cd5-4c11-b4db-99d1af14043b", "value": "1536:hQXM2fd+Z5c6jQFQ3ByIkKVrL2yBCtt5KmWTxx9:h6D+Z5HjBlvYbKmWTxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579122, "uuid": "e2576477-c434-4b75-99ea-c7dba31d9c57", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579122, "uuid": "17477ac7-c806-4f73-b69f-e508761ae491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579122, "uuid": "35845427-0176-41f1-9964-3770ba369c70", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5c5140-b339-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761571966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571966, "uuid": "08b21cc9-4bd8-493b-9b3c-a0e5d7120848", "comment": "Malware payload (a310Logger)", "value": "eae094cbde3b4fa3b421f6a51ab7a251", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571966, "uuid": "5bdaae6b-caaf-4f84-89ec-be26d48378a7", "comment": "Malware payload (a310Logger)", "value": "83cd275cb1b0c6d65b6d79487915fd86d78083782b585e01610e433fc25b73e5", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571966, "uuid": "43bd1759-e6a5-4258-b3dd-a69a871c84dd", "comment": "Malware payload (a310Logger)", "value": "854856e0af156f10804d702e7f367fd29e81cde9", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571966, "uuid": "d5dc3e7a-f1cf-45b4-aa7d-88970d896216", "comment": "Malware payload (a310Logger)", "value": "18a81a2f08846247968c2dafcf6e1734971d61853caa65d302e734fe3333406c5b00cf1de76ac27b0da3afcfcb177e6c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571966, "uuid": "36a7abf8-0f52-44e6-ae14-bf48677263ee", "value": "T1B82522183B16AA03C59597F01BF1F7B293BE7D58A010E29B9EC82CEF79A4F440C15687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571966, "uuid": "79d7e427-74ec-468a-a776-bd6cf66abb88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571966, "uuid": "eba00292-aadb-484e-a7f6-23ab843bb93a", "value": "12288:QcVbQ6VrOnUxQCg473dKsrMFIq8ClJmW+ianvHn7vH168mJuyrd5FEkenhVE6IHp:QchQ+WItKsr5q8+sKaDeNrbFEzAFAJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761571966, "uuid": "4a50e32a-bb44-4132-a2d2-84f2adc7ebc1", "value": 985608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761571966, "uuid": "8718929f-4072-4737-b82c-7d4a4910e10e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571966, "uuid": "f0b22e7b-5805-4608-87ad-0b9a438bc0a8", "value": "CAA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fef7e58-b33e-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761574065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574065, "uuid": "af87c449-d4a4-448c-bc16-c9bb8f546097", "comment": "Malware payload (AsyncRAT)", "value": "082f43de4a688f64b1f211371d07becb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574065, "uuid": "d99e730a-a339-4189-b5d0-a785d90f81e8", "comment": "Malware payload (AsyncRAT)", "value": "85407b2230f3475e9214f3d577bbec0ccc5b53c560f32d8b298fae7b43183020", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574065, "uuid": "ab84a46a-5e1a-462d-92f3-21b2792fe9b0", "comment": "Malware payload (AsyncRAT)", "value": "908c8dc9875ae34f1e8c88a06b23bfd55c5384e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574065, "uuid": "de321548-f3b9-458d-b6f4-bc290b20ef1b", "comment": "Malware payload (AsyncRAT)", "value": "c196d7e67b7c0f24ad2cd0598a7e9b7e062489e416fd779affb78b4db605785e5756c30af197e00f77e580995c9209f4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574065, "uuid": "5e84c9a6-cbdf-44ad-9705-4507f9703d86", "value": "T1A2348E1437D95B6ED3BF9BBCF4A401158772E413A62AC7AF1EC488E91CA3315D940BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574065, "uuid": "3f4018de-08c7-4494-93b6-5363b7525cf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574065, "uuid": "ede2fdc3-0373-4684-bc15-5e53846cc656", "value": "3072:iKSqmHjmKWMCrOij7j2+ZlS5iXt7ndGUbBWhuDtNYthI4kSVsvqh6+WpW:CjpVCrdj2+vShUbcsNAhI4k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761574065, "uuid": "d1615e3a-e975-494f-b1ab-91472d72abc9", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761574065, "uuid": "588f3637-6d14-44b0-9044-91e57075bcf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574065, "uuid": "d9fa4e58-22b4-47d5-a9fd-c9d5e86538ce", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce0aad3-b2fc-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761546009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761546009, "uuid": "8980ac05-aa75-4a45-8668-53e396126b79", "comment": "Malware payload (PureLogsStealer)", "value": "8be2c13f6c3363bc4d1dd5d189ae7c64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761546009, "uuid": "75b4833a-48ad-44ce-a370-214824079b75", "comment": "Malware payload (PureLogsStealer)", "value": "85c55f43b4d41aea1df3e5ac8592cd7f838ac9e657f3070b6b83fb53f63a1cdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761546009, "uuid": "df237c01-8f9c-4624-8948-8959df625b4f", "comment": "Malware payload (PureLogsStealer)", "value": "bfe9711709c97e0efa23e272606e6608b4bdefc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761546009, "uuid": "6a764c07-7a3a-4c42-a5f6-a6816fcd0c90", "comment": "Malware payload (PureLogsStealer)", "value": "4c2349d4af22ec8e92090032097845f29a39ee001f7ecc185692345545796276fc15ba26c3c2da60a5f0f0105dd5d4f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761546009, "uuid": "7503cb31-8058-4175-8f73-f5f207f05b75", "value": "T174163AE0E0B70092F1479E94546CB99E4A7531A3EDCA043D736E7B84CFAFC447686B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761546009, "uuid": "b7a92ebf-7419-4350-b355-f4abe24ab028", "value": "24576:BeBs0dNJktFY/Ad1euEfBc6lDulKZlOlEPTZVsM31w7FpRA4vXjzS0QROl4hLHSi:YB2mD5Jw5NCR7wVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761546009, "uuid": "bea3a37e-9927-472f-9137-a0b31c89f8ce", "value": 4372480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761546009, "uuid": "27e850ac-0bd7-42bc-afe2-58081ef7f0b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761546009, "uuid": "615939d2-a244-409c-bcdf-27738fe2a115", "value": "October payment.ipdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2736d01-b360-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588860, "uuid": "207aa66a-e53f-4a37-900a-6ae02e713871", "comment": "Malware payload", "value": "dd7242a471c73841baaa5b294dbcf797", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588860, "uuid": "c366064e-05c0-4dd4-bd7f-e0a52413c83c", "comment": "Malware payload", "value": "86a6ec3c30e3cb84c9b878136438979a5866f134c5a2799ee8f8d66070272ff7", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588860, "uuid": "13a5f4a2-f5a9-42c2-b5dc-0c5987f8618d", "comment": "Malware payload", "value": "0040bcae8f2e5b9975229b26601b86fdcb542618", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588860, "uuid": "21e4db9f-befb-4424-ad74-4a4760f959aa", "comment": "Malware payload", "value": "dc2985e8c363f637186764bfa0229f4236008b4e90e796188b77a75cf37a364387f97e5804961a5f10666b5ede29c6f6", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588860, "uuid": "aab0523a-0eaa-400e-9783-1bcce26b456e", "value": "T18DE423BD448924C498D760724D13A9FA06BFE7275C6BAF4D026BC86DF7A6FC00194B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588860, "uuid": "12399630-0908-4cf4-97eb-97632dfc7b13", "value": "12288:wy9DEa85nKRLIcSshQxKmik2Nl0oK5zrKgn4dUThCeRHg95A6/6cx24yZG4Q38WR:wN95UIShpmaNl07ug4OT48HS5AExTcGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588860, "uuid": "b5c8a8c7-2bd9-4ae4-825e-50597b19a64e", "value": 710509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588860, "uuid": "3e44a12e-13b6-49f7-aabc-32d4e618091a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588860, "uuid": "bd235754-dd8a-455e-9aec-8df06cc579f8", "value": "(HBL# 2509MAD001) 1573515.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea2c50b-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761588317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588317, "uuid": "322e3f74-a038-4174-a35c-808ec0e53ec2", "comment": "Malware payload (CoinMiner)", "value": "345c78653f07896efd7f1f86772759dd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Miner", "colour": "#525907", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588317, "uuid": "64e31c99-8576-48af-964d-44b1a2a30615", "comment": "Malware payload (CoinMiner)", "value": "8704d1330168fbf09a14c9716c2d279ae8b1cc722f07f44b2ceaede1caba968b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Miner", "colour": "#525907", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588317, "uuid": "749f611a-fc4a-4b0e-9c01-bdd2adb28f94", "comment": "Malware payload (CoinMiner)", "value": "fafb080c05f323192b831eb45e08f6c2fe50ddc6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Miner", "colour": "#525907", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588317, "uuid": "3db30138-97a3-4c46-8200-7f56a177bcb6", "comment": "Malware payload (CoinMiner)", "value": "14c15143e11d237f9204eb98be5e21626a8e9b01bffc865ef60a5343a42df1ae82f11c68a8b543dd7458ab3ee5a6c4dd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Trojan.Miner", "colour": "#525907", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588317, "uuid": "88ed8ae2-19a3-4766-b2a8-03d3d5699c05", "value": "T1CD86D0F311E12B9DC22ED0BEC152B87FAB87F47B2A4571A742163275A723C10F259B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588317, "uuid": "e757e270-52a5-4260-bdaa-8a2e16c98941", "value": "d400a6a867a8623e410a8599e61fe849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588317, "uuid": "9aa1d805-16ec-4c6d-a271-e521eeea5282", "value": "98304:yq6frbQ/Oqxi5Pz5wvTIq3/WbY7/5D7iNOEAR5A2PwbD2U3asere+sOcoO+eqM0P:WDbQ/uPmTIwEY7JGOzA2Pw+U3dvpOR4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588317, "uuid": "4a9827a0-f6a2-4d19-8fd3-3fb3d6029d4c", "value": 7976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588317, "uuid": "1ef71681-8761-4e60-9a49-75e967ede685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588317, "uuid": "7e565b74-bbf6-4cac-b022-853493667fa9", "value": "1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca7bf10-b2c9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761523782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523782, "uuid": "ac8aee60-1f9a-43f1-af2a-e30f3271c8df", "comment": "Malware payload (Mirai)", "value": "da79bc4a9ccd1aacad957db2d1bb2d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523782, "uuid": "c749ec3d-4402-456f-96ab-341a70dae74c", "comment": "Malware payload (Mirai)", "value": "8762dee4bddacfed096e23ad0a7c9ef6b2697c9a89b128d21418c99c5924b93e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523782, "uuid": "2dec0bdb-b456-421e-a3e8-cb8c8da3a63e", "comment": "Malware payload (Mirai)", "value": "85dde016bf09f4e2914edae79655f8148ebed863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523782, "uuid": "39c41d2d-feba-40fd-bf38-754648bfbb2b", "comment": "Malware payload (Mirai)", "value": "1f87bb6fd123f76f8550242ca7273b19a1c8b9a519c874dec42eebf7f6c96f6edd57d7c2cc9d040ae64583c14eb3dfe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523782, "uuid": "91e0a099-4f5c-4672-9340-8337f5fc610a", "value": "T140833A56FD429613C6C0217BFB1E428D7B6717A8D3EA7203DE269F21778A52B0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523782, "uuid": "81057544-12cd-4034-9e44-279ac5e35b12", "value": "1536:2IbSTJ6+4Ov2ti/gllh4YIpSGAg8xNqTbKv9ZMemf:2DJ/4zticbIpS8QtX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761523782, "uuid": "156e0b9e-85a8-4fb5-9250-a7b48204bc62", "value": 86140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761523782, "uuid": "c2071584-2ec5-4d38-8c24-22f1d813d0f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523782, "uuid": "762feebc-54b5-4f0e-b4e3-f2f4e51e5351", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f880728d-b30b-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761552444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761552444, "uuid": "e13e2143-a928-47c0-a9cd-3ebbf71a9551", "comment": "Malware payload (AsyncRAT)", "value": "700849181057105d4e15d1ff029e4f57", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761552444, "uuid": "b500a1a7-09a5-4a5d-87e1-9ac574c565fc", "comment": "Malware payload (AsyncRAT)", "value": "883ae3955a129045c7e3043cf13a743db9d5d3a2e12b30d6563898861a00cb06", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761552444, "uuid": "29310790-71e6-44f5-9209-df838bb7523a", "comment": "Malware payload (AsyncRAT)", "value": "4d3625182c35ee7876395c5d4d096cb39aa7c27a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761552444, "uuid": "66ef0f00-c4e6-4330-9b83-de342408ffc2", "comment": "Malware payload (AsyncRAT)", "value": "b997f948e9dc918021ab21d9d05cd360b5386919f2ec43267b5921dacf5bb11ab2278396ec65b70309a4ac15abbe2c12", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761552444, "uuid": "9336df04-d196-4b9f-ab71-6734ade956d0", "value": "T1ABA401903319D803C5A413F41EF1FA7667787EA8D521D7D69EC9ADEB78AAF009C04287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761552444, "uuid": "8bc34de5-8ff1-45e6-8076-9c1ccbb76469", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761552444, "uuid": "9297dedd-51a2-4506-859b-8eb5a7126227", "value": "12288:XcVbQpSkmLvGi4gwYWHOEroYpMzw+LxL1AXNMTxQpR:XchQUNrXNW/Zkwkh1ye8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761552444, "uuid": "20b137e7-d632-4862-a268-83003be40770", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761552444, "uuid": "26a3f844-9e3d-40a3-860c-0584f56d1016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761552444, "uuid": "04882f69-f532-4149-a536-6fd8a27050f4", "value": "INV0876567890000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6405fa73-b322-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761562073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562073, "uuid": "c8266cc4-ceb7-4131-b39b-e7f6bcdab432", "comment": "Malware payload", "value": "d4a7c5b5ea7362d63b08f9233ca68d6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562073, "uuid": "8c03f112-060d-4e8e-a6cd-bf17aba389ce", "comment": "Malware payload", "value": "88546cc0991bcc05650b2a206e0f601fd61bb970a2182be4eacc0c4f3d1b57d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562073, "uuid": "01002003-838d-4955-ab2a-84878d468936", "comment": "Malware payload", "value": "bc91944a1f27a77818cc1433c873148ef491683c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562073, "uuid": "a69ed25b-6de8-4443-bf59-ff7a18076a62", "comment": "Malware payload", "value": "3f58cb7513efadf234bc1062bce09223f18bbb5048259e1f733ccb211b841ad0bde77889e494a3752f3e49751d771b4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761562073, "uuid": "cb60dda9-f5a6-42f9-b7c7-f42bb37f9cab", "value": "T1D3D30896B881AB21C6D156BBFE1F418E33131BB8E3DA32039D141F6477CB95A0E3E552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761562073, "uuid": "7efe7815-1546-49a2-b02f-1b29a8da5832", "value": "3072:FsyodMhZP9xALtxzm7uOTD/AKeprPO0KXii4gkQ013Gnz5:/odMbF4txzguOf/AK8O0Kyi4h1a5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761562073, "uuid": "2ba5d421-c838-4afb-8878-2ea66ff94b6e", "value": 131832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761562073, "uuid": "305b8883-2e19-4841-8f94-ad76f507f328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761562073, "uuid": "f7c99e0b-f512-440b-a5bc-b29f4168b4e8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb823cc4-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570890, "uuid": "40968ebb-84c9-4cb9-a6db-a7a0ad24e52f", "comment": "Malware payload (Mirai)", "value": "78b441ecc4cfd295707cbcf7d8e5e600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570890, "uuid": "dbe89972-df88-4df3-a345-fbe09e1495fb", "comment": "Malware payload (Mirai)", "value": "8909976bb8fc00db7533fd63b3311f18e4347033a21bc1bd09f0ebcff4d7426a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570890, "uuid": "e5bf4bdf-27b2-4a61-a031-baba3cf41071", "comment": "Malware payload (Mirai)", "value": "75001e57d6c6916b89788988f587fb3728f578c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570890, "uuid": "53f47ff1-4b78-4bd5-8ff7-276aedb96ea8", "comment": "Malware payload (Mirai)", "value": "e16dc97e4c755e938b91eb2aa23eadacc15fe02ac01db278f9c046538ae6f87820e867b921ee136ed211d3b464281ccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570890, "uuid": "a0986375-f42a-4f31-b218-9891091bc594", "value": "T1C563FA96B8818F25C5D5027EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570890, "uuid": "4bb3fcb4-30d5-4ae2-81b2-5468bdbfdc2c", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlpr57uscvIGiojd70k7h:VqVMkWV8PPm9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570890, "uuid": "e2b4edca-cf6a-468c-beda-6b7cff5fad29", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570890, "uuid": "458d1862-3873-4cda-a6cb-c1ca7715ce81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570890, "uuid": "f28f2348-3e29-45d9-bb3a-5f208dea1a2d", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3924a26-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (AMOS)", "timestamp": 1761577669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577669, "uuid": "1f09fb85-8986-4e88-a498-a9be1924f973", "comment": "Malware payload (AMOS)", "value": "91e25557ef5b07db0c7be40d73a88dd7", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577669, "uuid": "8c9856eb-9073-403c-8fb9-e0781bfd7077", "comment": "Malware payload (AMOS)", "value": "892a1e5973db6756bf79479dd48dd10639e50001e2187191da59f596933e4582", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577669, "uuid": "05af6771-18ea-4d32-adb9-2ac90d5c5b39", "comment": "Malware payload (AMOS)", "value": "8d717fc4bb908834f715540a4b02bebffbb5d4a6", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577669, "uuid": "4031b46a-3b58-496e-b07e-8d66d2046e1a", "comment": "Malware payload (AMOS)", "value": "41a0783329c769931f9f27ae3bbb194f944747e241d14765a4440cb877003c00773efd76f5784e63896add2235850dbf", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577669, "uuid": "98adf103-2d1e-4ae5-8752-1b3b19f14240", "value": "T145C08CC1863CC47152390E6EB250E0F4A94768250BA079A1E805CA8020340BC0C0F73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577669, "uuid": "e844a477-fa26-4b12-abb0-13be30fd2f1c", "value": "3:WFBIx8sv3uy9Fb+dNMfSuLsXXOAzLeeymHgmQmk0QQHFxaFOd6HhC:/9vrbsMfSuwbLebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577669, "uuid": "58015db7-abbb-4eae-a3f9-256ef8896dbe", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577669, "uuid": "25fa1a81-a54f-457d-afa9-5d35031b2508", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577669, "uuid": "919e3873-d16a-4a48-8912-769ce2e73add", "value": "c94ka1gjpm.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52efd74-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570826, "uuid": "28926104-0579-4da1-b0ac-c1303cb4fd57", "comment": "Malware payload (Mirai)", "value": "d125ad0982fe576d195dbc41b4fe4380", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570826, "uuid": "9893a510-34a2-4ba1-83b6-28221b4fc5f8", "comment": "Malware payload (Mirai)", "value": "89a02708e33864872168e17dfa9dea3374467abe62fecd8f059f225b2e6c8964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570826, "uuid": "35734512-fd06-4a02-b29a-acb2c6d17fd0", "comment": "Malware payload (Mirai)", "value": "069e44e3c9389c395cc68f9bb48aa1fba8f339e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570826, "uuid": "7cd1d9e6-2ac9-4602-91b3-1bf37705364e", "comment": "Malware payload (Mirai)", "value": "50c1f018db9871400ae0a870cea8ca6c5f6f2b10eb1def3a018107a627c1b17a240df8fe33edcd682cb010bc287c8a1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570826, "uuid": "759edb47-a9ed-4126-a377-28f6fb7ee596", "value": "T15E23F1D3414B5EF5C62068BAEA80D7C315E1AE7FE3D36953B810467C6AD4A832F85A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570826, "uuid": "13192d2b-d014-4bba-a17e-5a143f18a716", "value": "768:D/TYCoIxdECrqkQG+oOhbQdKecFAMk1FRNVxI9q3UELbUXfi6nVMQHI4vcGpvl:DECFVqkdvOhqcFAMQTLLRQZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570826, "uuid": "36e8544e-90a9-4daa-ae77-d112660b8a05", "value": 46632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570826, "uuid": "888f525a-0463-4680-8f7b-f2f74c65b481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570826, "uuid": "0250ccfc-532d-4445-b2b4-fbdf619e1f47", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065dc15d-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607013, "uuid": "759a1211-d420-4dc6-916c-8e66544007d1", "comment": "Malware payload (Mirai)", "value": "193c560df7e08308f61ad29684be7af8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607013, "uuid": "b7b874ce-0234-4c77-8941-5b136101b39a", "comment": "Malware payload (Mirai)", "value": "8a37d57cfec23b1596419fc8f938d190bcf0e39a93b2510ae29c8e33aeb01536", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607013, "uuid": "1f530f4a-3bc8-4a25-b68a-16eaa6923891", "comment": "Malware payload (Mirai)", "value": "66cef3d5ae55a5408542fb660e59c35177eb82ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607013, "uuid": "07395e65-b9b6-4388-a11a-381202028312", "comment": "Malware payload (Mirai)", "value": "001617bf36ed4dfcf183bff7f95d70334a2d122bba0412c4378c07dfe5731eca37747aef2cc8e975196792b952c725fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607013, "uuid": "5fadda43-cd62-4106-8a69-d9b708fa6f9e", "value": "T106E329C7F900DEFAF80AE33748570905B630BBE115921B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607013, "uuid": "d65be9ad-4359-40a0-b1f6-e444d89cd983", "value": "3072:GmzTDH86Jo781q5lZjApqGidS8w9aeVvjbieL/VCyIOH8un:G2TDH86JWPjApq3du9a4LcyIrun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607013, "uuid": "da749aee-fcec-44c5-b177-6a02c5d73f21", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607013, "uuid": "19688de5-ccac-4a6a-9854-ec10798dc0a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607013, "uuid": "42389e1d-5bf1-4375-8947-031760ae5903", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03499341-b339-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761571789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571789, "uuid": "8829e57b-b233-4d3c-8c98-682eef6e7859", "comment": "Malware payload (CoinMiner)", "value": "b36f23337d6dac7421cd0bdf7f8d769c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571789, "uuid": "5d79d2a0-7774-4600-86b8-e4abccfa41eb", "comment": "Malware payload (CoinMiner)", "value": "8ac7bf6ead6c0068502f6473f7377239cdc44c6af728d5952500b8d5ae0ff157", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571789, "uuid": "239a189a-d0c5-412a-a9fb-fd75a8885c72", "comment": "Malware payload (CoinMiner)", "value": "a0df5bf04cfe53007bfdc6fcde7a56f1780b0b47", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571789, "uuid": "980ced44-2128-49da-b001-0058d176fcf9", "comment": "Malware payload (CoinMiner)", "value": "add90866b94473566aee026de2abba7bae21924c78a0010cd46b004bc12f9e8151243d233bea32e0ca3864af263a7856", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571789, "uuid": "8a587bc3-071c-427b-a4af-2e85ce91df45", "value": "T199222B1BBD8A4171D3E008F007B986CF867E1873278121EFB773D59D1EB4355A0666BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571789, "uuid": "188ce007-5a4c-44da-bb13-0584bba05cca", "value": "9db3169f0849392a7cd91364b6f1368b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571789, "uuid": "a0b5f28b-f542-451d-9e23-bb6055ca4899", "value": "96:lwOeGQyYLYBOZMdkwDysZ+Z8zVcjq3lVQFJxGE9b+z2FFhRC7tCEwr:qPyaYBO18Z+C3gFJxTZ+zmFhyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761571789, "uuid": "554566a6-3064-439c-9d0f-de836bb41088", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761571789, "uuid": "37bc34d7-26cd-473e-8cb8-8c704ba17c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571789, "uuid": "dbe657ce-7d9b-48f5-b33a-2b1f10d4b783", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffa0feb-b358-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761585420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585420, "uuid": "db22be9e-0dd6-4004-9ea6-13f2c9cd408d", "comment": "Malware payload", "value": "c7dba1d20adf22185da619c042ebc808", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585420, "uuid": "2522b412-4be3-4e39-aad0-bea9df6d221a", "comment": "Malware payload", "value": "8bdf562ad0a122751e7018209a9560aa3458a05f876d857bcf2c9d3ad935540c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585420, "uuid": "0f3c6181-432a-464d-8d3a-4fa55513491d", "comment": "Malware payload", "value": "0074acbae818652b02daec90b434eb247fb0d749", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585420, "uuid": "16087e32-b70a-4ff7-a2bc-37b445c7d342", "comment": "Malware payload", "value": "149190bade039d0e435a9ec729f94d0fc4b29eb94836db27ffe5bf94147e27c5f9dd1b8c1e5b00aabd07c789f30e36cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585420, "uuid": "20778e18-7dc0-4605-bd45-e89a9254dd83", "value": "T1F3B164CC3DC970B44B2661271D6EA816F55BEC41B80C897CE230F6A47EE17289A6F5F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585420, "uuid": "e408f44a-cec9-4342-94b5-c0195ab193cd", "value": "96:GDePivjPdDXCwMktNrUM5QT8UvXzImqn5JgM6nyQ:SIs7M2xbQImqDW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585420, "uuid": "dde39d34-d8a9-406d-939b-b78776dc19d5", "value": 5436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585420, "uuid": "6e07fe4c-620b-49f2-9294-b726174d0eed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585420, "uuid": "6f5ebd9d-a494-40fa-bcde-7aee826435a4", "value": "Payment Slip.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e00b38-b33d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1761573830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573830, "uuid": "7b96cdcc-6372-451e-b242-edc590daa597", "comment": "Malware payload (Adware.Neoreklami)", "value": "b8a44122f7eca1357a3c8bd313004e00", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573830, "uuid": "2372ab12-7468-44cb-b74c-7adf42b04fc3", "comment": "Malware payload (Adware.Neoreklami)", "value": "8cbf1acffdf3e1a8f54e3538ffb5371834b6bb95c098e3945c709110cc215294", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573830, "uuid": "bb08b989-48dd-4ced-8aed-b4d5396e5d18", "comment": "Malware payload (Adware.Neoreklami)", "value": "92f81034f7da2308b8ae303e37cdbccfdc5016cd", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573830, "uuid": "9e79fd97-ad5f-46f9-964c-3fba10746ca8", "comment": "Malware payload (Adware.Neoreklami)", "value": "082b989e559f4b2f66c03a647d2430fabfa02fdfd5f1414395a39fbd5b1b270226a13fe9b754c2c135f564ead7a2e295", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573830, "uuid": "aa354ce6-1dce-4e60-8611-f373819cfa21", "value": "T1C976335378FA0C7AD0161B324DFEAFACE395A1606D30609F1B16568F5FBE158C42A237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573830, "uuid": "d9544438-212a-4eee-bad9-55e3328c7688", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573830, "uuid": "3653533d-568c-4c43-bc4d-df8d8acea49d", "value": "196608:91O0/2PJbsCZ03Ud3rJS2YR/KfXP59yK4LEWA83Q:3OJJbZEUFrJSb/E/gLEWA83Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761573830, "uuid": "9191ab4e-456c-4abe-b268-4b0ad937f778", "value": 7589587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761573830, "uuid": "a7fcf4f5-4139-41d6-b368-7448f8c28029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573830, "uuid": "bb089b8b-9629-42e7-9b43-71f54bebc3b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10fa235-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588402, "uuid": "1e4acd86-a14c-4025-960f-ad8942345f88", "comment": "Malware payload", "value": "b162efa138a135c2cd34d602cdc3a5fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588402, "uuid": "2e35ff48-db8c-4e3f-b51d-583c16d22cfd", "comment": "Malware payload", "value": "8cd04fa9eb571435a3179c0953c99156f686bbb715b1535497916d563a1c429d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588402, "uuid": "7146804f-e427-4dee-a8d3-15d86f07b7bc", "comment": "Malware payload", "value": "f4e4dac6912f2152144e7c302bdcd436388f23ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588402, "uuid": "874e1c8f-3bcb-4ae2-8dda-9a2ebb701aac", "comment": "Malware payload", "value": "b53313d1fd05a8c55528fc004cb5c51f3b8646d84e402c107f13fd0604d494bf92ad2d42560240df65f40af31f41c98d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588402, "uuid": "428b3776-63d1-4bff-97af-0fca990ab357", "value": "T1ED031BA0CA6FB0A6FBD5D82A01AFF6EA5BF5F2530DC4461741F929C44F427D02E8991C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588402, "uuid": "0e39f238-23ef-49ae-9d32-ef73b9dcb1fb", "value": "768:TiskulY/lV/kostnbHIN+Q6NpRV68Nk8pU5o3+oyOMh5gJwG22fG1cPfd:TKaE0pRBFU5o3D0hQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588402, "uuid": "d6c830bb-3b85-458c-90b8-3cc141dc04e9", "value": 37909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588402, "uuid": "4df196b0-913d-4708-8747-35f79b579327", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588402, "uuid": "a4937f94-5a31-4b99-8a7d-54402efaa5de", "value": ".sambox.cache", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61543080-b33e-11f0-91c6-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1761574095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574095, "uuid": "6e872de0-1066-4a90-b75d-101c0d83d8b7", "comment": "Malware payload (BlankGrabber)", "value": "f55dc575561f7d038bbee768e446c0e9", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574095, "uuid": "df60cedc-bc88-459c-bc4a-f5f286fc8c54", "comment": "Malware payload (BlankGrabber)", "value": "8ce11f996bb549459edf3a1cb9c53c8c03e3ebf7d1f0d1be16aefe1c4ba2e76e", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574095, "uuid": "9b71fdb2-ebaa-42ca-8a83-4858f8d2af59", "comment": "Malware payload (BlankGrabber)", "value": "0a3937258ecceb70cab9748bf60798d907416ea7", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574095, "uuid": "043b2119-e3ff-44c4-888b-7affd3b8b8dd", "comment": "Malware payload (BlankGrabber)", "value": "f64f269db7c819ed3da10ee37375248bb73be2c175768dca57401bccaed879e51de5c4d64aa761477c940660ed32b06a", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574095, "uuid": "f9b4f666-eba6-4315-a3f0-c63c3daf6e31", "value": "T1A7B6332572E008F2F6A369BDC4819855D671B8260B60CADF47A847B92F179D04E3BF7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574095, "uuid": "39614f7f-945c-4b4d-8501-96fc718759ee", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574095, "uuid": "c429a0df-3c99-42f0-9b99-e14fb0d1b1e3", "value": "196608:D0rVAvA7xjwxi66HQhRYJRjlmwRq4/WRLeNTfm/pf+xk4dWRPoPAW3M3li:KmvYxjwPrYJRjckWCy/pWu4kRPoPAmW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761574095, "uuid": "72698a5f-832a-4574-b0f4-2a08e5ff68be", "value": 10511960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761574095, "uuid": "ab0fbe36-2a03-40bf-ac6c-a3e717895985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574095, "uuid": "a531abfa-4f13-47ed-8343-0a66f033d9ae", "value": "Exits.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918c2a41-b361-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761589208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589208, "uuid": "34344168-12c3-43a2-b4ac-84d69a76f759", "comment": "Malware payload", "value": "1f3c1b37a566b333bcf9392e77f8ea97", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589208, "uuid": "6f3b428f-b318-4395-a7d1-cfedb81153c8", "comment": "Malware payload", "value": "8d2bc4027e48d54a4864eab54e969617bd224830451fbc1a1f5929791f76a753", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589208, "uuid": "583f48e7-a56e-4178-bc26-c8e0d99d6c30", "comment": "Malware payload", "value": "aca95bf1de4d7941d3437d6e0e22e750624afa45", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589208, "uuid": "8e709891-6eb1-4358-9573-7bb21754e190", "comment": "Malware payload", "value": "14e01c616f35d8408065e1e104f24590f7ca31a68abca3efce8d8269dd3382f98870f1fc0007719eb6bc4e6afc36300d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589208, "uuid": "1e655b2d-00e2-483d-81e0-60d832c20273", "value": "T17883BE0C543DFD4E3A6BCB16D19DB594AEC018BFEA780943197C0E54CF644EAA273AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589208, "uuid": "5f68617a-426b-4b06-b7e8-c144a96bfb04", "value": "1536:4tvIv1v3v+v3v3vpv3v3vIvLv3v6vIv3vIv1v3v+vRv3v+v3v3vpv3v3vpvIv3vn:4tvIv1v3v+v3v3vpv3v3vIvLv3v6vIvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761589208, "uuid": "eb6e31f8-172c-455c-b96c-ed2cf7ba71c7", "value": 85874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761589208, "uuid": "8aafc9ef-363f-4567-8ae5-527f0da7c065", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589208, "uuid": "0b8e0dbb-07ee-4c01-a01e-1b50df961b30", "value": "262_b2539c-52a6f6b0-262.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7606072-b2d9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761530860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761530860, "uuid": "5f413938-e2d1-41d5-aa8b-3ef3bb07fade", "comment": "Malware payload", "value": "9a6c82f3e36e47b1afb726e75b5d3a8a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761530860, "uuid": "bea46d45-e781-47b5-b6c5-42909e0d1a90", "comment": "Malware payload", "value": "919cfcc005d2e5059dfc35b0322f3e50453ac8207b5585400bd5ba1cda0218d2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761530860, "uuid": "e3ef4e81-247a-4e6f-ac38-eb98db7c986b", "comment": "Malware payload", "value": "795bd8da52f0cda7c504cc6b78e69b0f5180edd1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761530860, "uuid": "0aad61a8-6f41-4944-97c6-3e71d1faeb3f", "comment": "Malware payload", "value": "457367806bfd9b3ca6b3497022f50c94b6435f581586457d8d6d3ce71353e47b9da76f617f8effd85272c1c434a52def", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761530860, "uuid": "0380c9d7-7dab-4c1a-a798-6486e8416774", "value": "T17A91F87177C6706D9BE410EAA17B9768723E9214340B4073D7BDFCD63C21A8B4096F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761530860, "uuid": "b4403c85-3cba-43e8-8a2b-415e2a91ea5e", "value": "96:nItDJYtoAJS8ffKH1NPIX4rDIcQ0ucq4o5nZHI3ED5upRI7BmaL:IVJYtoA1ffqzr/IcQ0ybxD1oaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761530860, "uuid": "dbc38d91-327d-473b-9c6b-bdb166d88470", "value": 4532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761530860, "uuid": "c0ff5fb8-29e9-4d90-94e8-3fa59d7387d5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761530860, "uuid": "863716d2-bd5c-4782-8ab6-86ebb8d5c4ad", "value": "seemybestthingsgivenmegreatthings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348ad65e-b360-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588622, "uuid": "1520130e-5f6d-42cb-b80b-5bf95b6e49d0", "comment": "Malware payload", "value": "0727165a1fad09ec53d56361c58325ed", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588622, "uuid": "95ddbbb1-0057-45e0-9935-c6f57e5f3331", "comment": "Malware payload", "value": "91f1a517e0bfb2dbc010554d8cbb462f33ecc5264fbc7d1994f7da741e8da3d6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588622, "uuid": "3d7b5486-ee04-4dbf-9e3f-338deffad7d7", "comment": "Malware payload", "value": "b217e64ba821c0cc54a73518d5a5260b45877b68", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588622, "uuid": "d0ec2b71-e1b1-4a7a-ae70-13618b292e31", "comment": "Malware payload", "value": "c1c69d7481d7fdbaaba0288bd96c6df10d6c87c6c1a227e04c7f6038c99fb7d27a345ef8f249419b25facd76c6dd21e3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588622, "uuid": "deae46ff-0944-40f1-9983-9b0210be0b0c", "value": "T1650633BC2AB6BCB6F24F851661FD4A4E8F1144BC36075A709CF814F99DB2BB0A4C505E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588622, "uuid": "11e712ef-4912-48e4-912e-2829216f1e7b", "value": "98304:HKs1uzled3vEwDURY4N/v2eLWhheEYXtmuwiVeGBR:qxg/ERY4NnLShYXtmuwi9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588622, "uuid": "491d0a85-0b9c-4b7c-aec4-d707c785fb1a", "value": 3759806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588622, "uuid": "eef8eebc-cf94-4ebf-8c48-996881749ffc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588622, "uuid": "ac08c364-ea55-4943-83d6-2f27e151c4ef", "value": "PO24S1458.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe588ff-b33e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1761574334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574334, "uuid": "df447695-bb8d-4165-a47e-9dc9bc8b7aed", "comment": "Malware payload (Phorpiex)", "value": "e15920e4e4d968e5372e0c33d98e9bb6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574334, "uuid": "862c9f2f-5761-4dbf-8d29-b4a89b6ec1d3", "comment": "Malware payload (Phorpiex)", "value": "926e7a5fc2df14280ddb9fad2a6a3a8101c4024cbce128f9feacb0f0c1e2070e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574334, "uuid": "d2e454d9-02bd-43f1-9e31-06f389238321", "comment": "Malware payload (Phorpiex)", "value": "7a76e9b5300ecd6b4f81a168880e31e1994d3ec5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574334, "uuid": "b5e22bfd-5713-4a4f-997e-5dadf2189a4a", "comment": "Malware payload (Phorpiex)", "value": "ecc2da5f1f5180c0d208327bd068864ef0c498adc5a27a4bfb4e2b8b11caf9a95ffeb5982a6038554e82f580929b4b23", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574334, "uuid": "ffa2ac41-a22e-4960-8f89-e25ce3d90d76", "value": "T13C833901F5D0A07BF9FA41FBD2F24E69582CBFB4134948E39290655B97246EABC3502B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574334, "uuid": "1b12d302-fe6f-4aec-9588-a00c8d2dbe20", "value": "cd8f53456e8eab6877bd6db17a9de950", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574334, "uuid": "d58ec4ac-346d-4d77-ae2b-825e7e6d74f9", "value": "1536:0wAxGlNFmav82iG/78+E+Tsvg49hICuFC2lnwq:rAoQOB/78+Nq9/ICwC2Zwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761574334, "uuid": "f1b931d0-2fde-4198-ad85-f8a0c172d83a", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761574334, "uuid": "cc6216de-1e84-47a4-a0d4-fa0eaac06205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574334, "uuid": "7f960cfb-1c69-44a6-8387-3f7253f3f889", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ae96c0-b2f1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761541183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541183, "uuid": "b23cfd33-6150-4849-81cc-539d0084c5ac", "comment": "Malware payload (Mirai)", "value": "940556467b35e213e9008f74aece702c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541183, "uuid": "0d458e8e-b14f-48e2-be38-a1ea9ffdf92d", "comment": "Malware payload (Mirai)", "value": "930a6c9530771318c28cd3d954d25ca06d5c851220250fb3c3e5ccf66b19b8de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541183, "uuid": "c890ce63-0687-4515-bf5b-8b3cfe6a26a5", "comment": "Malware payload (Mirai)", "value": "ce25b896707007b23d0d63542bb173b80448e79a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761541183, "uuid": "e556217c-b33c-4d6e-803a-f02925da1558", "comment": "Malware payload (Mirai)", "value": "964d6733eba8f15f8774f9e36b1c5288b4cb4269d163d0a382997216de806e55d22a800c4c8057bba0b870e932acd962", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541183, "uuid": "cf42939a-2bd4-4d4d-932d-1109e51aaa21", "value": "T1EB333A02957C1A2BC4D0A77311A74363F2FA2B5541D4E68FBD760C4FEE983502ABB6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541183, "uuid": "67f4d49f-530d-427e-9384-1393d37ed7b8", "value": "768:WdoXL889wsGBaU6bhlBlLKUo7uVW26lKGpa2FgxdWSRIzV4GMIZ/Tfi:WdiLnqs2Ub/BlLKNHlKGkDxdbIKsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761541183, "uuid": "7ef0443a-a090-4448-86f1-e8f504ba27bc", "value": 53820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761541183, "uuid": "e4926f0a-4e4a-4696-8d0c-ce644fe9cab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761541183, "uuid": "2b4147ee-9e58-4963-a414-60af29b08e3a", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c15d0cf-b369-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1761592474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592474, "uuid": "30e40b07-f768-4f2a-9293-94b91af56933", "comment": "Malware payload (Gh0stRAT)", "value": "45c60ac4e0cae2e9b2b7091658a7f640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592474, "uuid": "bf051520-2774-4654-b513-1b10f2a971cd", "comment": "Malware payload (Gh0stRAT)", "value": "930e562f42725f8159b3c1898dbb75a57659e11fe0c730a96ecd5ec69227f450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592474, "uuid": "7aa801a7-5fe1-4c55-8054-39fc1f0cd6be", "comment": "Malware payload (Gh0stRAT)", "value": "2a2c4d8173376023a841d71292571965a9c5cfab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592474, "uuid": "ef1e4d52-23c8-407a-960c-70b25a0eb162", "comment": "Malware payload (Gh0stRAT)", "value": "879e0c85d13fa60535f9d97fc150a2fe36e768ad558a6a09298fb92c8902b85e812733e9066080c7a7b2f67647b5e76f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592474, "uuid": "de3467c7-d827-45e0-8c8f-50c79dade152", "value": "T1C1E6232BF6EBA13FE06A053A4A73D212543BBB6169024C6697EC785CCF252D01D3F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592474, "uuid": "cc0f4f2a-9361-4b58-8625-cc7806f5dafa", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592474, "uuid": "46e9e07d-85c7-460f-92fe-d3ef9211a919", "value": "393216:8wbPMDxiB5sxDZ6OFeGaogAuFRGH4nrFhMuVHk:/LMDxA5MdFJ78YHuZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592474, "uuid": "7b550553-b2aa-4e6d-9cf0-26fdad0df190", "value": 14670244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592474, "uuid": "e10f6c3e-caaf-4056-a5b9-820dedafbccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592474, "uuid": "75ec2fa4-c258-4b13-9fed-606ed8ff24fe", "value": "CoD4x_21_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c13bdb-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579142, "uuid": "0d08dd69-b194-4f81-80a9-71078ed09dcd", "comment": "Malware payload (Mirai)", "value": "c278daf43d234f58482ac73c0c4f81ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579142, "uuid": "69f45fbf-603c-4c56-a338-20d67b269426", "comment": "Malware payload (Mirai)", "value": "939823fead9e7f54d3e4d0bf410ba647c2d8a15af52f8a07c29aa68df13f77c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579142, "uuid": "cde3aad3-bfe5-436e-9333-b6795cfa9864", "comment": "Malware payload (Mirai)", "value": "c09c8504e75d03fcf7bec6a544b9508b87cc41d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579142, "uuid": "d3760bd7-c02d-48f1-908d-bf5164273e67", "comment": "Malware payload (Mirai)", "value": "d06503639dc1dcd7ca4009ed65bd7ff4655f5e88a877c8ac136a53d48001c09d30d5f768bab724dc009916dfb5bdb013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579142, "uuid": "406989df-2fa3-4b2b-9352-5d1a6776eeae", "value": "T13784E11AF20B3D83C9DBD935158AC2459796E89B33F383063B46A5B738292778F38745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579142, "uuid": "1622b800-265a-41ef-bae4-3c0929ac76c1", "value": "6144:l7fDAmyraaBtJqLITQLFKMCkw77UrldG+Z6/O5FDmcvnGI8prZRyB:1fpUtQL1UHka7o7mOmcvn98prZRyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579142, "uuid": "dd279b38-01c8-496b-a132-a1dd332f1ddb", "value": 399344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579142, "uuid": "d80588fd-8954-450c-9056-5d3c2cb02974", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579142, "uuid": "a9364acd-2f9f-491b-958c-c8adaf5fb132", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30eb4737-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761588187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588187, "uuid": "850371cd-c4a3-45d2-8269-e0103005649e", "comment": "Malware payload (AsyncRAT)", "value": "fb723822420261a9c545c0150ebd4d30", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588187, "uuid": "17a697f1-30e3-4130-9fe7-0feee8b56e26", "comment": "Malware payload (AsyncRAT)", "value": "94ed112cb1f9ffe831906c83e02799a252b9f7b0116502550c1753ad12c23630", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588187, "uuid": "d25e3383-33b4-49f9-8332-c6e34df38d79", "comment": "Malware payload (AsyncRAT)", "value": "d5ed516581663779b2e9d9c608ad315e78d8da43", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588187, "uuid": "6b4ed950-1266-4231-973c-da91a6709cb7", "comment": "Malware payload (AsyncRAT)", "value": "6e0579cf71187a6ac29f99025f6f157b68e78245df1496b5bac2daa0e0ea08cf4c9262fd30c64a509b05851d08da1e0d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588187, "uuid": "6ebbd54d-372d-4846-8f78-12f557954186", "value": "T147F23B49B7904222CAEE6FF06EF371094275F5078923E75F5CC48A9A7F279C18A107E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588187, "uuid": "52885d28-9127-4f39-a3be-66ff03f5682b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588187, "uuid": "35c4f1f8-13d8-4291-97e6-51bb20237d3d", "value": "384:WLxpXSqGWjxaAiQcamYpnnGnRLGVYCwvHixdTXgVR8pkFTBLTIZwYGDcvw9Ikui/:iXNcaZodYYC4CIV9FZ9jMOjhP/ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588187, "uuid": "c3bb2c68-a65e-4f9e-8a85-d1d1e4a5b240", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588187, "uuid": "e7894544-a1f0-4d92-8ede-49c4be0dacf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588187, "uuid": "5d27c661-1728-445b-8d21-d144b337db8a", "value": "3client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661fdc64-b348-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761578398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578398, "uuid": "7c3df0c3-a523-4f38-aa83-b1f711b40a27", "comment": "Malware payload (CoinMiner)", "value": "083d5895283755a910b5c59d60a5348b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578398, "uuid": "c969e8b1-0d73-4ffe-a16a-df95336583d0", "comment": "Malware payload (CoinMiner)", "value": "9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578398, "uuid": "a469a3f9-03e5-49f0-8e35-7e378292ee57", "comment": "Malware payload (CoinMiner)", "value": "0d94bf4d0418061907ff7977e3f25a463cb25188", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761578398, "uuid": "f0562eb4-548b-439a-bbdf-716c236b62a3", "comment": "Malware payload (CoinMiner)", "value": "46f4df8046db7832afeb802c0e977a63d5872fc18398ede964ba03e77f79e67d7140b4ef684d00c9a3f7c00587422e80", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578398, "uuid": "3186c03e-f7c8-4dcc-8eb8-21a73ca24964", "value": "T188660246297FA774A367A3848BD1E5739AAF4639FE55853036233CEB9F1049400B0EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578398, "uuid": "e4337dc3-12e2-4e0b-a4e6-b617c3018aaa", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578398, "uuid": "a02cffa8-9765-4e99-8869-93637d13db86", "value": "196608:Od8aiP1kVGff0MYA9ZHP6mJhimlsM0sH86TTS6k:OWlMyhJDse/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761578398, "uuid": "0c4c836e-ccaf-4ca5-b9f7-8eae06206d3e", "value": 7084544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761578398, "uuid": "ab8a98d4-2abc-48d8-826b-aaeadc837265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761578398, "uuid": "ef3fc403-1da1-4e05-9265-d1c73558cfef", "value": "SecuriteInfo.com.Trojan.Siggen31.52010.17319.24484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c551c0-b34e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761580862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580862, "uuid": "cfc6aaf4-5446-41e7-baf9-b0cde7d7cb59", "comment": "Malware payload", "value": "cde5705e401a2a4922ae997f8472d02d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580862, "uuid": "e2faa7f9-12ab-4d0f-bd38-c76e3899b267", "comment": "Malware payload", "value": "9681db9fd286f0115787520ed0d9578f10234af76a5ed1435eb8718664d7128e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580862, "uuid": "014600d2-b75d-4b79-b692-ecdd077fc137", "comment": "Malware payload", "value": "8925e831bf52212cde549e6f13735fc96b24946c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580862, "uuid": "496dae2d-f775-4ffa-92cf-3c8e9e22db67", "comment": "Malware payload", "value": "bd865cae95de7a1586c6d7b3914db3c530264935105a9ca05e77cca58849efee6912ed415418c44bba2ecb9f61dcab30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580862, "uuid": "17e89d7b-d370-47d5-87f2-c60978480620", "value": "T1D0F69D15E3E50A61D02BD638CA62CF33CBB5BC525732D50F354DE2892F73A618A6B721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580862, "uuid": "02344960-a875-4e73-bb6d-3497642967a2", "value": "ebc4074459625c0e275e62116d8e6a53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580862, "uuid": "ed167118-e7ff-44e5-bf3c-0deb8ab9451c", "value": "393216:Tw+z7h+YemLjbxQI+9ZlsMr/ltts1/gQuU139XU3HI6:O8IQuU139E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761580862, "uuid": "59874b36-9c31-48c1-aa2f-8bf8b8e69e10", "value": 15797248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761580862, "uuid": "08e545ca-e5ff-4357-bbcc-3ab5e378e6cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580862, "uuid": "71078e21-92f9-45b9-a1f5-876eaca4f5ef", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2c2fc3-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577923, "uuid": "1d4799af-3177-4973-9818-970c5be1a8ba", "comment": "Malware payload (Mirai)", "value": "8069cbedcf22f3f6ed4ba0d0af46a548", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577923, "uuid": "ee52af75-3761-452e-921c-10109e7da222", "comment": "Malware payload (Mirai)", "value": "9700e206c168dd46dca123c0459ecd9c3255e6fadfae2c9f4edcea22dc37d43d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577923, "uuid": "5da32d22-e6de-4d3a-a351-308b52663c76", "comment": "Malware payload (Mirai)", "value": "104adcb067993052f253cde46defba52b8ae9c44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577923, "uuid": "e38c9dec-a286-4cb6-b832-c42612463081", "comment": "Malware payload (Mirai)", "value": "0bfea13f483a3a70666c922e1070e175488e327ef0c80a5621136c68347530dd7641e78d644909c81a2af76da5350638", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577923, "uuid": "d024c4fd-66a0-41ad-b6c2-324484a1e03a", "value": "T160F2E13FD9059B8CE96684FE52E01FD56F27882174DBBC10885303D38F9A2A871D16EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577923, "uuid": "1f395a04-ba07-4a5d-abfc-68b76f86eb58", "value": "768:5Fl08/3LKuB//SzinliN/k21EfQMx2W2QnFHVNMh3CQZBRSKXhJgGlzDp+kO+E:5Fi8/DV/0iEcf1MW2QnHNMh3B1lzVkWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577923, "uuid": "c6c3fd63-8581-4828-a57e-c83ca72e8890", "value": 37332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577923, "uuid": "9792a99c-ecb8-49fc-8957-0277070f73b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577923, "uuid": "dbe0e3c8-e855-4430-ad2f-dde83005f6ad", "value": "kvm.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cc1a14-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577431, "uuid": "c9c1dbed-2090-4ab4-ab18-14de2d4b8844", "comment": "Malware payload (Mirai)", "value": "38f846201a90e6689fa71ced81ea41e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577431, "uuid": "6dfff564-d718-40e9-b927-3148bb1cd81a", "comment": "Malware payload (Mirai)", "value": "979ba5760d19b46e9af4f80c13e8b60f9c52ef0cc131d8596231300d620eff00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577431, "uuid": "cd83242a-ee3f-4221-bce4-6f83d8d0e0ab", "comment": "Malware payload (Mirai)", "value": "ba5029d80d166b14ec044cd289c5a6ec3b7f06db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577431, "uuid": "ee991c47-eadd-4512-bce0-d31bed7b25c8", "comment": "Malware payload (Mirai)", "value": "cc12db9f864d133553c132bd0f67660558b959c6f5c08f9eb8c84738a40ce30aa840459eb98dab3a391291677559308b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577431, "uuid": "4903707e-fe69-468e-ab91-16ecc5de6749", "value": "T12BC31977A61C0783C49B55F03CA73BF18F69BEB312D61184A209BED41B72AF12522F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577431, "uuid": "88a285fb-0ae4-443a-8e19-dd965ef4eedb", "value": "3072:OJvK1YrOqmoThXSG3vqZmPWmqYQcuLwHnFSNb:OJvKyrjm4hXSwvYmqYQcuLwHnFSNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577431, "uuid": "e5b3a075-c495-4b45-a7e8-8ac02d31b4b2", "value": 121095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577431, "uuid": "845f0cce-eb9d-4385-a8e2-e922e6b5a369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577431, "uuid": "e0046e0f-60bc-49cf-871e-8806fe1e2c85", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231eff5f-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579144, "uuid": "b39d3e02-4894-4754-a833-e38add90f3a3", "comment": "Malware payload (Mirai)", "value": "fdd4763b139f13e00ca2e7427d8b74ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579144, "uuid": "bdab38f8-ecc6-4919-aacc-9fd13ac170ae", "comment": "Malware payload (Mirai)", "value": "98053c07929537797e86a37a6c40d6c35ce7a7adec54a7782078045cce4c39a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579144, "uuid": "b0a46c41-9ac0-4886-b683-26e5081b2750", "comment": "Malware payload (Mirai)", "value": "60ef35dfde9f22a001723a9dc2b1196ff1fbf9c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579144, "uuid": "b4b47f0d-f9ac-4914-a2d9-d94974c2c9f1", "comment": "Malware payload (Mirai)", "value": "7e4d15d530f45d3fa470c18d3ca2c7507a35de7f752c07d423955db519d83ac5674f6cefcdc5d9430f9563068ca6e698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579144, "uuid": "74f27fbc-a21e-426b-b56a-ec338aa9a428", "value": "T13B335B22A9791E2BC0D0F87A62F7C728B2F5070E25A88B4E7D620E4EFF215D0555B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579144, "uuid": "12ea49a7-3335-4bd9-9c2a-6bb9b953a8f4", "value": "768:M7U+SjoPq9Wsc1eINhO5Du3dt714quLZuO+hhQSIF29:0U+SjOSWsclNhO5DKb714chV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579144, "uuid": "78e8dd94-4a74-45b6-a275-5e594bb5a24c", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579144, "uuid": "b56c3b71-dace-42ca-a6c8-aa1c891582cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579144, "uuid": "55ddf07c-f4d5-4183-bc03-bb9ffa915703", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d75f34b-b384-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761604072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604072, "uuid": "a1114636-fa54-4c07-8a99-cd9b566c92f7", "comment": "Malware payload (Mirai)", "value": "6e7a61947151abca64ad869a21d5e4b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604072, "uuid": "8ea73004-8e1a-4b95-bdf4-335443087a28", "comment": "Malware payload (Mirai)", "value": "98966f9c6195b6be7c580f03d4d284e4bf7f98878ad2b646667dc2588ad15cf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604072, "uuid": "bd63715e-64a8-438a-9a8d-434e0665faca", "comment": "Malware payload (Mirai)", "value": "41a21e13bd97099ebfd9a0b0c6cc481afe6eb9e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761604072, "uuid": "141e15f9-f899-411e-bb72-b6390c5ebfe8", "comment": "Malware payload (Mirai)", "value": "9ae943987c863e9a64a0fe3f271c748b165ca7317946186fe6d61e2c227f8a36c4d488876e2a6b6c44726f0f85db0a9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604072, "uuid": "49c67611-c391-462e-86a1-c9d4cd88f383", "value": "T1C2630A82BCC28A5AC5C062BEA66F659D3361A3F1C2CA3103EC975B1137C715F4F26B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604072, "uuid": "839c0404-783e-4992-9e97-88a427a8f8ed", "value": "1536:kgXnYPFO83a4zD6FZkzvzTEBN/6prlR2R9dSt:zXYPFHL6OvIYI92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761604072, "uuid": "bf1834b7-4f1e-4615-85f4-c75e5e7f22d5", "value": 71152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761604072, "uuid": "2cf40a77-f1ee-4d7d-b1a7-a3235798a400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761604072, "uuid": "2cbd75ec-69b8-4d7f-b39d-ef9ebd42ab0b", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cdd3f9-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577921, "uuid": "f2711a60-3dff-4d22-aa14-e7647ac03307", "comment": "Malware payload (Mirai)", "value": "0d330a3cc41c4378b3feebc54d9cae3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577921, "uuid": "2fdabc11-6302-4174-ae83-41f84a0733a7", "comment": "Malware payload (Mirai)", "value": "98dcda973eef265e44b13759d4ed121cb5e5324c50a2d8011165a819b72f2ef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577921, "uuid": "897c2c4d-6034-4cf3-ae50-549a31802e62", "comment": "Malware payload (Mirai)", "value": "ee55823624010353ba5e9d39ad4912bf8590f6fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577921, "uuid": "a46ec7c9-e180-4348-a47f-e4323521eb6c", "comment": "Malware payload (Mirai)", "value": "83a2d26d8c8a96b746575d9584d521903688ecd59d085a4405954358002d7a7eacad330431b907e0b49f6812ef74de23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577921, "uuid": "4a9dd4e5-564e-47ba-9729-002828792f20", "value": "T168B2C04584185161C1B2EE76DB3099C2AFC68BB8D2A33C70111C9A52A3D7D5873FE9A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577921, "uuid": "9f0266e3-8b42-43a3-9a9e-66a52b4f37c5", "value": "384:1JTJa6fvV/AxanWzZDRQmxarmb+Zy0GgkyL7RGMJWoCzRWXhHHQmdGU5eT6Nuu9:19fpAxakDRQmxarmyZy0GgNHgHojXhHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577921, "uuid": "4fc2d14e-2bfe-48fa-97c5-ac5b11bff884", "value": 23880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577921, "uuid": "f956f490-cb71-44fe-bde4-7f1d36236d37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577921, "uuid": "edfc0029-0a57-43fe-95f1-6f846e192448", "value": "kvm.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15071a82-b327-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761564088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761564088, "uuid": "a66be5c2-a3c3-41b2-b676-1c28ec7dcf4b", "comment": "Malware payload (Mirai)", "value": "ec210976b3f7da7dc0173ff9e9425abd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761564088, "uuid": "1fe56c73-9a40-4a63-941d-5583957ab912", "comment": "Malware payload (Mirai)", "value": "9981d071cc62b2753198783528f4e6b16f62cdcfec149030862b24582db15f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761564088, "uuid": "23c13071-45f7-429c-b29d-1ac41390cbcb", "comment": "Malware payload (Mirai)", "value": "326ef22653a3a71197e068ee6417ba905abfa365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761564088, "uuid": "4be81b3a-97c1-4495-a0fd-a16d2c77e848", "comment": "Malware payload (Mirai)", "value": "38cacf6c9806645bd4f90155471187ba09112e48f3904b582ae4baccb2dcc6c2931746559a02e7b805462db5da410049", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761564088, "uuid": "c7c1eec1-bf30-4e2e-8acf-c64bce58d1d0", "value": "T19DD3BEDBB64B5921C46106F01FD78F8E3B6362118E0BD9FB2D0EA63B28755CB19067C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761564088, "uuid": "57a941a2-e269-4fc7-ad17-37285732ff4a", "value": "3072:Auh2KkxMJ4NK3Q/m3m+6RJf44gfC8tgynIq:HsxM3m1E426q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761564088, "uuid": "80a70d86-5cf7-4b26-aef9-55646560e624", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761564088, "uuid": "9ac7b0ec-b8aa-461f-9466-c02d87354eca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761564088, "uuid": "7d018aa9-64ea-4c18-9829-8139331da152", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c161b4-b2d3-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761528018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761528018, "uuid": "fd57418e-0ec2-406f-ae36-be85fad488e4", "comment": "Malware payload (RemcosRAT)", "value": "db8f4d4fb8ae576974bc62a6b0773971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761528018, "uuid": "caa84d10-0dcd-493d-8f93-b25d26d5aa29", "comment": "Malware payload (RemcosRAT)", "value": "99d592000e85eef794a714fa042815a31a1d34bba194555bcfc2e85175a8ab2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761528018, "uuid": "9cba1953-266a-4c20-a046-e856b96ac533", "comment": "Malware payload (RemcosRAT)", "value": "7f8694f79fc18dde97a9080e23439b56ad4bcb01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761528018, "uuid": "06f453c5-0261-4b72-8137-2966e76b3de7", "comment": "Malware payload (RemcosRAT)", "value": "a669a43e634fbd5db4f5c16c5aed847d62ecb67e6b3191b26d0d969a2748bb2311d29b89b14ac63899c2ce90ac7a070d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761528018, "uuid": "bb06ea21-9fdf-4703-a980-32394d1a8f03", "value": "T16D8412051261C0AAD8530478E43533FF4BB6CD1BD916AA078B39FF1B7872399AC5E196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761528018, "uuid": "e60004ef-8244-4edf-8880-9ad1b118c557", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761528018, "uuid": "7076e002-e38e-42de-9f8c-20f7f2ad0ae3", "value": "6144:bspNjlsn8OLszqA0vgZ7+NIo5zWy7avkBg+WQt7ekmvoZd3iSeWLBqBbTgf3UuXJ:bcE8OLszQvQSIo5Ky7pB5WQt+voeNeqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761528018, "uuid": "9d79dd6b-7a00-4f70-9173-0cfe5ce0ea37", "value": 384880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761528018, "uuid": "877477a6-ef09-41ff-acf7-fdf2a3adb141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761528018, "uuid": "e94140a5-8128-4eb2-b31f-cacac683f50a", "value": "Order 2736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bd9f07-b31f-11f0-91c6-42010a9c0006", "comment": "Malware payload (SideWinder)", "timestamp": 1761560677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761560677, "uuid": "ab94a7ce-69b5-4ff7-8539-7e5e8ccd756c", "comment": "Malware payload (SideWinder)", "value": "8c1af6bb55f4fdb952671846f5e10fe1", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761560677, "uuid": "b4f7b6ac-af15-454e-a070-d3b220ccf11a", "comment": "Malware payload (SideWinder)", "value": "99ed9f44a02a3549d60c58233f793622319ed4d08d2c1c8d6fd17fcb06afa8c0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761560677, "uuid": "c535be13-1e44-4beb-924d-37d9f6927516", "comment": "Malware payload (SideWinder)", "value": "ce64d60d8b0cb7d100faf0813637d597cd00c247", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761560677, "uuid": "fa67c31b-f0ea-4ee9-a47d-cb4170c8bc4e", "comment": "Malware payload (SideWinder)", "value": "3227b1327e949f7f819c11b5d5191a082bc7c0c31c37347ea4652821dcc62fe33a8ad61240b2efc358eb4fd52bb0afd6", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761560677, "uuid": "bbd743c9-bc58-4197-b21e-6911d83fb494", "value": "T10903E171E62D5222CB0F6DBC846B014098A15C5F812EB5767F3B73D9913B9B6BA3812C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761560677, "uuid": "2977c4a6-c2dd-4cc4-960d-cee26366fa36", "value": "768:QWsOnaOtzqaEduS9FPWIecmZiFQXsljnA2/603c7TGCaBZOXVmqb:4OnaOtzqaWFZ7QgH/XCafObb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761560677, "uuid": "8320c2af-017f-4a53-a1a6-27f31d43119d", "value": 41143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761560677, "uuid": "dceffffa-a3db-46aa-91e1-3b332f425312", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761560677, "uuid": "3f3ccbd1-0026-48ed-b49a-64319cc5bc04", "value": "Digital Pakistan vision.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32176d89-b369-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1761592484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592484, "uuid": "4630e774-f1c6-451f-98df-553bd1dbc02d", "comment": "Malware payload (Gh0stRAT)", "value": "7fb57e82fc616c4c54d2bab480304072", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592484, "uuid": "50090efd-1c35-4bad-a2d0-eb542ced601f", "comment": "Malware payload (Gh0stRAT)", "value": "9aeb0badce1e2672bc9fc5bb3ffbf771602c7301e305a65ef8b188aedcb0ff55", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592484, "uuid": "8e33fe02-1708-4105-aee9-d9714fa3b84d", "comment": "Malware payload (Gh0stRAT)", "value": "76d3595c742134a1114494b90fbe86bd30189591", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592484, "uuid": "b670a3f0-305e-4f6f-8264-3d82f118eae2", "comment": "Malware payload (Gh0stRAT)", "value": "659cc6913783a70d18440e05dc883de1b5d2a2bbb6355e7a59e702eced47150058a0febd8e6128bb240eca8892d57834", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592484, "uuid": "1319e196-43ff-4803-b8b0-2f3a9b70f10e", "value": "T162E633F7AE9E62F79C57019EEB52610778CCF78B0E4A4B6C25C1A91873AD740BDD0062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592484, "uuid": "8a612c3c-089e-497e-b4f0-e027ed741314", "value": "393216:ezf9OnR8p5gRDz2cPeiwKmkcxdeH25FxXomlBT:+FOnRE5sdP/zScHwL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592484, "uuid": "cf4cd5c0-5f57-4e8f-95d3-2a7680279345", "value": 14083648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592484, "uuid": "6e381d15-26a9-4786-80da-6a3dd053f252", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592484, "uuid": "b3a5409a-e9bb-4d59-a8c6-ca9fb49d5405", "value": "CoD4x_21_3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adde5e6e-b364-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761590544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761590544, "uuid": "3c3dc434-cefc-4df8-a169-7b443ff68fba", "comment": "Malware payload (Formbook)", "value": "c42359673e00a223edad16bbcea9433a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761590544, "uuid": "eb9c2e01-da32-40db-aaab-7acfdb4e771e", "comment": "Malware payload (Formbook)", "value": "9b20825f4ab45e71c3264f7966574b487a1a09190b8eaee590d479470048e030", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761590544, "uuid": "7308ba48-e2c6-46f2-b154-247890147b7a", "comment": "Malware payload (Formbook)", "value": "930a51c0133c3efd97f56a6f620e21824537bd17", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761590544, "uuid": "925dd068-cb3a-4ea0-af34-2d0d6a7f4106", "comment": "Malware payload (Formbook)", "value": "187f652d2872c5282a45a24884f349ebda978624646a6bbd214e73f3134305c38ebc9455e79365fedae00c2d38e173ea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761590544, "uuid": "b547b59b-fe7c-4560-8b05-374eb394c87b", "value": "T100F423126D40CF21DF12632ABABD31F78805896F730EA725DFBB455626C267607334A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761590544, "uuid": "57d2d184-b117-4d6f-b69b-325c3bc3ca27", "value": "12288:+fjKVZgvoCfPG8bvGXRZXu+EzFlvzByqn2b22//P3hhBXzLICPOmNM0QEhI:2jwfuPTbig+IFFwH3hhFzTPOmNHhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761590544, "uuid": "d59266c0-1645-404d-b269-92aa78c55de4", "value": 735042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761590544, "uuid": "3e32a07b-fc46-4601-bf01-24fb0650df8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761590544, "uuid": "62d5a010-ce94-4921-8168-827040a6fc67", "value": "78543546.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ec62d8-b300-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761547546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761547546, "uuid": "38dcc373-7f20-435f-85e3-5be6c9d22593", "comment": "Malware payload (Mirai)", "value": "411232e0bff8579bcea4782f9d527378", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761547546, "uuid": "5bc5b675-3001-471d-85fc-a345b2f0e86d", "comment": "Malware payload (Mirai)", "value": "9b2217b4b0abe7b404353f52ccbddeb93c6790efb5ad0a568be00483655c3790", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761547546, "uuid": "2c21aa17-382b-4228-8510-74739aae3cfd", "comment": "Malware payload (Mirai)", "value": "95ec50a8ff8f75637c4d9a3175559e9f297471dd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761547546, "uuid": "34d0bccd-a93e-4b4d-9dee-0689612ce308", "comment": "Malware payload (Mirai)", "value": "d942dc92ae9f5769ff9d2d9526157735408f42b09931c10395e1ca36cd750a0c71b35026854c46084a514be909f6ccba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761547546, "uuid": "76d215cc-27d7-4e0f-a3bd-6947c76efe2b", "value": "T141117AD9DA8297A5845A156DB1C7C20DF06783EC16E50A18FC4C3A347BCC588F831E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761547546, "uuid": "69064526-ebc5-44ef-8076-a5c3a5e25101", "value": "24:ToWBGhBh9Mk8QoWkp/A5VE+/I/V7RpjHXplHV:ToGGhL8QoWlVE+wV7Rpj3ptV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761547546, "uuid": "207add07-8721-4bd0-af16-3bdf057faeff", "value": 893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761547546, "uuid": "c1e2ceb9-d654-48f1-bd1b-eb0051be1327", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761547546, "uuid": "8c997376-27e8-4016-b1e1-ef133d52eabf", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33f478c-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588405, "uuid": "06f57f99-d5bd-4b18-8411-7ce172cd22d3", "comment": "Malware payload", "value": "5cbc347a3417476cd84c441aab9b8223", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588405, "uuid": "6d8eaab1-b564-4537-97bc-903df3a34581", "comment": "Malware payload", "value": "9b32646ee1426ae2eade7460c028c61df0d3b12fcb4ea25d3d4c9336ec2c76ab", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588405, "uuid": "efb72d00-b434-4018-b89c-11eb499634de", "comment": "Malware payload", "value": "6937874c0cc01909dbd7c260599d4af69e14e823", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588405, "uuid": "43319734-1e12-4527-ba74-9c36ff26b990", "comment": "Malware payload", "value": "7d19cc98da8fb4c5180b2f840c791fcc414028ac99f2dc525c6d86cf07097ba6297a0d66c0d4120cffb71b2c41ce9d46", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588405, "uuid": "1a5accb0-344f-4fb4-b188-e8758c0c75d4", "value": "T13231DD140BFA5721F7B20E3654B2A7369A36B802ED42EE1E014181491972A11ED39F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588405, "uuid": "4f3fc36e-3242-4251-a8d8-1a369850141d", "value": "24:8IJ8JsPZAO7ypgAM6Ji+/x1CRkRABYqVwOtab/cm:8IWJG/yp3xsBvtaTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588405, "uuid": "5b3abe73-4319-42f1-a723-d34800a1d0c9", "value": 1473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588405, "uuid": "83bf06e7-999f-4001-ba07-14c90e8f50d0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588405, "uuid": "ac66492e-eae7-48de-b4bb-216e26440501", "value": "R503749J637R01.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97bcb98-b374-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761597408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597408, "uuid": "cf3a27ee-5801-4713-9e4f-84c60ff20fb5", "comment": "Malware payload (Mirai)", "value": "493b41f23399e84881d8508add5bab01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597408, "uuid": "88f17ac7-8b84-484f-811f-305b3303bce6", "comment": "Malware payload (Mirai)", "value": "9b62454e93fd23b04995fadc8411d0520994c95b9d317c45f08783dc24c15403", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597408, "uuid": "86306102-ef4d-474d-960b-50dd1ffd06d3", "comment": "Malware payload (Mirai)", "value": "9577841405ab711343a9d2d728ac82302e8b6f14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597408, "uuid": "bdb60571-d259-4dcf-8a2a-1b93b3f0e5d8", "comment": "Malware payload (Mirai)", "value": "3365fe6392726a45fce1dda4da4ccaf3d261412db6573aaf6b50fbda553d70cfb464d2ebf4dc2fccc480ab277cd33a4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597408, "uuid": "696f2e01-e839-468e-9c60-f3756cedf13c", "value": "T1CE24841E6E328F7DF368873447B74A24A75D22DA27E1D684D2ACC1141F2435E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597408, "uuid": "42561e50-c7c1-45b2-80ed-e1c2fa549480", "value": "3072:pNzHF2evgUiHeY8e2GsgH03QU3pi8xC6nIlDWUXgjby+Zoe:paevgUi+DcUgz8AQI1WIgjblZoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761597408, "uuid": "92885320-eaff-4d0e-87f4-17279110ce0f", "value": 210848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761597408, "uuid": "30fcb564-b21a-4e2f-98c7-6651beca484f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597408, "uuid": "e13d7727-fdfd-4e4f-9da0-9e95825e4b1f", "value": "irannet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf28318-b2db-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761531433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761531433, "uuid": "e0a25f97-75f3-4a95-937e-4fb868e472a5", "comment": "Malware payload", "value": "4551b6e5dc4254c8086f4101e561c625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761531433, "uuid": "dbeadd95-2906-459f-b5a1-c2f7bdcf45b4", "comment": "Malware payload", "value": "a0dcec0d5fd73fb80317870176e70022e98dfdb604141778874468cedc1ea0eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761531433, "uuid": "2312ec64-b1aa-4bea-8a59-8cf9730a2c6a", "comment": "Malware payload", "value": "0478d436469a9b9c64617de093f3f91e6f31b1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761531433, "uuid": "05833cc4-be69-4898-9609-0d831bb09a4e", "comment": "Malware payload", "value": "d069ce9c465dbb69f9e8a11037c0a5972e12f3a19912b6a72c85a0a7bbef146fded79e4d54fd3dcc053a35b8e0bc3e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761531433, "uuid": "4d2653ac-0d97-4e78-b84c-b80c675fe9ba", "value": "T184F522287FDADFF4E02FC3707992011CB22D6B755A786D9E5E98E4091EA65342D3328C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761531433, "uuid": "185b65ab-d68d-462d-8304-d2ae93d5441f", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761531433, "uuid": "9043d71a-8274-43e2-a1bd-0e03bd89ce93", "value": "98304:uatb0O6BzWUb24rCavhlDVtdYnk6aQfXzz:uQ4O6BaT4+aJlxTYPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761531433, "uuid": "fb0598f8-a739-4c53-adac-4ce0e7c8d5ed", "value": 3552176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761531433, "uuid": "5caf6ad7-e3ee-49c0-ba3d-9fb53fb1d1b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761531433, "uuid": "c6cd7379-589f-4b86-afd9-7355c64e4dc7", "value": "SecuriteInfo.com.FileRepMalware.32665592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb26a5d5-b35f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588499, "uuid": "4b602f60-ee0e-4780-99bc-1c3a0452c863", "comment": "Malware payload", "value": "b1aedf3d05a0137fcde70f170997f72b", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588499, "uuid": "6926bf91-2cf4-4e2a-87cd-3f57f9a43757", "comment": "Malware payload", "value": "a1b1f0cfb8cabc1d0f9a01677d7f8e79beae71b4143511fa023cbd06caf14aa8", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588499, "uuid": "d3df956c-6c33-4ca2-8ebf-0f24ac3a6e77", "comment": "Malware payload", "value": "4831fafc2dd25f542ed627b089b2cc006139c08f", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588499, "uuid": "b958ac9b-d871-4ca6-8fb7-8c25a104c744", "comment": "Malware payload", "value": "2ff161b61530264a7732e51255ebb6dd66e165f8ef3d33baadd488db658a024343ef0bc06d98d851185250529add344f", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588499, "uuid": "ab713da1-884f-4091-b041-884a1201e3a1", "value": "T12A8131F07D01D9D1F4A6DAFBF66D3A88F0686207E0C5144D25F396880FBAD487968BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588499, "uuid": "46d0b414-2937-423d-bd2f-b1571bf97c1b", "value": "96:7lUOwMQ+TorzM5wlMc53lkcQmDG1Ouyklr1NF1h6bqDY+w+5aOHATjkD7wEYya:vwMtT5wj53lGwuy01NF1h6bqDA4gTjwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588499, "uuid": "e854eead-99f3-4184-9ede-c0201688c1d6", "value": 4030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588499, "uuid": "39d586d6-538f-4afc-97cc-35bd073e7438", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588499, "uuid": "e81aa475-3d0c-4a67-9e33-7ce38f443716", "value": "tyma.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9c2d5b-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577925, "uuid": "407bec6e-2f69-4864-977f-924374c26bc0", "comment": "Malware payload (Mirai)", "value": "f4253cf9d5f86feda2b444d0ede1022a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577925, "uuid": "f8028c6e-d567-45ff-824d-86525cc44898", "comment": "Malware payload (Mirai)", "value": "a2c28a990eced43679e04936e6751c015be30dfa82094092767e1d77bc212ed9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577925, "uuid": "77b88696-a293-450c-8f69-509a1dcae52b", "comment": "Malware payload (Mirai)", "value": "cfb138ae83631d3c716f9cf29cd6ab094faece85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577925, "uuid": "b41563fc-af02-4f80-b190-6fc979c5900a", "comment": "Malware payload (Mirai)", "value": "3eaa9f13ff87dbcc5df87b6c538904c6191d82e547cc6da106aa1e165858d2766593c4b0e94814f4cab9daa82b480875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577925, "uuid": "96fdd72a-7988-41a7-8871-236b6fd7ca91", "value": "T17B5302D13DCC4A2DE0F01C76D1B69380B98D7FBC8965702B256C9BADFC9009529F54E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577925, "uuid": "f9b0e8e2-df24-4472-a7d7-d542e650bb41", "value": "1536:QCVkz7WHSaW/pmUqaInbQmkl1OEDehc4zM1hyNEn:w7WyaW/IaNm0MELCihyNEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577925, "uuid": "4e169e7f-83ee-488f-bb36-792f0150a041", "value": 62080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577925, "uuid": "55a30d8e-48c5-44bc-b4f5-4939f66c5ed9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577925, "uuid": "2ac68985-0598-43a8-9faa-db1a88633f7e", "value": "kvm.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8441c0-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595593, "uuid": "9b7e1db8-645b-4f55-9dd3-bbac870e4ad4", "comment": "Malware payload", "value": "140cdda2f51d89dc194a8b8c3ab9e463", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595593, "uuid": "6ba05ec1-6b12-40fb-a84d-20de24f6a5fa", "comment": "Malware payload", "value": "a30c086bb16c702985df2193d1e52cfb15b978a679de014b449a95eb9a233c15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595593, "uuid": "327e74a8-f449-461f-8ad6-ccf18422e25b", "comment": "Malware payload", "value": "255180975a70d00d31d516ecc895e42fd18c24bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595593, "uuid": "42217549-318f-48e6-86fb-83038a3461ff", "comment": "Malware payload", "value": "ba05cdd891df9046d2264b3460e52bc4f481a5a24be2aef527c2b5e9d487437b898f96d3873e588334376e5e7033d3ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595593, "uuid": "ed771124-0cad-4907-a01b-a1daa05e25dc", "value": "T1CF948D8663B404AAD5B7C03CC6538617E7B2B0592310E7DB4BB1CA791F23BE5363A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595593, "uuid": "fe802a60-4a89-4462-8c9a-c7c22c188654", "value": "a6b222f16bbf34bb5cb7e6939dbc42de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595593, "uuid": "af87d8c9-fa56-41e4-926c-62566e6fd236", "value": "6144:N1G1JeytrBCqeF+MSyi1HFko9pk9ic2lO7aUihYrdB0eae9TBohuFDGB+Ls5O2/b:grBC5tE5Hpk8c99ihAd9T1Xg8iaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595593, "uuid": "011d133a-96a2-4fc0-8909-e40d5d4b83e6", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595593, "uuid": "ef7ee0ff-45bc-4b29-a5ce-b2ef0364a709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595593, "uuid": "d267d9fd-9681-4c45-b905-c57b5b96c9a4", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3357cf2-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570823, "uuid": "907a03ae-884d-4998-b72f-bc2250683949", "comment": "Malware payload (Mirai)", "value": "73384bf9aece1adfda188c6602512d8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570823, "uuid": "61165e86-264c-4c99-9de1-9bf54714b271", "comment": "Malware payload (Mirai)", "value": "a393d136e6eb2fff316ab7a142df608dcd3648247983975a382842dbbdb329ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570823, "uuid": "a1584fdb-b8ed-46db-9f48-96defc3e66d0", "comment": "Malware payload (Mirai)", "value": "370893ecdc2e38428f4a3cd064f64fd1e3aed8ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570823, "uuid": "10fd3ec7-6533-4164-b8a6-c1315561271b", "comment": "Malware payload (Mirai)", "value": "66bc9369c8fbb7d245cc16030e106fb9e6746d8cbd0ec074d32ba62fc1dfa089b54e26b35fd0e2e0920bfd01973d4dcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570823, "uuid": "b7fd1989-07f3-4f02-8413-74bb54fc4d35", "value": "T188C2E18E3A1D2B2BF151537BA97AE656F8E050E5D72F070C95982BC5678911A3C8C88C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570823, "uuid": "19b32687-4f8a-4817-a70b-e775dbd1109d", "value": "384:Mz5BTn5Aa3OAaQ79YkbbSDacowHZRnsZ716S68yvNnLI0CYfIV11v6ceBx1OPXGv:kv5AaXacooQHsBqvphRfCiceBx8DUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570823, "uuid": "b120375e-fe9f-404f-8810-5ea71c9ef0c7", "value": 26248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570823, "uuid": "c9512be0-b4a0-4f47-9962-95bb4aed5ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570823, "uuid": "ed1a4c4c-1f8d-41c0-9551-ac2138d10448", "value": "dlr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac4c3f9-b357-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761584714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584714, "uuid": "17004037-cc4b-4069-b4ed-e848a10efd17", "comment": "Malware payload (Rhadamanthys)", "value": "fcbe47becd3fab0c922ec60031ce3a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584714, "uuid": "f868f253-258b-4de1-b3d2-99c383446364", "comment": "Malware payload (Rhadamanthys)", "value": "a3a7a4f887a96f9638d0a566dec939864813cb6522d95154eda516d5a855282d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584714, "uuid": "6b5f0b4b-778d-4543-a511-b0cae6e111c0", "comment": "Malware payload (Rhadamanthys)", "value": "6a0929a59ca6eb6bb279a1bf69fb6eb6bb4b37b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584714, "uuid": "33ed078f-0535-453e-9fa5-94fa24c455ca", "comment": "Malware payload (Rhadamanthys)", "value": "e059cac8447157949daecbac3c16de2d7fb169b9775f0d0132aa80a1942c607c5d78dcc0581bb1ed18b67c19de07ceaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584714, "uuid": "6a4b0c60-f4b7-4e31-a22c-b57d24e9ec86", "value": "T15475234913E524BAC5B46375C8D84612B771F884AB3153FFB60882B92F132F4A376B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584714, "uuid": "2f6d4715-4ed1-4326-a4ac-c2968659f7b6", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584714, "uuid": "d0f2dcda-0ae7-4214-81cc-917d17b3dd69", "value": "49152:/jzZZtU6cu3c15P6h6CIJnx6dsaPPbeJEhR/LQJ:ZZtU6cuoPa6CenxTaLeJQ0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761584714, "uuid": "79b0295c-f7ed-4ff2-a812-e53c293ad8af", "value": 1654784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761584714, "uuid": "5ea8aeb3-eeb8-43cf-a4c3-a5eeff53e319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584714, "uuid": "a91c82f4-a20d-481e-a1d4-9f8f21fee98c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0acf066-b36e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761594817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594817, "uuid": "e3063f14-2ab9-4336-8d09-305b20d8ec74", "comment": "Malware payload", "value": "75be92e844c1fa4351132dd62adca576", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594817, "uuid": "72e0b6f7-6217-4ef6-89d8-6d8ba3706dfa", "comment": "Malware payload", "value": "a442eb87e36814f33635c971290576586980f77523d223174da0719ca35aa2e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594817, "uuid": "8c885c09-b88e-4678-84b3-4eb2717e06a1", "comment": "Malware payload", "value": "378e7ab01c429590c5b2487561d3089960dcedfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594817, "uuid": "7cd5086f-eb83-4e10-a888-183e115bc39c", "comment": "Malware payload", "value": "2cf5ceba405608581daf3c4c36eefe8b03750cac1501bb947dee81132c1fc9eb2c6b2c999ddc1a3f3691ba52a9f2f984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594817, "uuid": "8e37358d-87be-4d60-8d36-d633f477de2e", "value": "T1C2A63383C852E50EE4209370033A2555EB3DFB4EE535465963F9762F28E7C33EB865A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594817, "uuid": "c21d9f26-16d2-473e-a2a4-45a203c2d52b", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594817, "uuid": "38e81e2b-7d4c-46a1-929d-373e609c3f83", "value": "196608:SJLpiNghX4dB+bzPz/MWWzuEzjEVkT4kwVeUiyeyE5zi/d:Sdpu262/M6EzjZGUPlnqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761594817, "uuid": "25aab2f1-588a-4e83-bfd9-4d0efb8d6c65", "value": 9492680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761594817, "uuid": "959958f8-c773-4af5-bd0e-d256a518c002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594817, "uuid": "7ef252bc-1d37-43d8-8f4a-c1714bd3eab8", "value": "XMouseButtonControlSetup.2.20.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2ddc7a-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595673, "uuid": "5d53b7eb-176a-43a1-b317-d43b0c7d54e7", "comment": "Malware payload", "value": "589f1de16576a096f5b31c442a54d323", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595673, "uuid": "c67f4d2f-5971-4f40-a5f8-379e75d50c87", "comment": "Malware payload", "value": "a46b0041491f28d94a2952ba6d7cb6497002358635ae638cb2d8cdd3aeb54f43", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595673, "uuid": "d754dede-1409-4000-a8ae-c1b0a0e811a5", "comment": "Malware payload", "value": "7894ca0a17b81bcc4391db472794947e55d2d85f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595673, "uuid": "060c1085-cebe-473a-927b-7c1360ae2794", "comment": "Malware payload", "value": "4508ddf6947269251dc0d2b8212cd376b5ec044fd1cb510244bd73c34f72c6a6643bdf1d0a9b4bae5ee9101d56405445", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595673, "uuid": "99c0e6ec-dfc9-41ab-9dfe-8cc1f177a90d", "value": "T167253A60D92C43AE4E972BDDFC4106A2CDBDC604652740FCEBD90B8D62064ECE77E669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595673, "uuid": "66d22b23-8f84-4e8f-a15e-c997d518b886", "value": "24576:JWxOHdv16Lqmx0h/hDmMbNr5V1UdbJv2dDsrhaZWr:JWxOHdv16Lqmx0h/hDmMbNr5V1UdbJvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595673, "uuid": "21fdfdad-64c4-4b9a-9104-3d9c5438d9c8", "value": 1016884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595673, "uuid": "759399d9-2a58-40b0-890d-a30c96c0e63b", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595673, "uuid": "b2652f12-05df-4ca7-9bac-14d3dd39ae3f", "value": "Request for quotation-TAXC JASS-1298740040034328960866_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c183f97-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (AMOS)", "timestamp": 1761579267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579267, "uuid": "5dad2fb0-f516-479f-9beb-6974e885af39", "comment": "Malware payload (AMOS)", "value": "c98415b7993ed0f86721d671723579b1", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579267, "uuid": "852237a2-2e56-494f-b6df-53f2494267d3", "comment": "Malware payload (AMOS)", "value": "a4b7b5c45836f38a61a690e8e76f5e590494a5f613d9a35f926f932d8d759328", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579267, "uuid": "52ec82b4-b52d-4146-b395-a41b22befd88", "comment": "Malware payload (AMOS)", "value": "999fbccc0b4b22bb7fbcb3000372afe9e48ccfc9", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579267, "uuid": "87b382e8-8801-40c6-a069-9240c699b4e4", "comment": "Malware payload (AMOS)", "value": "f5eb4532212bb8045624bc34b35ffc13b60b7a3cc940cd2fce8628c760159ed902099e125ed823c4b2cca68a140ca8de", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579267, "uuid": "8187efd8-a57a-4856-a3e9-86a2b337380f", "value": "T1B9C08C91443DD432A27E0E4EB281F2F8AA86A4284BA439A1D42C860465640B00C4F37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579267, "uuid": "64f87a63-8360-4bc4-aba0-d4b332107cac", "value": "3:WFBIx8sv3uy9Fb+dNMfNegocmEtUHeeymHgmQmk0QQHFxaFOd6HhC:/9vrbsMfNHocgebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579267, "uuid": "ca17d869-7f3e-415e-a299-12af463a96d8", "value": 166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579267, "uuid": "5f29bf8e-592d-46ec-8a0f-18393e124459", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579267, "uuid": "5c809980-6759-43a3-888c-5d73ec0583e4", "value": "wcv2eidlu4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cddda01-b2ef-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761540103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540103, "uuid": "b461f8c7-d5e9-468e-b0ca-ef154a930d25", "comment": "Malware payload (Mirai)", "value": "6757eec1328f3432758018b379294492", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540103, "uuid": "58c86640-fc52-415e-b2fd-fcc72b4e9ab4", "comment": "Malware payload (Mirai)", "value": "a642661259f2493c9d259526b8c92cc40b38812dbf6ed715bf12b4215e5691be", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540103, "uuid": "78d946f8-6743-46b2-aeff-24dcfd4cfb90", "comment": "Malware payload (Mirai)", "value": "c3041a2da52d0d04f76a5f5209ecc6fd97197f89", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540103, "uuid": "07370125-e0c9-4346-bc3b-a0161fc49b99", "comment": "Malware payload (Mirai)", "value": "d7d8edde13cd5b00e46879ebdfb17584adad0aaf0cd0aff75254da624e46f019871f1a2b6d3c5d612b6942078248727d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540103, "uuid": "57d91358-ccba-42b0-baab-bf3b2f9fac8b", "value": "T10841F2ED02802F7A35068A2563E755AC9C468FD1718A579CD58A7C2B8C0F61C7BF9D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540103, "uuid": "d893aadb-9818-4782-ba61-004f55424f3e", "value": "48:pIIdYsIaMnh2apwMZByZhV8R47AF3OH8ENpuNlwNpE:pZexP0aGuBwhqSdGcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761540103, "uuid": "18056f33-b920-49f3-b988-4ec9dc1adb68", "value": 2333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761540103, "uuid": "2750ed4a-8c84-49cb-9b9d-9c536e7fae76", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540103, "uuid": "20960a43-546a-4f02-a395-4887c5d031b6", "value": "wget_telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214accd1-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761577423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577423, "uuid": "abee5842-ee45-4ab9-b618-6b9fda50e258", "comment": "Malware payload (Rhadamanthys)", "value": "bdb5995d14aedee3819b98ef286ff69d", "object_relation": "md5", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577423, "uuid": "1a4d605f-9e7d-47b5-baa0-e9c3b97ed188", "comment": "Malware payload (Rhadamanthys)", "value": "a758398b54dba09fbd3b6348bd224ebbc95b313156ad0f2aaf1f5fdd66b9403b", "object_relation": "sha256", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577423, "uuid": "05685e0c-4640-444b-956a-071f642e1bf5", "comment": "Malware payload (Rhadamanthys)", "value": "d8779bd4149ccc3df2fb0fd8f141b1c706a0c730", "object_relation": "sha1", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577423, "uuid": "3355c132-9b1c-4c1e-a342-1ff51ebd7afb", "comment": "Malware payload (Rhadamanthys)", "value": "c4d4c2b625cf2ed6678645c8a587cbada4654848aac4c718a685c9e55cfe4434c6be088f2a03922e90a26db3eb937b8b", "object_relation": "sha3-384", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577423, "uuid": "c4681288-1cbd-4a5f-b64e-5c025de33ba3", "value": "T1241701D529D141BDC892C630E28A1BFEF4C935894DBA482FBFC618012A31D95DDE7B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577423, "uuid": "419c47d4-99c3-4ab2-81cd-b1ab8fad9f1b", "value": "1642d55e623703e2c5ba45ff18ce985e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577423, "uuid": "8afdc836-9e35-4fc9-ad54-7f6fced47ce2", "value": "196608:L8BkBUyY6hMLJEzhFuTHubCxcve58A3ziQNRhHR4VyL9q6YKz+IkRHDTfeQ8J5v1:fUEhM+8TeCxzJzTR4VWqT5RXfexrZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577423, "uuid": "fb77ec32-7ab6-4e84-b924-6aca2e7e0f36", "value": 19564776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577423, "uuid": "8534b9e4-0fc5-4385-b56a-9834187f46b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577423, "uuid": "3363e956-b46c-4875-8710-b073c4a53fbc", "value": "EasyHook64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eca0cd-b362-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761589703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589703, "uuid": "1b830397-950b-4356-8ce2-82e5c0c781e4", "comment": "Malware payload (SnakeKeylogger)", "value": "5d4e9abef8b28ed8fa39d11ed11f0d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589703, "uuid": "bd8af375-d7f1-4e5c-8646-f719ff444239", "comment": "Malware payload (SnakeKeylogger)", "value": "a822bed7ad8245a218ce6a220b9c02693f499cd4bf42e6daf11557b41f114a9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589703, "uuid": "a94519ec-4508-4e8f-b23c-b913e96a14f9", "comment": "Malware payload (SnakeKeylogger)", "value": "5ab58df9c5e8a143e6f8e5dba366cb9da60a8883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589703, "uuid": "7b8e415d-2545-4acb-b54e-66dee0769cc9", "comment": "Malware payload (SnakeKeylogger)", "value": "553823b4a13fda0f91d6c1343defd9cdaa6b8ee7958db5d92522100b9213932bc35ff426aa86748e3f69f1c46960f7ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589703, "uuid": "7c1c4c09-8f67-4d6c-8c7c-8839feef53e0", "value": "T1FAC401086369D612E4559BB42EB1E2791BB97E2AEC21E3075FD92CDF71B6F520C00363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589703, "uuid": "85b848eb-153e-497e-8df2-3e4e5fff8d81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589703, "uuid": "9e378f74-1ee1-45b1-97db-ebfcdbf76abd", "value": "12288:ymMQToAp7WIJT03rPpYA32WFf41opaWLdYbPgqzgqI7dPvwb8it5:AQsxIO37I1GPLKbPgfpox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761589703, "uuid": "0b453fa5-4caf-4f7e-beb3-9af52237ef08", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761589703, "uuid": "e1edb8d6-c3c6-41b1-bdfc-458c1d3c1338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589703, "uuid": "8b0df9f2-c063-4630-a24d-3f6be835eb8d", "value": "scan document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b5b5d5-b331-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761568604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568604, "uuid": "f5d495de-55c2-4f90-b4e1-14e0c0bbfd28", "comment": "Malware payload (XWorm)", "value": "c1a70ba9f553021236d4a7cc4516d3e9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568604, "uuid": "a9903d36-2c0c-407e-adbb-78ded873d528", "comment": "Malware payload (XWorm)", "value": "a843c61a739eb4b3c076725d7c6b55dc6e051a782c3561b816341cf902811856", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568604, "uuid": "139284b2-fd08-4b35-918e-072c1e494571", "comment": "Malware payload (XWorm)", "value": "6a5bc143150302191675c968f48726180c86f5ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568604, "uuid": "ee4a3b90-d5c1-407d-ac1b-fe7aed93970d", "comment": "Malware payload (XWorm)", "value": "4ddcd18f4ae698859f0db1f00f43b8f8721517c44c1d45c51b8d50d9757e5dba34db0276f531da6e67155766a42b135d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568604, "uuid": "97b7fdcf-ba80-40c4-a3ba-2426daa2494d", "value": "T19FB733068F6F9E2F8ABC215C24BF0F4E26E48E544105B9E767E67CDB9A4FF11204616C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568604, "uuid": "99fe9b90-5002-4f41-b6be-a25c1f20931f", "value": "49152:tF+1Z8nS6+ScO88pUQGNL70GNecQYVMIVoQ2UDPOT83SAdQ9t7HBFUQbneE1o+JL:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761568604, "uuid": "42017df4-bd70-4415-87d0-32815a6c63dc", "value": 52431415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761568604, "uuid": "d2c61912-d4bb-4d79-9931-0820aca0c6bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568604, "uuid": "1920a133-9691-444e-bac9-2ba63b9358d5", "value": "Travel Plan.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3ad50f-b383-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761603886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603886, "uuid": "f85fc52f-621d-43dc-8606-836eadae2ce0", "comment": "Malware payload", "value": "a48a9195e7466ef1d7747bb9612a8648", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603886, "uuid": "412533dc-7c6f-46a0-9272-bdd09d203575", "comment": "Malware payload", "value": "a972d18300270d54a9ff831af150aa1fb4e7c319dba4fc9dac07b3af756aee05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603886, "uuid": "bd473f2c-9ae3-491b-b3b3-6a5f5808c252", "comment": "Malware payload", "value": "dbd736e3f0d3197a65416dea798244188ff25d5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603886, "uuid": "b430a270-48eb-458c-9673-63f0444e5b9f", "comment": "Malware payload", "value": "5ce623905aab2f8727d44696eae42a8d434c751b9d9aab1171d934b832b4042e1438f0145962a654a6c9ad25ec0f328e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603886, "uuid": "ad78be97-2064-4835-b50b-b4b78c6cc255", "value": "T13D553361FE21113DD8A1EA05FB5F3D0A35C7C611C8579933BB498BA670C688763E8B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603886, "uuid": "544e6ced-d206-4d14-94bb-c835945862e5", "value": "24576:76iBlT5cn+YUJCMEBG7lBE2lTCf7X81omWAP5g8oNL8l4PpPqH6eZSny:HjVYWCxFo1omRJoN9E6s7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761603886, "uuid": "e8856d7f-028e-4bc5-9756-0ce72ccedcb4", "value": 1298976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761603886, "uuid": "9815b163-a225-43e1-80fa-02584c3a95ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603886, "uuid": "3346dc11-b9bd-4cc2-bbfe-b5d9319e78fb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6782d1c-b35c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761587095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587095, "uuid": "5d8e0c34-bafb-4be8-95b4-eb417d7e08ab", "comment": "Malware payload", "value": "1f3d97678bbe9288a197f1068dcfb2d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587095, "uuid": "66fe1407-b5cf-412e-9deb-5631f2e0e7b4", "comment": "Malware payload", "value": "a97d66d000482d5868127a0eaf11d279f4f18a77a45875806913439a314dda73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587095, "uuid": "bd1dac2d-5716-48a3-8a90-f7c380d1a2c6", "comment": "Malware payload", "value": "70e0a32ce194c0320551f434ea09d4f01ce6b93c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761587095, "uuid": "03a0f44e-4374-4b6b-9749-0e8da1283e1e", "comment": "Malware payload", "value": "f6c9e9802bd63b6bcecc0b742225dabaf027759532a0db046f9b47603020f50d9c829b862b530f3f7eccb637a7a84cf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587095, "uuid": "b3997d70-bf6f-4c35-8543-4bfa648f8a77", "value": "T1F6730106AF25ED16CF000C632ADD9F9D8D7DAE5A49EBB0B55CE1988F67D11CAAC53300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587095, "uuid": "e2056d58-2895-43fb-a55b-bdf4710b157a", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0Cj:phNlHuBafLeBtfCzptj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761587095, "uuid": "3208e366-39d2-45c5-96f5-2ea373ddc132", "value": 73496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761587095, "uuid": "01839c5d-1735-49ce-afa4-dd93b4441431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761587095, "uuid": "c603c436-603b-454d-aa0e-f83cb338aa30", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c718adf-b366-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.iWin)", "timestamp": 1761591320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761591320, "uuid": "7bc53a89-d540-4965-8212-2e1d44d628b3", "comment": "Malware payload (Adware.iWin)", "value": "230d7dcb83b67deff379a563abbbd536", "object_relation": "md5", "Tag": [ { "name": "Adware.iWin", "colour": "#48FD15", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761591320, "uuid": "bdf19519-0227-4b69-9763-3a7794a85e05", "comment": "Malware payload (Adware.iWin)", "value": "a9cd3d966d453afd424d9ac54df414b80073bb51d249f4089185976fb316e254", "object_relation": "sha256", "Tag": [ { "name": "Adware.iWin", "colour": "#48FD15", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761591320, "uuid": "c6cea211-591f-4c0c-ad1a-c2a62bc9a152", "comment": "Malware payload (Adware.iWin)", "value": "dc032d6a626f57b542613fde876715765e0b1a42", "object_relation": "sha1", "Tag": [ { "name": "Adware.iWin", "colour": "#48FD15", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761591320, "uuid": "d878720a-9bef-4037-ad9b-45de71ad5efd", "comment": "Malware payload (Adware.iWin)", "value": "2baf9ed5681ee4add12a75dd0e7578d8cdcb8d4123beaab9114ed82a46d0aa680455a33291119c57aa8fa146fa9067bd", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.iWin", "colour": "#48FD15", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761591320, "uuid": "0a701901-a791-417d-986f-b493c9074fcb", "value": "T12872D0E9E7385996EFC8AAB18F055D37230D8A60A2BA4F0078CD4465B5113794FD91C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761591320, "uuid": "2c79e337-da84-45db-b923-c6f9d287d68c", "value": "384:+gTgSLZ5WpPu3944wiiNIw2nbI6B/PvpITFkvbWa:+cvLZ5n9Sb9ytp6kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761591320, "uuid": "7acb9df2-d456-4722-9aea-065ffae386f1", "value": 16382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761591320, "uuid": "05bd6c33-360c-4047-9f03-79e79f7900aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761591320, "uuid": "f84f3286-0ecb-49b4-a398-7f805b9a6f0b", "value": "MEMZ 3.0 (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c409949c-b32c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761566529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566529, "uuid": "168cafc7-55d8-42a9-84fd-4dcacb389464", "comment": "Malware payload (Mirai)", "value": "da409ce4cfc92dc461820f70dcec256e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566529, "uuid": "7180b9c8-61d5-495d-9751-3367bc0bc12b", "comment": "Malware payload (Mirai)", "value": "a9efa021a70d66e616821065b891e73a9eb10f41526ddbcacb6a07c9d25a2839", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566529, "uuid": "48faacee-3f69-4602-b77e-09f266ae4139", "comment": "Malware payload (Mirai)", "value": "ebc2f0af473f12f64e0e69fdbee262667e8ab964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566529, "uuid": "8a0e580f-781a-4b5c-9c17-09bad420b63a", "comment": "Malware payload (Mirai)", "value": "57d5bf8759235179f2424d2f9d6f37c232acd17b5c17f81f6377a31de5fad669476bd5da4eb26f18b6c06104fa8f752f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566529, "uuid": "e601e0c3-39b8-44a4-be77-70f7fc2d28fd", "value": "T14AD31845B881AF20D5C626BBFE4F118A33135BACE3EE7213DD145F2427CA95B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566529, "uuid": "306385dc-14a1-43b1-b895-18da9f71600d", "value": "3072:rC+uzhnjjtRbHz6P6D5rV9vkHIrxTgdjrcJE0PVatzZBkIa1Pnzr9:O+uzNjjt5Hz6P6D5PvkHkxTgdjrc3PVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761566529, "uuid": "0cd84cad-59ce-477d-a12d-f5a624d3ff67", "value": 130604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761566529, "uuid": "8805f769-eea4-4811-b2c4-e7e2c58fb294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566529, "uuid": "f49d54b5-e432-40aa-9122-a859c3d1250a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202aac59-b368-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761592024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592024, "uuid": "ff51be11-b1f0-40fe-b5a9-133feef3e138", "comment": "Malware payload", "value": "45f76f2ef838beb413a74d81bfe1c557", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592024, "uuid": "0e9a2495-27d6-44f0-a0bb-fb1afc83b5a7", "comment": "Malware payload", "value": "aa2e442fd31a281ee6b97900b4a7b45ef05f63764ff9e981cfee891e27feb5d2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592024, "uuid": "28d2762b-c69a-4dd5-8c69-21ae9a2b3f9e", "comment": "Malware payload", "value": "692a0087f2fff33dd1b67da32d831b15455ff0a6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592024, "uuid": "0b30aeda-7e64-4c61-ad38-b03d4e5972d5", "comment": "Malware payload", "value": "96a9c11e77aea3255e6805c4750b61b4a77e7b5baf0b908488fc30144288905129cd7a4f3ba7258df91da05de3634d60", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592024, "uuid": "c6ae46bf-6b35-4c7c-8764-25c1b4d0e472", "value": "T11FF0DD1DD848C1A28721E1E78B31801CE380E46A8257F524B280D80A6992BA06AC87BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592024, "uuid": "d6a7d66f-655a-4d8d-a9a9-9c7a8f403c67", "value": "12:3kde4rwpK+EMG/swBM7AmH2fZh+vXgMiCi6snVj9SGk+h+G5gL:38DEOMGJBCWf5MiCNObk+4G5gL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592024, "uuid": "e86829c4-86b0-40f7-9a46-7147346197e5", "value": 649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592024, "uuid": "6b3353d3-7c2e-4c44-a0b7-f95d79644685", "value": "text/x-asm", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592024, "uuid": "87d50f65-8fbf-4263-bcd7-d552cd2fae24", "value": "Factura_9484_JPEG File.Vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267b0f18-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577432, "uuid": "7623bb4d-9fcc-4eee-bb73-1090cff5e662", "comment": "Malware payload (Mirai)", "value": "4b4a8fcb5111381d9ba2c9297d4bd795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577432, "uuid": "8ca90b4f-be11-4062-9638-887ef0cd6def", "comment": "Malware payload (Mirai)", "value": "ab23e7f3beb8e04324e84fcc0755f1afc140b0fe09d7c20598a2826a8ad60b3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577432, "uuid": "73f15f5a-0fad-42fb-87a3-e03a52a9a0b8", "comment": "Malware payload (Mirai)", "value": "cd125c6378f2738d00ac99b0e0e9d973690a27a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577432, "uuid": "0340f86a-02cb-412f-868f-b404ebc2850f", "comment": "Malware payload (Mirai)", "value": "6cce012b225436072ceb85873148c07c35755016caa55185a1a4dd6be78bea2750364a3882c004ed9d9c95a88fc282cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577432, "uuid": "a372e462-bbee-446b-913f-ae264046d45b", "value": "T1F0B32973A4615FB7C042697125BA5A200F16AD931F4F1A99723CBAF4073B5CEB80EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577432, "uuid": "0fdc30aa-8722-4d5f-9780-62e1379df16e", "value": "3072:JsmnW43UTX5LrAVN21zauA00ms1cuEEvnFjN/:JsYTO/AS1zaD00ms1cuEEvnFjN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577432, "uuid": "9e841c64-48ea-4a27-88e1-9719c069fe6a", "value": 113138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577432, "uuid": "d39013d7-0d79-4613-8fc2-0d1b8dffc499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577432, "uuid": "b21ea338-9f15-43b4-b764-1dfe78c4862d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79902f66-b339-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761571988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571988, "uuid": "b13a300a-40cb-4238-87a7-186c2559fa92", "comment": "Malware payload (RemcosRAT)", "value": "83c05d4eb01c6e90dcd25d427ceb2a14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571988, "uuid": "eaf21a36-9848-445d-bf6a-eebd33afc1e4", "comment": "Malware payload (RemcosRAT)", "value": "abd56fe04c36d4373ea9cc53efa0aec3bfd626a632c1079581163eaba26a0545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571988, "uuid": "7476c777-8401-4cc3-a7d7-29784d8fd82b", "comment": "Malware payload (RemcosRAT)", "value": "8ada123c67d245e47e55575c9945677a39921bbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571988, "uuid": "6c351c67-09f5-4a67-8a6b-7d582c2e0478", "comment": "Malware payload (RemcosRAT)", "value": "3ba83372ffcbeeb3acec1845f3e761e14dda79c4d766b480efc0081e5ed1a81b65c41041b7e1b3a267b7bcccae526d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571988, "uuid": "8bd500f5-d11c-48b7-814d-b86351b4def0", "value": "T1B715239452A8E706CAE227F05EB1F13207717E6CA931C21E6EED2DDBB991F105E40357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571988, "uuid": "95d1bda3-9e28-4927-a1ea-b617bc595c47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571988, "uuid": "0fe24567-a26c-4954-9955-19c62a9c01ab", "value": "24576:oQIPpf2KPnHq2Bh+mczjIRHN75FB48GkmR7:PIPpOKPHhh+lwHN1Faym9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761571988, "uuid": "89b5b362-f151-4c84-adf0-00426c45fa33", "value": 937480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761571988, "uuid": "1eb654b0-f3e6-424f-8e6f-c750890758d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571988, "uuid": "1419b5b6-5456-49f0-9dee-362442619823", "value": "IMG-2025010-WA001310.cmd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e3759d-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607017, "uuid": "77c14485-f6d0-4f2a-a0f5-36e5051f9dd6", "comment": "Malware payload (Mirai)", "value": "39f89acedf15c695cb71acbb2585807f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607017, "uuid": "b6ea15f3-1dc7-48f1-8fa8-966a2fb13594", "comment": "Malware payload (Mirai)", "value": "ac10f28c3ce7646220621c62002f46471321a8c31be3d1ec2395e6bfdda2155b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607017, "uuid": "92bd5de9-de5b-42d9-bdad-6639f9d7259b", "comment": "Malware payload (Mirai)", "value": "11a6c05f8fb8043b37e1d6cd31dc2f9f0d0309c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607017, "uuid": "07fa3cf7-987a-470b-8d15-77e7fd4db3c7", "comment": "Malware payload (Mirai)", "value": "bcca37d42b41fc57991d5c0725c8724e15114450c767e5f594b7c622ed193f00edcf101d929b61494d9c552495d59ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607017, "uuid": "fc0f7379-a5c9-44de-a2c9-74d0edf0aa6a", "value": "T10604B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607017, "uuid": "b1d2595b-9d6b-46bf-9a92-262e94a4c3ca", "value": "3072:nKpzGweNkSfcQqmav8SqaRVlnYz655Vt:nKYweNYQqmeqavlg655", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607017, "uuid": "a89e0bd7-607d-4453-9db4-de411ce8b487", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607017, "uuid": "c58de009-6609-4370-a396-eb89bf1bf418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607017, "uuid": "b99fdc22-36e5-4955-ab47-44f5a90fc954", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592407f8-b326-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761563773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563773, "uuid": "23926c02-b899-4034-a3a8-1b456a8bc044", "comment": "Malware payload", "value": "4fc6d33d6a8f2aa8e59fd2a7595c0bde", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563773, "uuid": "220baf14-a5a5-411a-8c1d-62aa59e80296", "comment": "Malware payload", "value": "ad0f9aef42bd04f943cee62021816710c6a2132d8159a7cef3b88abe16735b2f", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563773, "uuid": "fb309b89-70e4-44a7-a55d-fde7b722b30d", "comment": "Malware payload", "value": "862191a43d2c15d0965e93c561c08e1c5fda6cb8", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761563773, "uuid": "fb1d64e3-5c95-4e3b-a8e4-c8227d2d7398", "comment": "Malware payload", "value": "e242433eeea007c02b65cde49f9c508a6f79ea0967852825ca2c8b3e9e8e194d6a100f27aac69a0afc998c6bf779fe1a", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563773, "uuid": "ce7ab6ba-43a3-4785-a2e5-4069e9bfa7a8", "value": "T13A147D417580C071EA6F06305579DB755B7EF8600FA4AECBA7884E3A8F31AC09735A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563773, "uuid": "2902febd-1be0-458b-abee-4492e0a06879", "value": "2852f79409a9a13539c08c755dc3fb10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563773, "uuid": "5f9e39ed-e795-4290-a0d0-014ad78aee44", "value": "6144:s9BoHouFxK/bu5lnou0u2mwYsCPKJyGC:sSK/bu5lx2vCPZGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761563773, "uuid": "652d95b1-57f1-4ba7-8ed0-519081439007", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761563773, "uuid": "6458c1a1-9213-44e1-a7cc-1633f278372c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761563773, "uuid": "98604ed0-778e-4b56-8d3e-f64f60a321db", "value": "DyCrashRpt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baff483e-b342-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761575963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761575963, "uuid": "5d976ac9-3867-4366-9642-53694e68c866", "comment": "Malware payload (AgentTesla)", "value": "eccf7f94c5917742ca1ded69a25dcf59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761575963, "uuid": "33e5a2d3-0c60-4cf2-ae72-dcb6efb640ec", "comment": "Malware payload (AgentTesla)", "value": "af1d46ca62d21278b42c542972a6f2b31cd4632736f8744d2a14e4de207084f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761575963, "uuid": "65ce3b32-0842-4a18-88bb-5ee3464588e1", "comment": "Malware payload (AgentTesla)", "value": "b5f2621446e0d1bb90d1947e83d925c49cdc8b97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761575963, "uuid": "ed0f4841-40d5-4d3c-b0b8-78e9d419de5a", "comment": "Malware payload (AgentTesla)", "value": "d6af8f498445fe04b3d56f5895263a5a84ebb4e696a95b670bd96d50cedeaec84492fb0317808c056fc6adfc90e9c721", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761575963, "uuid": "b36feceb-d315-4a62-a677-27d540b669ab", "value": "T16B72128D6FC2B2911233B0A32D6BB059737A2C41F58DD1B5F335C1A0F9A5718E8E6978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761575963, "uuid": "c4e35166-3375-42e3-a7ba-2aa9a198fed4", "value": "192:k2jRv+D5g0pf7N1qRM5arIYAiCLfhFamFoGbO13caNvecYdqXoBKO6z:njRvy1vqq5l/JFa+Z6xIcS/6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761575963, "uuid": "3f5516d4-c452-4f4f-8b0d-47f0aaa6be2b", "value": 16753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761575963, "uuid": "df8af870-91fd-4ef8-aed9-1fd4a530612c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761575963, "uuid": "9089ae63-950e-4d4e-8f53-f84015e7e08f", "value": "payment silp.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de21ac0e-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1761557124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557124, "uuid": "f4cf23f8-42fb-4594-b3d0-62c33cbc56c9", "comment": "Malware payload (GuLoader)", "value": "a9608f0a5daa4bb6a9a70dec5d05021e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557124, "uuid": "0164f77c-fd69-4dfd-8812-c4a3054c2e74", "comment": "Malware payload (GuLoader)", "value": "afe3acd3fa1eabe109da9d80b9d38cee777a7a74046fde36b9fe4343051882ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557124, "uuid": "26ae2efe-2ffe-4ab2-b313-035bdc5cf216", "comment": "Malware payload (GuLoader)", "value": "f4274769d3e10739a307c878aa558b0393298b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557124, "uuid": "e3cb2280-b786-4b0a-bb67-ed5a60587579", "comment": "Malware payload (GuLoader)", "value": "260a5e66f7940c3cd27d188d5b87f06e77e1a273601d6336fa39c594c2d19fb4fb32549d4ceb6acb0e0173648bb082d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557124, "uuid": "81ca7132-b911-4572-861f-f465531cc29a", "value": "T1009423007260C166D86381F2D5312BFB2AE9AD1ED2919B074768FE073F713DAE90D279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557124, "uuid": "4b1a593c-f065-435c-9a38-e76ee496254b", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557124, "uuid": "f63d8211-16b6-479b-8a3f-32cbd24d147f", "value": "12288:AcE8OLszQvAu0crxCoWU6SX5kD8UaLTdB6DmY7lW:At8/zUA8J5k6/dB6RlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557124, "uuid": "d316f90f-ea1d-43b3-905d-6df8a39c3563", "value": 431072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557124, "uuid": "f06779a9-962d-4464-a26d-98bb1c7c705a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557124, "uuid": "a585895d-4f18-44db-a43a-e34dea44c9e2", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf48024-b340-11f0-91c6-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1761575082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761575082, "uuid": "0a6b876c-3289-4fcf-beac-2e2c37e015cc", "comment": "Malware payload (Phorpiex)", "value": "388d33930a71f6a79427a516d5ee584c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761575082, "uuid": "5b31b77b-51c7-417e-a2ca-3b6f063eab33", "comment": "Malware payload (Phorpiex)", "value": "afe63f1bf0962d50b41c849e30e8cce7cfae3eea3c29a7c15f06f3c63c85522b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761575082, "uuid": "48df751c-9362-4900-ae77-021ff2702c83", "comment": "Malware payload (Phorpiex)", "value": "cd0494ba518335df7baf39d089be16b0405fe788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761575082, "uuid": "2d76d869-c3ff-4c2e-8bb7-590ec6d46440", "comment": "Malware payload (Phorpiex)", "value": "44c0200e1321917bc34bc1a4dc91aeed088c57663aa7db200548b003ed5345e81c84d5d417713eff682a025655e32c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761575082, "uuid": "a83310a7-4345-4414-ad57-d8a37ab9d4d5", "value": "T16C32090BBD909132F7E009F095BF924B8AFC29B22795698FF780B10A2975791C16169F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761575082, "uuid": "5e6ee260-5f6d-4d9f-880c-2a8e34f044ec", "value": "38ca2cef077b08d131c2be3bfd70789c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761575082, "uuid": "4e0770a6-b10d-4d99-b1e4-75ca963652fc", "value": "192:FpYy4rgxfEKZxphMfP3ff7JJfxMLkWScZqYa/DFi0F:FpYy40MKXp+TxMQWSc9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761575082, "uuid": "cb3a929e-56d7-4ab6-a258-11933d18797f", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761575082, "uuid": "f17d82b0-d9e0-4c4c-bc75-6272b7fa4a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761575082, "uuid": "9eddeab9-5417-477e-a5bb-d2ec5aa195ee", "value": "v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945d1e70-b33d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1761573751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573751, "uuid": "6bd3082f-0a8d-4abb-b60b-8a9722c986c6", "comment": "Malware payload (Vidar)", "value": "65fa716e468f3db267213d6782f34caa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573751, "uuid": "ad0f1f5a-12a4-4e46-8038-69383c57d731", "comment": "Malware payload (Vidar)", "value": "b00bbc82d49257c5fba163f7e60f9afadf30cacfa74a562ab7640951e746c46c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573751, "uuid": "5265c169-6c37-455d-a2e8-939b500199db", "comment": "Malware payload (Vidar)", "value": "059ad4c352fe0ff4f85ed4ab7ee07ad802c20f9b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573751, "uuid": "ba4b3632-d8be-4bd4-af2d-536ce4ec9203", "comment": "Malware payload (Vidar)", "value": "c3861b33a8f3f12f40fc2c77346cc73d8c8e60118e7dc40256c1b395cd22992e0b25ad0653e3085d77113c07aeeb89d0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573751, "uuid": "c7ac5e1a-bd8a-4879-b3a9-8c5d88d912bf", "value": "T1E2542376B151971DE704E372EB0BF38044E5BF6331BD70B2996D7C626AC802A298FD85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573751, "uuid": "4fedd1a6-d5ed-486c-a3f2-a5d2d952334b", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573751, "uuid": "158e1e69-8ce8-4113-8250-277503ccc41c", "value": "6144:Wet9pupTiaQr1R0X48Cs7kUcrlzgG1pLYN63HcNa3SJRnX+6Yx:Wet9wpTvqZDcSrlzgexYN63d3Ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761573751, "uuid": "08f5adfb-603f-44a1-b208-476c6af8bfc2", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761573751, "uuid": "642ca6a8-6de6-4ca7-9480-65ef0b799bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573751, "uuid": "2a0d06fe-6a73-4c86-ad1c-5d0f9b4611e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f73a0d-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607011, "uuid": "589dd797-bff9-49bc-b2f0-e7e70a5c9dc7", "comment": "Malware payload (Mirai)", "value": "daa00beb2437e1cd84046282165bece0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607011, "uuid": "41e6cf08-cfd7-4b5a-978b-c55b1ffd1472", "comment": "Malware payload (Mirai)", "value": "b070e45790a5a69eed905dbca9a75d3a50a8928c87df6c43bb59649ca52ffede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607011, "uuid": "966b5841-a906-4c84-9ba5-8007c7201417", "comment": "Malware payload (Mirai)", "value": "c822dc911ae48fca453d2a368a102bd49df2a70f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607011, "uuid": "90b9b3a6-d3bc-4b16-b287-9efb84fe0403", "comment": "Malware payload (Mirai)", "value": "24d36e18fe94779acf98f6b7874d2ac3057bcd25bd2df75fd1a1b25cc6c1ad98006ad37d2af0314ae27e7ee97214f23f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607011, "uuid": "ef442513-989a-4e5e-93d6-b40d33dfbd54", "value": "T1FA042945EA414B13C0D627B9F6DF42453333AB9493EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607011, "uuid": "95e29da4-2de2-4894-80a6-b55d9b34d6e6", "value": "3072:YzeSvyff84oALv2eEQakGzORuGMzw99Lcd38YhTfYo+M/R/qNDhpLn:QeSvoDoA7TEQakGzORuBGLcd38+x+M/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607011, "uuid": "6f5e8cf5-a719-4e53-b996-73f2e4320b26", "value": 181482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607011, "uuid": "cffa5bd2-09ae-42e1-b2da-69b1f9bbc5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607011, "uuid": "2ebac472-aa6c-49f5-adfc-fbd734590576", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c90d6de-b360-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588636, "uuid": "da6fda0b-3cdc-4f06-8ec7-ff564a2da884", "comment": "Malware payload", "value": "13b08cdc8b4c819737a8a11501b87590", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588636, "uuid": "328b42ca-8ab6-4b84-95ee-1954a7f13b2d", "comment": "Malware payload", "value": "b090b0932106b00d9c53d165309f6e19716b07d822238caafd888ef1a79d0885", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588636, "uuid": "f02862e9-2117-4e06-b559-6c47d095645b", "comment": "Malware payload", "value": "5ddafae1529e5c066898193d2c8498396077be46", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588636, "uuid": "adf917c5-863f-4711-ad96-f713a761c08e", "comment": "Malware payload", "value": "fca275170115b367fa3c3fb11682235b86358188beb713be9f76244f037e6815ae342987093d0c8b6422f0c98949f259", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588636, "uuid": "51530f3d-0f19-4a52-a458-89702da18cf2", "value": "T1BDA69D25A3E504A1E56BC734CA56C333CAB97C928635D20F054DF6C61F73A628B2F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588636, "uuid": "72692ba0-f331-4fe6-b4ac-35f53b8e9724", "value": "85ee00699c62c4d2b297b76819c00f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588636, "uuid": "e45fbe82-5614-4db6-811f-78010deb27a3", "value": "98304:4L3ACfXaDkJaT3IOsn3qEsB8B3KUKbCwsVtqqR6ZOEB9r:4LdfXawa7IOsEB8F/KbaNEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588636, "uuid": "4ab42c11-1b45-46bd-913d-e9c62d9c5259", "value": 9691136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588636, "uuid": "21e9b323-e028-4189-aedb-fb84594d3433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588636, "uuid": "1670f9d1-1dff-4641-b9e2-5cbe795db6d5", "value": "MSVCP140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30b86b6-b33c-11f0-91c6-42010a9c0006", "comment": "Malware payload (AMOS)", "timestamp": 1761573346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573346, "uuid": "6864cf34-cbdc-46b1-aab9-5c13952780ed", "comment": "Malware payload (AMOS)", "value": "6a24e208c3bf580408cf34b12531a5fe", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573346, "uuid": "bebd8064-e7fc-49b1-b421-213da044e1e1", "comment": "Malware payload (AMOS)", "value": "b34241006b130412756e834250f2f73da11f895183040618e030b50b5951da9a", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573346, "uuid": "293e7b5a-1d79-4693-9b6b-bf128556a13c", "comment": "Malware payload (AMOS)", "value": "4be451826ff82123cfcef0cad87903bdf1ae0bbb", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573346, "uuid": "fbe5de83-7d19-47bd-b213-8ae22a77ff9c", "comment": "Malware payload (AMOS)", "value": "0f1cb451ec5026fd1fef22ce1b75633f74f66a8ef374be415c399a046fcf6fcbb7a4bfec2b06ea90d3baecd97ca623f4", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573346, "uuid": "f164d4f0-1d38-43e8-ad6a-1541bcb22b3a", "value": "T178C08CC2863CD471523D0E4EF290E0F4AE4658240BB078A1D805CA8020244B80C0F73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573346, "uuid": "eda05b12-fba0-400c-a5db-fb1939963844", "value": "3:WFBIx8sv3uy9Fb+dNMft9FXOAzLeeymHgmQmk0QQHFxaFOd6HhC:/9vrbsMfbFLebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761573346, "uuid": "13123b4f-780b-40c3-81bd-eafbca465709", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761573346, "uuid": "59bdf310-f43f-42ee-8c4c-36db2c4fa732", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573346, "uuid": "75f96b07-439e-4905-8447-409fbfdce192", "value": "hbjo8tc0uv.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907fcad2-b30d-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761553128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553128, "uuid": "c3df88b3-70b4-49ad-8d71-ef6f6d59c723", "comment": "Malware payload (PhantomStealer)", "value": "92293bd45a3c5c53bad3156084d25f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553128, "uuid": "c7522e72-19a8-4a3a-bbe8-a691ed862a11", "comment": "Malware payload (PhantomStealer)", "value": "b633f26713f9c55ee4ffa88e6683a5907d1057b3a6c42098aea67452b05ad3a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553128, "uuid": "0326560d-2389-45b7-b5cf-9083faca39b5", "comment": "Malware payload (PhantomStealer)", "value": "e010b7e07205cc2e00b2cf92e919d800b693e175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553128, "uuid": "a10ad82f-3154-46da-87e8-a847d49e13b5", "comment": "Malware payload (PhantomStealer)", "value": "e544e132c7da777520f9d432079b6d6b181ac9b225c59eaf7d3c6332bc967012942fa3da0655da086090e125a54d3b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553128, "uuid": "babf8cf7-d044-4c9f-bc0d-bf16a47cbb0f", "value": "T1374523645248D20AC6BA7BB419B2F27047753C99F930E2066ED92CEF3AFAF545E40353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553128, "uuid": "493c3bbb-3992-463a-8857-b6dab64a2ba6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553128, "uuid": "a410f7b2-edf1-4993-87a5-32569ff2ad26", "value": "24576:bQDYG6bWgTmfLOi0vkR3UcvCjX33zIzEOArNRz+ZT1bNNl+2S0tH:EkvT2x0a3PvYUgOYNpWpl+SR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761553128, "uuid": "df59204d-2289-4371-84dc-d0c6af8c4ef5", "value": 1201152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761553128, "uuid": "34f89c26-6cef-4092-8643-6d4469f51bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553128, "uuid": "d77cf6f6-964c-4fd1-8eb9-8a5395e2f686", "value": "SecuriteInfo.com.Win32.MalwareX-gen.30738.22667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e84300-b361-11f0-91c6-42010a9c0006", "comment": "Malware payload (GoToResolve)", "timestamp": 1761589101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589101, "uuid": "2cf8ab41-152a-45b7-b2a6-5f17924bcbbd", "comment": "Malware payload (GoToResolve)", "value": "81baec404d9876b686da9f6916d044c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589101, "uuid": "ec7cdc3a-75b1-4c47-96ec-8cf123269bc3", "comment": "Malware payload (GoToResolve)", "value": "b8c684dbfd92da40e60172ffa8459ffd9e23a143361e3190476e046882d9ed7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589101, "uuid": "0425e571-cfa7-40bb-9dd8-d9071bef7712", "comment": "Malware payload (GoToResolve)", "value": "f8777eec40951e8c506f1f7376e3eab60fccbdbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589101, "uuid": "45d25dac-72db-49e7-86a1-7ddee6c12a31", "comment": "Malware payload (GoToResolve)", "value": "bc2cf960104d1ac54517b0debc0f6636c40f8c8e85e213c97b4022641c4c2bc5577a95d87d6e756fa0f2fbb4b0e74636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589101, "uuid": "e4ed7048-b585-4a2a-857c-a59db3710eec", "value": "T14D37333132568471DC5211F1E929AFBBD66D6D248BB208D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589101, "uuid": "af28a4f5-9a2c-475f-abaa-372a25ba8a59", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589101, "uuid": "b71439e7-9a74-47c8-ba32-7539f4641761", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpC:q9WtLzgOTbjZvk/ekS/mcpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761589101, "uuid": "b440f178-2373-47ac-84de-4ff1e7137323", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761589101, "uuid": "f7ad04d8-821a-4fbb-bc83-a253087e0005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589101, "uuid": "3234bae9-9045-4676-a511-ae596c26db69", "value": "Abounding_Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d48b7a-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579145, "uuid": "420c0aa3-66a5-4f88-83ea-b1f23c5fa077", "comment": "Malware payload (Mirai)", "value": "886c20aefd465573d387ebfc28adc87c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579145, "uuid": "ccedd079-64dd-49b9-be29-811ce1a620e1", "comment": "Malware payload (Mirai)", "value": "b993c09028c5d5628e1c72aafafbd15d4c6b7c0e4f1a0e58c31647166550056b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579145, "uuid": "1f3c4b88-6f50-490e-8686-8a6b691eb244", "comment": "Malware payload (Mirai)", "value": "3d28945e5c3a58bf9a21fb9ddf916873558da96d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579145, "uuid": "a1237682-b2a5-4aca-9ef1-91747a78211c", "comment": "Malware payload (Mirai)", "value": "b7d22ee075983ae43e27c8c6c534146d1491f0d87e1b6a9a8e5b3a4a6621020152287765b7f77dddbd06c77e5f7a3e92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579145, "uuid": "e12c4af3-be5b-4dee-a56a-e9004d2510cd", "value": "T11E235C41765C0E47D2A65BF4293F17E083BEE9A020F4F588260F8B868275F77518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579145, "uuid": "b048731a-d5a9-41a9-b222-2d6836f106da", "value": "768:9qkwvgVaz33B07Du4X9vRssRp6wtw6inWZV9C5Ak5NtVABUks/5W7ydEx:aYVrW4XVh6wtw6Ma7wZm/s07V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579145, "uuid": "5e2ef498-f4fb-455b-9a01-aa4743be3bda", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579145, "uuid": "46ecc3ef-fa07-48ea-af3c-8f3614481cc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579145, "uuid": "d5d4e50f-1e56-47bb-be66-b82a71d7e61b", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b14609-b361-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761589317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589317, "uuid": "52763df4-926c-4047-a046-2458da3d332f", "comment": "Malware payload", "value": "030a6b9cee8aa8dc2ab850a6d158ecb7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589317, "uuid": "39acb391-9169-42c0-a234-c76e6f45666f", "comment": "Malware payload", "value": "ba362af1a2f6867949ce14606b1acdea1f1de295d65dcaa1e36094c827f4dc13", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589317, "uuid": "08be5f2a-ea47-4f44-b261-edf0e0679c4f", "comment": "Malware payload", "value": "56b46c639850f3fd213b7ed58e2542a98b2d6d8b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589317, "uuid": "401ff442-c391-46e4-9213-591017198072", "comment": "Malware payload", "value": "efc685687cd6458ec49c7a17fd67b94af1068fde025d94439956d05297b06b9ccb82a00820ca0aa164237acfbf543b6f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589317, "uuid": "30b58bd9-4a3b-4de9-951c-96f1df1e8203", "value": "T11AE15215A1C0EE2D83B380156BFBA14DCE2048D784466999B55D12276FBF98C2E77F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589317, "uuid": "b4190a86-8f2f-4313-9c7b-42ae2eccc108", "value": "192:X2aF/kvIrWUZieFoFyjY69JpRC68NRVSqsDkxnFKKBrB2BN:X2aueDkxnFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761589317, "uuid": "11657a3d-cae2-451f-99d7-bf546d81c5c2", "value": 6900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761589317, "uuid": "7e897c79-a35e-4a9b-8a17-3fe2cd9ace33", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589317, "uuid": "270e7039-7289-4432-a598-f4f2bcddb369", "value": "-1.14-windows.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be216746-b343-11f0-91c6-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1761576398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576398, "uuid": "14d7e99c-1302-43b6-aa89-f2d8e740a563", "comment": "Malware payload (Arechclient2)", "value": "d03145de36a8538aa2120a58e2f1030d", "object_relation": "md5", "Tag": [ { "name": "62-164-177-36", "colour": "#6BA3D8", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576398, "uuid": "16b2d05e-1329-4a57-aeab-c07a59f9959d", "comment": "Malware payload (Arechclient2)", "value": "ba699da64d44b039defd4f42340bc7bec888b8dcef135d5735f2af309ce8ce72", "object_relation": "sha256", "Tag": [ { "name": "62-164-177-36", "colour": "#6BA3D8", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576398, "uuid": "a27982b4-853f-4f94-9f51-8c36d90ab8fd", "comment": "Malware payload (Arechclient2)", "value": "4c8c4b7dbcdc1984355f89ba7fe9d47625192025", "object_relation": "sha1", "Tag": [ { "name": "62-164-177-36", "colour": "#6BA3D8", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576398, "uuid": "f12e2c4d-e3d9-45ab-8194-095c0bad0572", "comment": "Malware payload (Arechclient2)", "value": "c83536e79ced51bb3e1b9a880b6fff215f5500858a6b764e195e8c66ca639d7e7d5512fba931104c2825a59812b395e0", "object_relation": "sha3-384", "Tag": [ { "name": "62-164-177-36", "colour": "#6BA3D8", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576398, "uuid": "c0d4bf33-86c0-42ac-8c7e-100644ca7cac", "value": "T1A3E533623B178701E10A9E31AA98BFD8C3E4AEC153E48224D69FF55C0B72DEE41E57D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576398, "uuid": "a9067aef-60cb-489e-819f-74973053f2bf", "value": "49152:cBMntJOMhe50ckXRst4GXdy0lY9Jhjr/KLQixPPHb0bZtLUT81wkUHb0B35H9Skx:e6bOMhwEXRiXN0JQvlYUg1wkSbypHcpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761576398, "uuid": "6a109a70-d45c-4403-85ed-ce6bc5a9d0fa", "value": 3039232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761576398, "uuid": "7651db39-12d4-42ae-bb6a-2b78629caf5a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576398, "uuid": "ec1f8c88-968a-4749-ae0e-53ce4909f7ae", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efbdb8e-b334-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761569715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569715, "uuid": "fe937d36-f4c7-45f3-a5a4-88dc04c69ef9", "comment": "Malware payload (AgentTesla)", "value": "005e8f8dfb15e4db0ddd915de60b77df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569715, "uuid": "11ec8960-0f2d-4026-95a7-5fd9275a7f84", "comment": "Malware payload (AgentTesla)", "value": "ba6c6d03831cb1d23fb172ad4f44577801bc479a0fa2e89edb6979d74c502407", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569715, "uuid": "b20b1b8f-b01f-4733-a1ac-fdd6ee22841d", "comment": "Malware payload (AgentTesla)", "value": "77c7711b64d6d36e52971f28712ec4590d83da6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569715, "uuid": "bf835944-d89b-4e22-830d-95476aa65bf6", "comment": "Malware payload (AgentTesla)", "value": "520620e6aea07494a06232c555f8946d6378dc52b0346de507f1fe098824458c5e68489d5374b82a4d24e1b1da5e8b4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569715, "uuid": "8c7c8c08-d7f4-40cc-87f2-c2a52b687942", "value": "T1034633605F89BC83F9D32C6C92755A1F12001EB5284B322D93DE2F9D1A667F6E2E1D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569715, "uuid": "346e6118-8515-438b-a0da-c05f93a7d1a2", "value": "98304:7ubO4mzSyL0NIlfrJ+L0xsXC+tjMnECCvbu7rmZE4j8FVcCdYSLKAx/ow:6n5i0NIlfrQgxshynEzkmZE4jkOSLNxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761569715, "uuid": "64af173d-feac-44a3-bd13-d015e8ea0003", "value": 5473653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761569715, "uuid": "1b1991df-9296-4225-a7ad-b2b284321257", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569715, "uuid": "a085a98c-ff42-4007-8714-78d3e311fec2", "value": "aaa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859b4b68-b36e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761594771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594771, "uuid": "fe5db429-d629-4eb3-a8cc-508ee3f5e810", "comment": "Malware payload", "value": "d47606aba129287ba8fb99572baed350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594771, "uuid": "eac2eb09-bc26-4a3f-a0d8-f48fcd439ced", "comment": "Malware payload", "value": "baa808ebbdafb0caddf42e0bc6a20c59064941b18eaf13e166d1e7840154ff90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594771, "uuid": "88e2a9c3-bc15-4f2e-bf9c-ae596bebd49c", "comment": "Malware payload", "value": "5736ba8888378519e6f6c8bb850fde72d8b747f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761594771, "uuid": "7b6d4757-1e9d-414c-a6fd-fff757e3a8d6", "comment": "Malware payload", "value": "79c3ac6d75c602052fee1dffbd4ba43923a15f3c90327e98a30eece71b0de9ce8e3fb8eb64f29eae01cc728f17898395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594771, "uuid": "8d1ca1bb-8f6a-4e6f-b783-57ab2afcd383", "value": "T1EBC402586B5EDD13C9A22FB11A70E37526709E19E820D2134FFABCE7B4A9F05394C352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594771, "uuid": "1ce1897f-646c-47db-ba82-2a158a6cbea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594771, "uuid": "fe2ded68-2631-41ac-a45e-fe7d3607942d", "value": "12288:zbYLCifQhKqcpeNI7xvAM/3nkBuMNClfiKoyvROhVDTH2EmFSatxsFyJx:PYLCuDvpQWlAM/3YuM8QLnVgSaDdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761594771, "uuid": "5d928dbe-fc4d-48cf-af91-173811fadd63", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761594771, "uuid": "e6e4d5b9-7639-4277-aa69-079c5fd8b966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761594771, "uuid": "9daacc26-23ab-4a16-8946-c2255b87eca5", "value": "new order00778893.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3654acc4-b358-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761585189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585189, "uuid": "cb368bf3-f295-4993-86cd-e78158bd7c43", "comment": "Malware payload", "value": "b4cf52ac6905e63ad20a61792035f2ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585189, "uuid": "9eb22e93-7af7-455c-aa63-c910f1b410ad", "comment": "Malware payload", "value": "bbb0b744632fe251819233d4c693758a4e8d20b3b88f5605a60aaebb4ae1ed9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585189, "uuid": "09ebba5d-baea-4aca-b12c-bd6a52285022", "comment": "Malware payload", "value": "a4a079160d2663fa8edf6cf9b9e3d361232a1742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585189, "uuid": "30e099b7-86bd-496e-9df5-f6d2cbbe86df", "comment": "Malware payload", "value": "372ad07ef496d2e5c94d599d128eea645f17eba0fd931884c37397bb93ebdcbd9efd4e9dd52cac159052db97046441bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585189, "uuid": "6d5d02bb-f68a-4f58-b1ea-3e9eb64ef6c9", "value": "T156E5C21EA854805EC75585398F6A41503A32BECD3F2312D31592B67CABBF6CB743AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585189, "uuid": "a5ef6339-4262-485f-aa09-5203d94437be", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585189, "uuid": "3acda8a7-e5d6-48c3-9465-ffaeb9ef045a", "value": "24576:55mNvHjkHpYPfQic1WGsDzjTDzjTpGlwN+JDvbPnnPR6LulS35rLGmDFKn8Otfdq:55iPjkqfXc2Gnndly13+Gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585189, "uuid": "37bdca6d-f5a6-4a14-a8d3-5914f1aca0b9", "value": 3143992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585189, "uuid": "f8e5956c-f38a-4e7c-901d-b65ac4df51a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585189, "uuid": "d499005b-6004-4d2d-88e7-7c2be39d903b", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55a5871-b35b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761586691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586691, "uuid": "d1a47340-e5aa-4bb0-af1a-c37a4253209e", "comment": "Malware payload", "value": "31594871483d48def42308d66132f521", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586691, "uuid": "0f6a490f-40fa-4dcf-9c20-bafc80bcbed6", "comment": "Malware payload", "value": "bbf26a39e64b13e7d547d6d8800ca762ad48aed44976868523cac6bbc97346f0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586691, "uuid": "57e213c2-7bdc-4110-97c9-b25491d929cb", "comment": "Malware payload", "value": "0862b71ba3837824b6b6b55c1426dc1e20b54079", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586691, "uuid": "817c16ba-73d7-4e44-b8bb-20d623c83a03", "comment": "Malware payload", "value": "e5f59f49b474a8410b086141acf2f4b3c64087a4602251688e7a065eedf88b222e3db4927e2df31a1401e138ac2c812f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586691, "uuid": "7afbc5ca-5635-4398-b3f9-dbe5fb9c239b", "value": "T13AB63345A3E144ADE8F7443E95E2D018E9F2785A0B5CD69BA35C22E32E335E06D3C772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586691, "uuid": "5b2b4cf5-608b-4c1a-93ea-838e0e84ef41", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586691, "uuid": "de77d371-333c-4569-a266-3faf8c3efac2", "value": "196608:+CNG6eSYXMCHGLLc54i1wN+QjXx5nDasqWQ2dTNUGTlS+iZT/SOm9W6jfMLH0ID6:+CUXMCHWUjojx5WsqWxT54TrwtjED0IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761586691, "uuid": "ea0583c6-c7bb-4584-b8d8-7617dbb9b902", "value": 11445857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761586691, "uuid": "71f5747c-301e-4d46-a31a-a9b8d752bd41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586691, "uuid": "f0e1a50e-71a3-40a7-92f4-49f50d27804f", "value": "hello.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b1f5fa-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761557001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557001, "uuid": "5e6e5575-c7ed-40c9-b591-9189f12d7ad3", "comment": "Malware payload (RemcosRAT)", "value": "f4abb9a1392b5c61411812dd5ac07b1c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557001, "uuid": "453e1b06-ad70-4a2a-9470-171b0c288f77", "comment": "Malware payload (RemcosRAT)", "value": "bc0df020b8051a657aab929242f108def8099da56af41da02b8d833f3e5e453a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557001, "uuid": "8f4d24f3-a60e-4c9d-9e8a-9fe389413440", "comment": "Malware payload (RemcosRAT)", "value": "c3b3b5045ac7ed9084101d04b16937967cce20ae", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557001, "uuid": "a6461261-311f-47d8-952b-9adc0e8e712c", "comment": "Malware payload (RemcosRAT)", "value": "c44697a60c1f268ae2d23f1f0c7f57072ea03792a65f21fb7345b840cdd5c3fa5f3cd75cd6029dc3a5a3bad0c882a690", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557001, "uuid": "9f0b6f27-3cd4-4ca2-8d67-089d115c1468", "value": "T1DA936C31FA2661560D072BB9FC5A5AA3CDFCC525055310F0BEDC178D520A9ACA3BDBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557001, "uuid": "21cdd50e-45ff-436c-84df-fa775c619487", "value": "1536:qQ+OJ/B5YTlCAKUGUX4ltpWDZ1K5cwv4fVBhcZYYZH/RUnd5A5LVmvKXGeAa9c:q8B7YJCAKUGVlHWDZ1Ev4dHYL2A58vEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557001, "uuid": "db4ba6df-bc30-4aca-b0cf-b56fcd15a9a0", "value": 93772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557001, "uuid": "6f439a6a-7cf8-407f-bcc2-d22283bc85da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557001, "uuid": "a91763a3-21d7-447d-bd7f-5694e9f4620f", "value": "Confirmation Letter_Zafarxon^J LLC.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328fc687-b368-11f0-91c6-42010a9c0006", "comment": "Malware payload (ConnectWise)", "timestamp": 1761592055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592055, "uuid": "1796bb13-c627-4d14-9616-ff4f82cb9326", "comment": "Malware payload (ConnectWise)", "value": "0bb4bc5aa200a14a9af65ea221a1bb4e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592055, "uuid": "b9a2ce39-53ed-4c1e-8949-108be02a684a", "comment": "Malware payload (ConnectWise)", "value": "bd12c6d8caeb7e4a473c37878435e812db9a379b435ac1aa66b41e1036eb02eb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592055, "uuid": "44f0c5fe-d13b-428e-ad57-5840d5351ca1", "comment": "Malware payload (ConnectWise)", "value": "71d9e693edb1956377ec7cecaa59af323d0ae5c6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592055, "uuid": "faacf207-14e3-44e9-add6-39096b87cabd", "comment": "Malware payload (ConnectWise)", "value": "b8b972108ab1707d75f81d254d65c4a5f88944de9b88335c7591fbe8750a9d652b075b0e136564b520f5de9cbaf3b14c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592055, "uuid": "4ed8b5b0-e31c-47f4-bb63-bfa29771fc46", "value": "T1E6F6230222ED8565E9F3173AFA7A86A01A347C389912C06FA761391D1B73F4094FB777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592055, "uuid": "2cb3749d-09d8-445b-b9d7-d6a1d0fd3e46", "value": "393216:oT3dHx9fWT3dbT3dNT3dMT3dTT3dYhFT3dYhYT3dYh:Q3dHrG3dH3dh3d03d/3dI53dIA3dI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592055, "uuid": "3555c563-95c8-4730-9f43-dfd8671de167", "value": 16670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592055, "uuid": "73ddbc81-86d2-499e-909e-d19b8bf06fe0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592055, "uuid": "7931a855-66f8-4fa1-8853-5d6014ab69a6", "value": "Microsoft_Excel.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcb6c90-b30d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761553127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553127, "uuid": "1716ba91-f8c0-4511-9e2d-f1e6a7027409", "comment": "Malware payload (Formbook)", "value": "91ad126d31b105372d21bc55c124ea30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553127, "uuid": "0f2302de-2f56-4c8d-ab38-45c4f76abc8f", "comment": "Malware payload (Formbook)", "value": "bd289bf197d4a84046ab10da52a56de48eb317801d3931fb7b2fc36b279083d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553127, "uuid": "305e824c-71ba-436a-b864-f3ecb7c1e418", "comment": "Malware payload (Formbook)", "value": "7863d4ac6a0e127b853cee16f22869b5baaaec2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553127, "uuid": "d017df50-5028-463d-841f-c772f4c6768a", "comment": "Malware payload (Formbook)", "value": "81b495db87d0e71073a7c0702fcb8743e06f9d54fb11d79defae53d9d444b276a9e42589f4d12129060ac50a97293f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553127, "uuid": "5a60b1eb-42e7-4b6e-9b13-7205404ea530", "value": "T16AF412285799D603C9F627B50DB2F63117BC7C6AA432D25A6FC9AEDF7921F008D40382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553127, "uuid": "5c766c9d-b79f-4251-95f9-51b18993ec6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553127, "uuid": "ad08e743-7b6d-48bb-af11-5a5db70fb1f2", "value": "12288:xgIPqwMOnUgEYLp8i0iyH3l+aRLTiZFM8kpkABATWCgE/OLth7u5/wIvn7dE8Q:auqwMOnQqBgLkFM8kpkAK69gihKwia8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761553127, "uuid": "c99feda1-940c-4988-9526-93b54036ab9f", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761553127, "uuid": "584fc5df-843f-4e19-9b48-16017f898682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553127, "uuid": "9ee862f5-08d7-43fd-8be5-8d952795fa03", "value": "SecuriteInfo.com.Variant.Genie.8DN.710.30680.25610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e97290-b354-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761583704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761583704, "uuid": "c9eec692-65d1-44ea-950e-a68bda98f3ac", "comment": "Malware payload", "value": "0ee0493b61680069c7d82ca2606d5eee", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761583704, "uuid": "f02d7a11-abb5-4ecf-8acc-f87acca2aa9d", "comment": "Malware payload", "value": "bf3c6d80f5fc1193975deb917e118716f8a9c628895456ba1360711fa02e015f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761583704, "uuid": "caa049e8-cd13-41fd-919e-eb511a689996", "comment": "Malware payload", "value": "24f95d8779f911678876b426640b365b90c2c624", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761583704, "uuid": "4fb386cf-b53b-48a3-bdab-f98eabe40535", "comment": "Malware payload", "value": "0e67907c54eadc99c3e98b3ca3a9f868885a95162d1e3903dc4b55775c4fa3039d2a0c90196045c19c98d90953ea1c88", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761583704, "uuid": "7371c4e8-166b-4543-99a0-f2c4e0241694", "value": "T123B423530D5D548CF4D7A9728CB7EA0DA6304CC2B9886931CC2AAB502B6CF3B967317D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761583704, "uuid": "351f2321-4649-44e0-a412-f9013317befc", "value": "12288:YqzHcSGBLvG9p0RgdNp6omm1nd1hInr2X/npIc2jaD/bkY:YSHPGBLv3Rmom1ndrsr2/31/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761583704, "uuid": "55067c63-2ad0-4bb6-958c-0b9854b8985a", "value": 539558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761583704, "uuid": "fbff51ad-c01c-46f3-89d7-95283593f0ce", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761583704, "uuid": "c8d74e5b-3b10-4281-93e1-09072d74fd61", "value": "F\u0130YAT TEKL\u0130F\u0130 ALINACAK \u00dcR\u00dcN L\u0130STES\u01302.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02171b62-b369-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761592403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592403, "uuid": "9e379d88-d249-4981-859a-2731718d2203", "comment": "Malware payload", "value": "a6ea82be7b6b38a7ea139b15ec9e783c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592403, "uuid": "23b013bb-8428-42ca-834b-7886764d6d71", "comment": "Malware payload", "value": "bff643eb651973f174da204f33c0b67985e58d20d9a542a167358f9e20df236b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592403, "uuid": "cb02c02a-9364-4d82-a751-99ed4bf036c9", "comment": "Malware payload", "value": "1c3224cf08c0b73b132e0adc0fefc4018d8f0692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592403, "uuid": "fa8c39f8-02e8-4643-8868-b3b8262650db", "comment": "Malware payload", "value": "512e46a35bd565f84292ec54896f391d7a86ba142a05e56f8d6155305f22acdc21801e06f220b2cb933eea85550ea2a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592403, "uuid": "9fc9fa8b-4ce1-48fe-a244-db5efc3ad927", "value": "T178F75A4267FA04D5F9F7AA3499F65213D633BC166F3085CB224C172A1F736E089B6722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592403, "uuid": "6fbcd760-972d-4aeb-b2c3-0701a0d0167b", "value": "e615388aedbc25fe64cf6e074ffe90a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592403, "uuid": "18d4803b-422f-40c8-b7f2-fabec8da7ba5", "value": "393216:jRTVp1ieANgk6frCK9eQkMfC6L1uu1k/gD9V2+3rQSI8w5SvDazn1d5VRmNpO5vk:jjptA6k2BPDtQlRVNH877pgPVlcmjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592403, "uuid": "ee33bdb0-6ad3-4e66-a912-90f651dac37d", "value": 73013922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592403, "uuid": "7c5ff17c-c7e7-4d84-9b2b-3e1cb7a3ec09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592403, "uuid": "4b3c388d-3979-4d9b-8f1a-856aa2841a77", "value": "Aero.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98519d64-b33d-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1761573757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573757, "uuid": "b00c3afe-9983-446d-8afc-045d27e49062", "comment": "Malware payload (GCleaner)", "value": "fdbaa6b743b781968b127274f5e72514", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573757, "uuid": "74b3123b-2bc5-402f-90bd-d7cac39af104", "comment": "Malware payload (GCleaner)", "value": "c001fbe8ebf471c1bc5c85c90dfc339eb8ca252be0b1bcdeae16c98c4fd2b9f4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573757, "uuid": "f78ca6f9-ac98-4220-8a1b-dc6d50a1766e", "comment": "Malware payload (GCleaner)", "value": "c814e71e7846c8ae9c3a4dd9ded8fc993ac82d53", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761573757, "uuid": "fb980668-452c-43ec-a538-393618781b59", "comment": "Malware payload (GCleaner)", "value": "70509030a79a6f5ba6fc10969a94a2921f4aad42b28b8fbce15a3d7d08cc10aa60c5b937c173d55bf4285c865da76913", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573757, "uuid": "12673d3a-8907-4c2a-aac2-825eae39dbe6", "value": "T16F16E171A39D5962D030D13F2B0D93D7612F3DC87A6EEE5022ADF3461DA6DB03A0916B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573757, "uuid": "be2a9092-5541-4780-9e2c-82c966cc0b59", "value": "513d0d27bece74b1bceeb6501edda78a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573757, "uuid": "0b769295-b346-4666-9530-0eef8c8fdb56", "value": "49152:EO+5P6uKVnHnfLE2wp5LBoHN7tI2IMEdzqguDhU20HzznIaTAsw+h+PC:EnFQ1H42EBkTQ/z+U20HE+hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761573757, "uuid": "cf7705fb-5f13-4285-bdb5-fbbe9c22d959", "value": 4386576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761573757, "uuid": "adac00f8-6f3c-42b0-9435-97bab075ae99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761573757, "uuid": "6aab5244-4bd6-4ac4-bc0f-4e49156fe66c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa12f32-b349-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761579049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579049, "uuid": "ea73283c-7c40-4480-8f2a-af086619d93b", "comment": "Malware payload (Rhadamanthys)", "value": "cadfc00c9c4d5b295c5865d17c035274", "object_relation": "md5", "Tag": [ { "name": "202-71-14-164", "colour": "#A541D1", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7099", "colour": "#F772EB", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579049, "uuid": "c674eb1a-525f-411c-b7e0-4654d949f4e0", "comment": "Malware payload (Rhadamanthys)", "value": "c076c979a7838bc3c2b40036bef75ce0cff254c58300794ac3f32dac46288d5b", "object_relation": "sha256", "Tag": [ { "name": "202-71-14-164", "colour": "#A541D1", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7099", "colour": "#F772EB", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579049, "uuid": "06984a65-22ed-4dd8-843d-3be4c4ddc984", "comment": "Malware payload (Rhadamanthys)", "value": "7acc05d7868e4e4597515efe8c4ff9ab4e236288", "object_relation": "sha1", "Tag": [ { "name": "202-71-14-164", "colour": "#A541D1", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7099", "colour": "#F772EB", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579049, "uuid": "40f5645f-8ee9-435e-a9a9-f3a03bd7f0b2", "comment": "Malware payload (Rhadamanthys)", "value": "95acf8b02e12c7cf12c63a7ca347b744e44ae212ca1508b63e2f8fb4682171a3495c8d8dbfea3722b6dbd6524f1826f4", "object_relation": "sha3-384", "Tag": [ { "name": "202-71-14-164", "colour": "#A541D1", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7099", "colour": "#F772EB", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579049, "uuid": "398d355b-9340-4ff7-9c14-07a76e4ee351", "value": "T1F8F633B73B5AC90FA624544E90DF92399B866B8BD9DF12300EDD11C35F05BC06CAC69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579049, "uuid": "d671063e-2739-4a60-ae86-74142a275141", "value": "393216:T9+bny7690LQp7QYDTstcQcclsWHwJAYzsV:T9mzSYEPcclsdJAYzsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579049, "uuid": "cae7078b-14f6-457c-9395-d0129b030ce6", "value": 15521219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579049, "uuid": "8f8b4f25-6721-4def-af58-4303b61d93d2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579049, "uuid": "0e4c88e9-cf89-4b69-b5cc-8aa90257d528", "value": "revo_uninstaller_pro_v5.4.3_ _fix.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208db229-b312-11f0-91c6-42010a9c0006", "comment": "Malware payload (Prometei)", "timestamp": 1761555088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555088, "uuid": "47f8942e-3536-417c-b74a-a04dd9471680", "comment": "Malware payload (Prometei)", "value": "0daffca5dca6effb58d64619607cc6a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555088, "uuid": "c6119719-3bb3-4f85-8169-d0565fcc6d94", "comment": "Malware payload (Prometei)", "value": "c0dfbe27877c54e2e546908d518a9a1683ed597871ebbdd4b692bda27ad50923", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555088, "uuid": "a7c387e9-a050-443b-ba61-65c71c33e5fc", "comment": "Malware payload (Prometei)", "value": "93e3845529cb7bab2b38e1329437b32e580fa353", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555088, "uuid": "c85b6f5c-8a6c-4451-bc89-ffcbb9202a86", "comment": "Malware payload (Prometei)", "value": "590f6be7adf7c8f48e9f4f00a15c4235eed3b5dd88d12d441b87b5113b09df5c6fc6200258fdc8b1a6825d97f6842efa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555088, "uuid": "0ea49e1b-0041-494a-944a-bd2f2852f8f3", "value": "T14D9423FA5B8EF2FB09127F7027A0A80181A47470F99D675986CBFDDA0FA52679CC4118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555088, "uuid": "aed398d6-05a7-446d-a420-04420ed0c549", "value": "12288:4a6aYYIX2dWVxeJAaLYxAOfUhjXb44UfhlBeL8:V+2WejYxUxsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761555088, "uuid": "24b0a37c-8301-4416-810a-cc1b92e4a164", "value": 428387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761555088, "uuid": "1b10328b-f868-44d9-9200-956591a84dbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555088, "uuid": "174aa405-d82e-4d09-8bbd-7339b0759a64", "value": "c0dfbe27877c54e2e546908d518a9a1683ed597871ebbdd4b692bda27ad50923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aec42c8-b345-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761577010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577010, "uuid": "8902f817-d2e7-4991-941c-12b96db4b705", "comment": "Malware payload", "value": "03e71e49eb6c5898ab51d976756c60d2", "object_relation": "md5", "Tag": [ { "name": "95-216-21-113", "colour": "#32DE3A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577010, "uuid": "df1eab60-6e44-42ed-ab3a-58d0080be753", "comment": "Malware payload", "value": "c360caeeb33a577d3b3398d45cea35c97e1989ec98f80d11eec1c2a715697bca", "object_relation": "sha256", "Tag": [ { "name": "95-216-21-113", "colour": "#32DE3A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577010, "uuid": "7a020548-85df-4757-9836-80b7bcf46043", "comment": "Malware payload", "value": "d81f4989105705a14643a36bbedabcdf076cb617", "object_relation": "sha1", "Tag": [ { "name": "95-216-21-113", "colour": "#32DE3A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577010, "uuid": "21a087b4-0b03-48d8-b7c6-4b86d6a255e8", "comment": "Malware payload", "value": "9a1fd7a12b71e903eb3ed8d86e75b38a58fedba7bd582429b0b7193ad2fee21655795f1e12b4e59ca4bfbbb68681e923", "object_relation": "sha3-384", "Tag": [ { "name": "95-216-21-113", "colour": "#32DE3A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577010, "uuid": "b5c8d8ee-0141-47e5-85dd-167934a844ec", "value": "T15A967C07EC9149E9C1A9A331C9A79253BA71BC484B3263D72B50F3382F76BD46E79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577010, "uuid": "73a504af-42fd-4906-b5ef-b57b0de191c6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577010, "uuid": "814ddfd8-e2cf-40e2-99f6-2ab7fc480a86", "value": "98304:l8O9SCQJfWYylXMYvdzE29FOmI6rBBIHnIA80BvqpygmeS:lrQFWYqXpu2vFBw8kvO/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577010, "uuid": "c42505f7-5dcf-42c6-ac2a-7a9f8b250a5d", "value": 9317888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577010, "uuid": "dd1e4b77-6677-4b12-aa88-50977827c8ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577010, "uuid": "c3a93239-eb36-4cb6-ba5e-6bf87aad353a", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a824bdce-b329-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761565194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565194, "uuid": "3bc42d73-0e7e-49a2-b9de-9ab4978d7e66", "comment": "Malware payload (Mirai)", "value": "c52f8c527b653b4e717854286de70c29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565194, "uuid": "72a47fed-1ba2-4d9f-b6aa-0aceffac0198", "comment": "Malware payload (Mirai)", "value": "c3fa756b493d1e7b8c851310bce33d92e21349c5646692260452c9f807147f4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565194, "uuid": "1bd76f22-7bf4-4668-a98f-c6ab17af53dd", "comment": "Malware payload (Mirai)", "value": "9e1db79c91d604326d060183aba1172782e1c911", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761565194, "uuid": "5a1305f2-23b7-4523-9104-f91584e4fa6d", "comment": "Malware payload (Mirai)", "value": "f5c33af15480ab4600a647da04e742c24fa58f3b0c7aea4ca5fb2eb8e70008e8e6f141fd8e5ffa4b9cff401bea8ad3e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565194, "uuid": "f6406d3a-e5f4-4f00-80d6-f8304c2f8a2e", "value": "T154C3F909AB614FFBE86FCD3746E90B0529CC551722A83B7A3574D828F64B54B4AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565194, "uuid": "359ed998-f621-462d-9521-b320ea7cf9d3", "value": "1536:xNZqs2lYRB1f+g6z3jL3pFLUwXkb3+YEwIvF2E+7hQqw5HxZp+/praXbr2F1lIl9:jZqs2lY56TXHSmqw1xi/h+2bmFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761565194, "uuid": "d895a289-53e2-476f-967e-0f7e1fd6bfb5", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761565194, "uuid": "f99626a8-a312-49cb-9aaf-969ee6caec4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761565194, "uuid": "862bb48d-d007-440e-9f0b-0c850ccc3015", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0808f9-b32c-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1761566217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566217, "uuid": "8f76c05d-dd5c-4d0b-9930-4156d6a562e8", "comment": "Malware payload (MassLogger)", "value": "b3579c926a3b6e3a3907f27df66780fd", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566217, "uuid": "d9a124e8-578b-4076-8a00-8c76128e453b", "comment": "Malware payload (MassLogger)", "value": "c497271a900c6b2cb681d47b913e718efcff6ec00ec46138a82c30dfaaaa03b8", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566217, "uuid": "36456bd5-6041-499c-80b6-ae7fa9db6ad1", "comment": "Malware payload (MassLogger)", "value": "c410cbe63c997efc36c3eff740707c34d1ccde9a", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761566217, "uuid": "29e24362-361b-4cbb-8538-6e6df8a5308d", "comment": "Malware payload (MassLogger)", "value": "798d04a23a2b4b540ec70d21259bb7ac0953dfc485706e63c2938c29124ed0b88aa48211b142dcb5fe2a7f4b9130edbc", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566217, "uuid": "8821340d-98c5-4f3f-adea-05849c8d160f", "value": "T1EBB4F1118D846FB9CEAC992840BE161FA7F0199F1166794AFB3FBD86AFF354442070C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566217, "uuid": "d4e6014d-5900-44d4-9900-9926025678fa", "value": "12288:UJF6awgcrJsbybZ5+CLtUPxcmUhxTI+AltjDy:UJhwgtSbLtzx5sju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761566217, "uuid": "b7bd4497-2898-42d9-adbb-6f553ac66073", "value": 535042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761566217, "uuid": "568bffb6-a479-443b-ad68-f3f641b6584e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761566217, "uuid": "22687696-5a67-4430-9a3a-cf1b8e8ca39e", "value": "S\u0130PAR\u0130\u015e 189395.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586d80c6-b361-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761589112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589112, "uuid": "45a711eb-7932-4151-a526-3d6c0b89bfb0", "comment": "Malware payload", "value": "e32b43381f1caa9954b550f78d922e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589112, "uuid": "f65ee89f-6006-4b31-99b4-56bc6bbf96fb", "comment": "Malware payload", "value": "c4e7a48ffde4a42c8161f3a11838bc10ebe1007725c3b415e66a88ec270eae23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589112, "uuid": "8b77a3ed-228c-4e2f-aba3-06b18bb86d70", "comment": "Malware payload", "value": "b53be7b5667ad7023daab39059e12e9cb5b42c3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589112, "uuid": "bf563f8d-2877-4c74-98f6-d024a44e1b19", "comment": "Malware payload", "value": "7d1814724bd3212f09a3ff016b2adb276c66f7a07783ad733f18611b4242279fd14dd29f21f13735ba8cf9ee046a3ffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589112, "uuid": "245de5e7-4a0e-4788-b70e-78a9ac0b996d", "value": "T1DEE5171678A0D476C86BDA3188A35542B665BC370B3733D3EA50B278EE7EEE41B35704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589112, "uuid": "d7f367f0-d890-4450-94c4-e2903c2775bf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589112, "uuid": "0d9c54e2-3a05-47e2-b251-738cb07847cb", "value": "24576:AlMNL398Jre+tLAxqe55kf5sd7T5YO/G+7Xlp8ebQnL9oIgtMtLBIKynKrzLjfGI:AWpN8JrNA4ebkf5Akem9IWBLNXZ5SC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761589112, "uuid": "9055a608-02ae-4918-8fd0-a846dcc7cb68", "value": 3032128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761589112, "uuid": "323936a0-0b49-4158-a6d2-4bf0f723ad32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589112, "uuid": "02f05ea3-d8da-4633-b560-b62ea0b29b51", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1962bd96-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579128, "uuid": "95a81c0b-f92a-4951-804b-09ff4ce664d1", "comment": "Malware payload (Mirai)", "value": "660ef8fee10a677ad9d6b67fa72fe2e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579128, "uuid": "b3989d60-349c-434a-84f9-a0f353949006", "comment": "Malware payload (Mirai)", "value": "c61ca533794a065e34c1b9ed7449ecdb05b4998b3c072a736fc81f7dfb4f75a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579128, "uuid": "859ce9a9-3951-4680-ad8b-c85d5136835e", "comment": "Malware payload (Mirai)", "value": "5eba077ab77c7ec7e5af4b7da511aa7d3c229c50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579128, "uuid": "926fcd7c-ed7a-4902-9973-08c39bd2f8dd", "comment": "Malware payload (Mirai)", "value": "a3eb9cf4aa3646fd40777979dd25876a6479a054e6ed15b4d30f11e41a50183fc12b049ea9c339b6f06cface3057b25d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579128, "uuid": "35109287-3939-47fb-876f-5718f631c620", "value": "T19F63954E6E719FBCFBAC863447B75F209248339626E1C684E15CEA011E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579128, "uuid": "46d0a186-c477-427c-9187-46d7841c79eb", "value": "1536:u8aCKglaDrIjtb3stmjpYpt13Dg2K5Y1UQ+el:9H+0Jb3vyptxg2K5Y1RHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579128, "uuid": "285b128a-bffa-4d5c-bf6b-37ded66c1752", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579128, "uuid": "19fb2595-d2b7-4951-89f5-9db58310b501", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579128, "uuid": "1befd4e9-dd97-4ec4-99c4-1558c69e1572", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364181b0-b388-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761605805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605805, "uuid": "d546c067-6407-464a-a133-2ea7738da7e0", "comment": "Malware payload (Mirai)", "value": "4b6adb68a6cd3200c90f01cbca39ccc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605805, "uuid": "0d2aefa5-7533-42b8-a546-221f5dbe985e", "comment": "Malware payload (Mirai)", "value": "c6231b85cf641a91a019db681844e3e16941ec6208775d1d97985d2e8b2890cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605805, "uuid": "ab4185fb-e1ca-432c-a1c3-7e8388c4c26a", "comment": "Malware payload (Mirai)", "value": "5cf5d0ab31d46d4ccf9658e1bfebe8a8a2da36fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761605805, "uuid": "98c4a91c-12fb-4b09-83e1-d961fcfc5397", "comment": "Malware payload (Mirai)", "value": "bd3a634ed684947de1f4919353e123686de5316e2c6a7110168da1fedb2e409fbb0ddc195e54e79c78c0448f71898a44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761605805, "uuid": "e9be81ad-f415-4c38-b6a5-fb8f63b4b1f8", "value": "T1ABF3AEA3730F6091C86206F80BCF6B9D262365015EAB9BE76C5E363E5B771DE45023E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761605805, "uuid": "60ee7539-bb03-4d10-b54a-ede51e1b2d7f", "value": "3072:iRfeH5yaTdGCSwggEX2wp89AZbGy0tBAKg7C0vZQVEldkq:ioHgwrC2j9AtL0DAvCsQV2kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761605805, "uuid": "e1067d99-8c1f-4f2b-8a12-2d56c7d6dbe0", "value": 165504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761605805, "uuid": "52e99e49-a9f4-4694-9b8b-f64ecf78be61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761605805, "uuid": "a34b9c9e-f00e-40e9-9e35-82af35b4d30f", "value": "Orbt.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e32050-b375-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761597615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597615, "uuid": "c655d13c-7bdf-436d-aa59-3ab1ab048248", "comment": "Malware payload (ValleyRAT)", "value": "04e4114279f6d064c776fe53c1bfbb29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597615, "uuid": "174afdee-40b0-4c67-a65e-e780b06cf7c0", "comment": "Malware payload (ValleyRAT)", "value": "c65b94204e8e7f2c9a85cba08db28449a8e7e91702856380ade9fa7b9f63bf4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597615, "uuid": "bbc140e3-2480-4590-ad8e-99e42247e7fd", "comment": "Malware payload (ValleyRAT)", "value": "1da58f5df92065f3323f092bc481016055f26b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597615, "uuid": "5e84b0f0-14e8-4413-8ff4-e6be29ba8b72", "comment": "Malware payload (ValleyRAT)", "value": "8b213dbb44f7217ece88bdd2d2f79a01ce484372758fda4e570ff4d6bcd8ed8b3388efbe8d20cb7ba6e3c19bd5bb29c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597615, "uuid": "bc97f7b6-384f-4d05-b159-194b84376d22", "value": "T1BCE2E1D368F941A1D2A179B45F14D98227B360BB0BC9D36C71BD07D6FE748C2582344E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597615, "uuid": "5dcf731f-7a3f-4795-8d62-5d2da82f4ae9", "value": "c1201007f24fe8ef3e37fc185993eed2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597615, "uuid": "aa0ec850-d035-43e0-984e-7e17352ce32d", "value": "768:Sd9Wi/1oqaR3N4oir0g2B8PQG1fdl1T4snqW2:Eoq0Kr1O8Vdn1nqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761597615, "uuid": "4a5893ce-8ffe-4f22-9032-c9a8080127cf", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761597615, "uuid": "5d2e997d-23cf-4164-a0e0-40695cd69fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597615, "uuid": "9977972b-7d40-4cdd-8d76-9f780a3caf28", "value": "04e4114279f6d064c776fe53c1bfbb29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fddbe9-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577919, "uuid": "226a6093-1630-4117-ad17-e0e75577ae69", "comment": "Malware payload (Mirai)", "value": "5775cb0b501015a98ef77dac1c3ac562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577919, "uuid": "ba50e1af-5283-4e58-a7fa-238b8f857124", "comment": "Malware payload (Mirai)", "value": "c7aaa17c761e19aa37a5e973498a65163bba04ed8ca3430c6686a02396602f71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577919, "uuid": "ceec2d7b-a883-485a-875f-e8ddf7b18678", "comment": "Malware payload (Mirai)", "value": "dbff9499b3434a7fa6cfd98e339d899b98bce2c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577919, "uuid": "ab3208b7-5559-4129-81b7-32ff916e66dd", "comment": "Malware payload (Mirai)", "value": "cf89e98a9f25c297f1ece57467820e1e9ddfadd0bf904fef9a735cc58aad03f57ceb4e42f4707a8263aa3748ef3b8079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577919, "uuid": "8980af4b-8c76-403c-a00d-97804b1585bd", "value": "T19D834B2169392A1BC5D0B47B31F74754B3F2178E2AA88A4F7D720E8EFF2164025536F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577919, "uuid": "f75c4229-e399-4fb9-a712-395bede02ecb", "value": "1536:snzz8dask/NgRcTSLKuPQH7Q0Uka2QdE99LUlM5FUt71ro:wbuPXDka2QdE9xUl8FQro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577919, "uuid": "8eab4978-fd70-4917-b5c8-2945602613d4", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577919, "uuid": "f8bf10ef-70fb-42b4-9457-6f10ee7bd3bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577919, "uuid": "8cffd204-af39-46c5-8a80-8099ab09d6cf", "value": "kvm.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df5c62b-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577928, "uuid": "eaf54bcb-1863-4ac3-bfcb-9924262736eb", "comment": "Malware payload (Mirai)", "value": "eeb50761d2e140b813702c2c472807e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577928, "uuid": "0732e40a-e991-4799-a78f-c088b0db3ae3", "comment": "Malware payload (Mirai)", "value": "c8c77db93e53f90c5e175bb6bcc291b98dbd07eb40de72872e9f8e32a6151917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577928, "uuid": "d62dabd7-1969-40f9-9298-31ed2cb1ad9d", "comment": "Malware payload (Mirai)", "value": "566a8c0dcc26d446e932d7fd5a3df220b0cbff04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577928, "uuid": "ec743542-1e42-42b0-b8dc-ddda1091cbd2", "comment": "Malware payload (Mirai)", "value": "35467c5684154773b7f0e835cb770634cedee34e51fe56aa300cb001de6219f06276b32af893f7ceb3dd39aa3e497b12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577928, "uuid": "a69d8f86-e0f3-45e5-ba7d-8922b41a3ae0", "value": "T1A503E1CD2B3A7482C98C58BEA55971724847608173684B6F5345DC0C8FA2FCA9DAFE34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577928, "uuid": "64a59c86-be70-487c-bb31-5abc32842a44", "value": "768:gUyEYl5GfG9cXkb+jaXrIa0BMXAfQPMQrF+hYGn753pTRsqN0WGPO3:ALGuii+jMkDyQfeBFtGnl3JSCgPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577928, "uuid": "b4b6d6c7-279d-4562-a9a9-fd7d3c99bd1c", "value": 38272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577928, "uuid": "885cbae9-cf97-42a8-b5ed-270c457f7c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577928, "uuid": "6523b7e9-162e-4cdc-8c28-75e480e86046", "value": "kvm.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dceb04c8-b323-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761562706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562706, "uuid": "bc78d888-b0e8-4917-be02-8d84f3e70fed", "comment": "Malware payload (Mirai)", "value": "9ed3dcbae2579fdc7773cd39932cdf3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562706, "uuid": "38d76b3f-6176-4763-8365-1f36bebe8aed", "comment": "Malware payload (Mirai)", "value": "ca1d884aefd0d8f69e8503f3e31e9bc4cd5206e629106591bb9d628a68627513", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562706, "uuid": "36b1ab22-82da-4c5d-a1df-cbc1915c25e6", "comment": "Malware payload (Mirai)", "value": "629988032c278b1e4e9e0e357ec9f2bba7cfa007", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761562706, "uuid": "c8b164f7-a4bd-4dc5-b340-c13dede38590", "comment": "Malware payload (Mirai)", "value": "de5527eba18df7f1a32aa4d88df48f32d313c8affbf1cc4a56251e535c4a941ab39c8cc755f8c837e2b710056b6d55fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761562706, "uuid": "2267f07f-611d-42f5-8331-86f7ccfb4b4a", "value": "T1D4D3A70E2E218F7EF26CC63487F74E21975933D623E1C685D1ACE5151E6438E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761562706, "uuid": "ab69cf92-4d4d-45d8-b7db-83204e0f960e", "value": "3072:GmaDmqmIdDbcsTOS/fNqPIS3s0L+jdUVOFcdLpx1InzAAh:2mqmIdXcsTOSXUz3FOFG718A2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761562706, "uuid": "7af70027-ee51-4866-9bfd-004589933ddc", "value": 142636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761562706, "uuid": "c78c7464-f80b-464e-aafb-376883c6e2e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761562706, "uuid": "461f9e67-1be6-4672-88a5-58080cb93092", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ae725b-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577427, "uuid": "1bfdfe35-58c0-467f-b880-0ffe9adac311", "comment": "Malware payload (Mirai)", "value": "05f27058f3f17bd097c2798f125de48d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577427, "uuid": "d40bd24e-8061-4a43-a14a-1f4b78fb724b", "comment": "Malware payload (Mirai)", "value": "ca4ee578c41f3c8e1eb7781def187bb841e96626953b81aaba4c8c25d34ace74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577427, "uuid": "563d49d3-e9bc-4793-8869-2877436f8c0c", "comment": "Malware payload (Mirai)", "value": "63789d6bd25acabfc769670eb3a5cad9352d7066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577427, "uuid": "ec6dad73-29ba-485c-a8e4-d2115916526d", "comment": "Malware payload (Mirai)", "value": "c0c52b580b7288a724b11b5354fca60c88a0fd03f2c907d120c0836f26d46b7dce999130869c4f523c0f20e86d0723eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577427, "uuid": "8483c44b-d47c-466e-9cea-2dad7c799dcf", "value": "T129A34D72E607C1B3C44306B1029BAE5B5D31BEA74A2A5E4AF36C7CB4AF324C47515FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577427, "uuid": "1698cce1-a728-4844-8dcd-f1a0065dc080", "value": "1536:1eLBA8EPuP+CFMgTW+K5gJsRVfgytdQV9xqxS1swmqHIVcqqWNGnQOT:EAVuaH5gJsRFgaDwswmqoVcqq6GnQOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577427, "uuid": "1ed81eca-0335-4cab-ba4a-c20f2290100e", "value": 104639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577427, "uuid": "22da46d8-5b66-41eb-ae58-4e1e6da42b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577427, "uuid": "d101435c-92c5-4080-bfe7-5037aa6bf1d0", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6361cfa3-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761556918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556918, "uuid": "6ea77ded-fe33-4e03-b06b-5609a4b30145", "comment": "Malware payload (PureLogsStealer)", "value": "a4fcdf4ee8adae60f5f4fdece302c14c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556918, "uuid": "1aec0c3e-9def-40aa-9edc-0121c02eba4c", "comment": "Malware payload (PureLogsStealer)", "value": "cb988bbe7f94f4096352325d9aec6896f1cf6ad8e060a6f12200b389b744171f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556918, "uuid": "d3fd6264-c7b1-4817-9295-c5d055c4cdf6", "comment": "Malware payload (PureLogsStealer)", "value": "0ba5d51a240b49a903a3bd49b07e1f4d42a324a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556918, "uuid": "780c7a76-6cbd-41aa-a67f-503ce06f4fff", "comment": "Malware payload (PureLogsStealer)", "value": "8d545fd42c9d620bbf57dc8e58c0d193dafd03712ab9719c61b3dc140be14e1fdc805dc0de39da7b310129a1f8341cf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556918, "uuid": "eb4b6082-d14b-481b-84a8-e3b6c52e3645", "value": "T169264BE0E0FB0092F1079D8454ACB99E4A7531A3EDC6043DB35E7B84CFAFD857586A4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556918, "uuid": "31c91144-33e0-4539-b240-aa540b6582d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556918, "uuid": "80e0e19b-0cfb-4b5a-8e9f-f48e05bfd4d9", "value": "24576:7IGSj8wutuA1bWBvmvYRgTuxOWPFmtq/9Ltm6q/eBoEQTR0BxGPGZD52Agy1w5N1:EDB2mD5Jw5NCR7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761556918, "uuid": "a2f0a12d-00f2-4c67-a113-70598be7efe5", "value": 4491264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761556918, "uuid": "e81622fe-c406-4e85-9330-63e778f91b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556918, "uuid": "56d074c6-d864-454a-8e43-dca145196c70", "value": "8431456230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9b3143-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761557100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557100, "uuid": "fa9686ad-6b2a-4b48-967f-b6eac9a7b9c5", "comment": "Malware payload", "value": "701b1f527a5387937f74b813953793ec", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557100, "uuid": "d841a1ad-d3d7-4ead-b609-0c88bf198122", "comment": "Malware payload", "value": "cc7b7b19c3694ddebe911977da4482e9f733e39b2461a1defeb8bcafdd075e18", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557100, "uuid": "be4659c1-dd4b-41c3-b4e8-ef0417d5cf08", "comment": "Malware payload", "value": "8d2c2d43dc4c3912c75b7cace23bebe7e639482e", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557100, "uuid": "8ea53839-8b44-4db8-b899-db40b0d1427d", "comment": "Malware payload", "value": "2cac969f9d445fac8084b8ffc2161bdb024ae9c3e1ce200d0309b403ab0116e240de87b5986938cbe82f6ff3784018e7", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557100, "uuid": "3c2cc72e-0e8a-4d3e-ad2b-da9c64c1a89d", "value": "T1C1E4122A21C8755EBFD1A2397BBD9AC606DD40821E308F1C9D45F0A23A5717CBAF764C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557100, "uuid": "443f9cc7-65ed-4b8f-a1ca-f869d136f56a", "value": "12288:Qf1WMfLDi4GMGhFDYjvYf2czgg8bg40qbxXNlq3L2me9LJZhg:OoMjwMaYDYPggH45lXNQ6meN/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557100, "uuid": "58df22a0-d505-4803-874d-81982cf203d2", "value": 698165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557100, "uuid": "9468936a-b3f9-446f-858b-adf71d884fef", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557100, "uuid": "f42659c2-e597-409c-ba91-708fe0382bc2", "value": "Quotation .docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b832ec0-b2cd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761525659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525659, "uuid": "7870c5e2-2ccd-48b5-a026-0c9df97242df", "comment": "Malware payload (Mirai)", "value": "787a54e90761d57f923942e5e3796f8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525659, "uuid": "747a6232-d3d3-4b9f-a99d-78a37664c71a", "comment": "Malware payload (Mirai)", "value": "cdcad9f5859265e37f71a652b7f53515af98580e9af65d40dd143b96cacea648", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525659, "uuid": "e53b0975-499f-4cbd-8494-d15c12558e3b", "comment": "Malware payload (Mirai)", "value": "5b08dcfa0def6d4a350a2429c6fb720161bd7819", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525659, "uuid": "507a9f6f-e560-49c4-aaed-d1334e8825e9", "comment": "Malware payload (Mirai)", "value": "86403942b203192a7dac56640ffdaf5bee57b4604a07c7090dfc2e93325cdd2821de39881c391f46f522b4a90d5e4598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761525659, "uuid": "a0e866eb-82f8-4091-803c-85cfcd0feef4", "value": "T12F933A46FC818B21D9C512BEFE1E118E331357B8E2DE72139E146F25738AA6B0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761525659, "uuid": "e0411b9b-b65b-4f8e-8d11-d100686309e5", "value": "1536:gAnw7RWRK5rTKvUjbpk15dyHtQTU+aFqEMXXDVRiAy5Lc3/D7tp5pYb:0R1I4NQTU+aFv5Lc3/DRp78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761525659, "uuid": "6fd50668-8632-42f8-bc16-b275d86b9ff2", "value": 95708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761525659, "uuid": "7cbe4eb8-f5fd-4d27-85e9-180863656c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761525659, "uuid": "abe9ee35-5263-477e-b1fe-6369dbbfdb56", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082585b5-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607016, "uuid": "ea20a1ab-d7a2-4b11-96f6-ebd3da9bbaa2", "comment": "Malware payload (Mirai)", "value": "d847b7f14ba04874fd86eda33c110736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607016, "uuid": "0e260247-fd42-4467-b04d-ef09191de387", "comment": "Malware payload (Mirai)", "value": "cdeb84cce5258dec023608f26fc5b988299a98e22a6d2f420b2b98ecf9418640", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607016, "uuid": "748f8ddd-f6d4-45ce-90a5-45df5ee7b463", "comment": "Malware payload (Mirai)", "value": "a4301635bb01a0c30944c63d87e2fa7834bdd96e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607016, "uuid": "57225659-5bc2-4bc7-81ee-ece0570a4722", "comment": "Malware payload (Mirai)", "value": "a0ad4b677bbe609aa85c24ebf33aedd2522deafcc5cc6ca48f155dcfe81f7eaae49ec375a0982fd2b546a236bd11ef55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607016, "uuid": "3e6a749d-d9b6-4bf4-9d70-4ea1e9ff204a", "value": "T126B35BB3CC26AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607016, "uuid": "f0f1c289-1ad1-4d15-9b59-5a9089d214c2", "value": "1536:WTW/VCxsHZusjiLi62C8XiKTRpP/PVmAVoWWczTW+A1P7a:WytCxsjV62N1TbVmFWWMTbWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607016, "uuid": "da41c427-6779-4dba-9dc1-b539204cd10b", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607016, "uuid": "9caae522-df01-402f-8824-a54d712d3002", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607016, "uuid": "b20a8cf8-819d-480f-9ff6-1bc5be43d3f9", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c2ffcc-b335-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1761570396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570396, "uuid": "6afe5e05-8fe0-4c90-b046-1a0d2e9cb85c", "comment": "Malware payload (SnakeKeylogger)", "value": "f09041e14e0d87ee1e206a31dbf8a3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570396, "uuid": "f7bc64b6-1990-46fa-bac1-c2207062ec19", "comment": "Malware payload (SnakeKeylogger)", "value": "cf960781f1a616c0277102db1d353fd73fa2c1e2642dac9e9a31aa21b8d5854f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570396, "uuid": "97a21add-47d4-4c4a-8ec3-9746a8857f7f", "comment": "Malware payload (SnakeKeylogger)", "value": "67ec5eebb16319904028547f51b1cd184a663f72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570396, "uuid": "50f777c6-977c-4e03-afaf-400c55dcc455", "comment": "Malware payload (SnakeKeylogger)", "value": "c7c926a67dc688812ed39b240bbf2404a41037134e534bc2c2923a655e88bfa540ef3d48f937e45be0edcae29197b859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570396, "uuid": "39c1e947-2456-4ee6-b498-904722e1ea76", "value": "T1ABC41250330AE903D59197B45AF1F2B203B96EE8E611E3D1EFDD6EDB74A6F009910287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570396, "uuid": "37bbc6be-343c-43fe-b2ad-f1ef797c06a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570396, "uuid": "5b178de5-4457-48fd-b9b1-ca610c37b258", "value": "12288:XcVbQTgne7FAFBPwK2WjiAuvHQ0UYmF+okckgPhS:XchQIe7F2BPwK29Hwjkg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570396, "uuid": "3ed6649b-f1d2-44a9-aac1-52f4722849e5", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570396, "uuid": "1f2d1928-7d67-4c63-802f-1582e8acfe3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570396, "uuid": "44f10add-bf70-4874-871c-8c04f452d288", "value": "k3qhtJvVAmJIV5G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f7c346-b313-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761555820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555820, "uuid": "5e5973b5-1d56-4a3d-aab8-ec27165eb956", "comment": "Malware payload (Mirai)", "value": "f7f7f29b388294b160ec90b46502dfa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555820, "uuid": "1ffc9569-95ed-4e00-8c49-092d6fe79bce", "comment": "Malware payload (Mirai)", "value": "d0d253fa897aeb2aeaf6d7286168de38a3940c977b535e92228b35082480a889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555820, "uuid": "9491ba42-213b-41a3-8c2b-8f9bdb7df6be", "comment": "Malware payload (Mirai)", "value": "4bb22dca1a75010e2bb5b2195a08050c92033e9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555820, "uuid": "33bd04cf-df73-45c9-b202-3f48ac4a95ad", "comment": "Malware payload (Mirai)", "value": "044a05a2eb51e576b88a098d41e4265cb1637b1c7013ec55cac52c434b7e069974c4c2d981ce0ee05261cf9af9395ae7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555820, "uuid": "80887845-00ab-4258-bc0f-08dff07fb11b", "value": "T189F3A436BB619FB7D80ECE33059A49011C8CD99B02D92B6FB2B4E51CE76AD4E48D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555820, "uuid": "dbddd3e4-9a68-4b93-94b7-37f636985392", "value": "1536:2h+geTE8OWVT/BsTOfEa0ywgwZqRbSUp7RuBfiNBLGPqiCnFBmUlHmPaLEwBvI6N:0++fa01gwWp7kWMSxrmUlGPaLEgvI6Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761555820, "uuid": "db605f8d-9864-4c32-be85-41c2845f0220", "value": 160201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761555820, "uuid": "97c7ea92-a69f-41ba-9e6b-94d4032d805e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555820, "uuid": "36296d48-56bb-4548-aca3-6f4d5eae8070", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7a48fb-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579269, "uuid": "f3ab61ac-61d9-4aef-bc88-2f95a5c60c44", "comment": "Malware payload (Mirai)", "value": "71f2ce68b05543d779bbcd30986ebc17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579269, "uuid": "585214ba-15e4-418b-82a4-87e48f96da07", "comment": "Malware payload (Mirai)", "value": "d0db45036f9b40b19fa22edc27d7d1f9cead1b69ee6d495c1225a75ab5e9cc49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579269, "uuid": "7ee2855e-cd59-4a34-81fa-5e1f9a8ed4ef", "comment": "Malware payload (Mirai)", "value": "e93eedf382c34d683874bd6ce2098324fe36a995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579269, "uuid": "3818bde8-963f-427d-87d4-c77873cfd9f1", "comment": "Malware payload (Mirai)", "value": "c6a60caa6450237dd5e39095911afd4d3bcc81b478228ad7ab310465dc683f25985d98f518364febca9c6a5dc6a4ccfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579269, "uuid": "f4e53870-e8d6-422d-a356-57c14c509475", "value": "T1AA435BC5D563D9FCDC1019353077FF725A76E93F1028EAD7D7A8A932A982A02D80728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579269, "uuid": "cc0cfea3-a317-4201-b817-98f2d32eca5c", "value": "1536:d6Ew9WqbZKWzp1reXfez1o9yWCTZrt+xc:Q9WgZKWz34s1wyWoZrQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579269, "uuid": "f2f350b6-fd0a-45b2-b603-4782fa630e15", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579269, "uuid": "22f2fea3-5a59-4c7a-a86f-9c5f0735eb28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579269, "uuid": "17b72f8f-e876-4c07-81b8-972be62d71c7", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be1402f-b330-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761568180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568180, "uuid": "44ebad48-464e-49aa-831c-a4a6b01df40d", "comment": "Malware payload (Mirai)", "value": "654f984f9d214f9d2af890afb84bacfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568180, "uuid": "9d9b6762-e59a-4295-b113-4371191b7822", "comment": "Malware payload (Mirai)", "value": "d2ad1fca5938e93eb784e78b00b8ec9fd7357eefa03715669f6e0f64dccf43ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568180, "uuid": "ab85019f-fb59-41a6-9106-e14248439321", "comment": "Malware payload (Mirai)", "value": "d445c0f1919d0489b322e22ca1ff76ab80bb9b24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568180, "uuid": "2b79df13-b110-4c98-be85-19c12ed0cea4", "comment": "Malware payload (Mirai)", "value": "63e11625327674e679c8be308f3733fb971cc13fd04f9d79e38b2730b254441881065601b2a98617414d3e2211ae4f03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568180, "uuid": "2e34e78d-813f-419e-88ca-c97a103051f6", "value": "T1D413F22342BBC24DF12F91751ADEB55EB4D0A22960C89A91E6F7E13E1CC7A347E35708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568180, "uuid": "45df3b23-d70d-4e41-8039-7c629f0594a1", "value": "768:b9uBF4emvGiu1LLe779bcuVJb7L8nD92JygQJrNU3JGatzGIbnbcuyD7UHQRjw:b9ufTmMObH34nx2JirG3catzGIbnouyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761568180, "uuid": "fa26c9fb-635d-4275-a28d-43d7027560d5", "value": 45264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761568180, "uuid": "9d02fa52-188e-4bce-853e-0ca326c7ccf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568180, "uuid": "422245fd-4d97-4889-9ade-64cac4c2df80", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee1dced-b373-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761596988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596988, "uuid": "35d7ca54-d576-482d-8b87-641d0bb09fde", "comment": "Malware payload (XWorm)", "value": "293f03152b415dc5e516fc32a4ce0926", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596988, "uuid": "97b33c1f-5d58-42fd-b7fa-2daf980c8562", "comment": "Malware payload (XWorm)", "value": "d302627135fec58d75b69c0bb730756534ac3a48ffdaf82cc96b6ab941a4f3d7", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596988, "uuid": "f881369d-3cda-4075-aa7b-6f0922b74dd2", "comment": "Malware payload (XWorm)", "value": "934b5adbb9d72cbbe6104cac51953597c5b0630c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596988, "uuid": "425cb826-00a4-40df-9428-6ca857c87634", "comment": "Malware payload (XWorm)", "value": "7294c5fdf02305fde53d2f2b35ed2322e592ce1e8291bb15b2ef1181f067ec57774627338219bfb9b6ca59588d4d200a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596988, "uuid": "49ab02ad-5ac4-4b78-830a-0ce5f0d2c8ed", "value": "T10CB423E7DF2BEB67D7A6A994C0172544B783930102B5C436F3544B62BCC129887FABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596988, "uuid": "f4fc329e-8894-4e3e-bac8-6cc8e2d7cfde", "value": "6144:uQ/mIttrn6VPWYbHONxWImjU/Vccpr9XRVGouScKL777gA6BeD1xZY+ATc61SkgW:uH2DYbHONqBcLXgtqUe58cASkV2fLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761596988, "uuid": "37e264b8-384a-4141-a046-9fd843f5a38a", "value": 498871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761596988, "uuid": "afdbd5be-0a91-453c-a54d-58771deb9b51", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596988, "uuid": "56278a55-0ba4-4a87-8a47-4cf1cb6b9e91", "value": "PurchaseOrder_25005092.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c480aec-b34c-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1761580153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580153, "uuid": "30ab82cf-478c-4381-859b-08708c3d1cbb", "comment": "Malware payload (ValleyRAT)", "value": "a124ab505f03a3aad2696b23b083a459", "object_relation": "md5", "Tag": [ { "name": "555888-cyou", "colour": "#F3B236", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580153, "uuid": "eb3ffbb5-0cb8-4a9a-a479-1d44e44d78a5", "comment": "Malware payload (ValleyRAT)", "value": "d37be74cc100b18d6c0c82200712409d31cfa9ec9f6a8aa2d036eed10120a02e", "object_relation": "sha256", "Tag": [ { "name": "555888-cyou", "colour": "#F3B236", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580153, "uuid": "6103890b-542c-498f-9b6a-d64f80a618f9", "comment": "Malware payload (ValleyRAT)", "value": "6d936f80daa9533929a11f567c77511188e15bf2", "object_relation": "sha1", "Tag": [ { "name": "555888-cyou", "colour": "#F3B236", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761580153, "uuid": "a8b6522e-7065-4697-9444-bf666ac78d9a", "comment": "Malware payload (ValleyRAT)", "value": "9499ac72d9d0c4aaa93de8038da6a91d2855fd2b1221bacd661f9a7feac5349d84f334e4380ea8534af587cb12a03465", "object_relation": "sha3-384", "Tag": [ { "name": "555888-cyou", "colour": "#F3B236", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580153, "uuid": "c59cda22-fbe7-4c73-b118-97fa855549e3", "value": "T1D8373321338AC137D56E05706929976E22BABDB30B3050D7E3CC6D3AAEF15D29634F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580153, "uuid": "2afef659-c70a-4d44-945f-0e63da472b16", "value": "393216:qRXgxGFIqSm7tljAHn7u5XqO6NqQznkmAkMl7cVtOYr6XlBuy4jTH/WAzAZ:qRwxGFIvm7tauOckMlsOYr6XKJHzAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761580153, "uuid": "c335bd55-9572-4db5-8789-0c5a7d99caa0", "value": 24436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761580153, "uuid": "2d849996-6000-42fe-aa4c-ea6941b6d767", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761580153, "uuid": "7b0b7050-8a2e-4c67-abf3-02b99859bd4f", "value": "Setup_x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e02175-b359-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761585803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585803, "uuid": "b8462093-f092-4a3d-89b8-6b7e22c7b2a7", "comment": "Malware payload", "value": "edaf02312c848325c9178400374af921", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585803, "uuid": "24da3052-b602-4ccc-9579-1d51900edf4e", "comment": "Malware payload", "value": "d411d55d4cb662c8c5cab7a45e0501d3565f5e6d2f0ef51220993d6299d4578b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585803, "uuid": "a2cd81bb-c953-474d-8ba9-e866ea7669a9", "comment": "Malware payload", "value": "194f8e0a8a9b527a6ce154c2f07549c256bf4a88", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585803, "uuid": "96df68ae-a215-4e38-b705-edd1779d467b", "comment": "Malware payload", "value": "ec142a1362cb314c804868c1f87dc100a57c7d77878569191071a3611f837756e7caa1605388617f6fd0d117d10fc095", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585803, "uuid": "89243b33-4493-4744-8615-f376d904329e", "value": "T147513D55895E7097C8BAC1F249441580D6D8EF70DFAC12DC9664410877729D70CACDBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585803, "uuid": "9961a982-0fa3-44f1-8112-0a6160f938f6", "value": "48:9sRQzkj1UR8ElHhljmt0Vr2xygVMd8eOtnnqWUexF4DLhdDYBtYVtuF:qQA+WwXqt0N2xyoM8epWU2mLh9YXquF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585803, "uuid": "25b3a38f-4878-4b77-9acf-fbfef84a0704", "value": 2973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585803, "uuid": "56964bae-40cb-40b1-8238-3a92e52c89de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585803, "uuid": "5083e2fa-ab2c-421a-a075-a12d06d2b4a0", "value": "Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9a9471-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595753, "uuid": "692f6568-ecec-43f0-b602-21c8865217fe", "comment": "Malware payload", "value": "977d9ddcd706a5b3eb3566616fe3592f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595753, "uuid": "793a3c91-14b7-4309-bac5-332962b78b8a", "comment": "Malware payload", "value": "d55ae8bcbdafa749da6e7dd94e6b84b8972b4ee0b79cebb67d93d8bd5cdefc0b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595753, "uuid": "41fb8a02-491d-40da-85e3-419e3bcd9a2f", "comment": "Malware payload", "value": "c0297fab7bdbbf744666596eb00d61f2501a0ef5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595753, "uuid": "e9d33921-9530-476e-8df0-bd82bd11c460", "comment": "Malware payload", "value": "166d10b20aa1a976b70520aff1567890cc4444ad3f713e7ebf3f56af3fc0c58841d5f8a4b9f063717a61740754452c48", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595753, "uuid": "1cd8cdfc-9fca-4006-8b38-58d437b19208", "value": "T143E423E0C07E460B940F727268C9185CD05B6BBE126E585D50F276DAC27FC190EDE9F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595753, "uuid": "769c9298-a515-4856-94ab-3af1416d6dbe", "value": "12288:5PG2ufZjUyIyxnxplGsFeJKVLnh8WUPa1bJZHUohUBCesIBwc2uvn:NG2ufdO+PlzE8r/j11Z0oyBrjBb2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595753, "uuid": "8650142f-cdf1-4618-8396-0741e5d84e49", "value": 700322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595753, "uuid": "326c91dd-24bb-432f-8f9d-227d16e45dce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595753, "uuid": "adc3e9bc-3c88-435f-9058-ceebadaf118f", "value": "DetalhesSEPA (78).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fab3a9a-b360-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761588641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588641, "uuid": "8097d983-c449-4e6d-89e9-094933d538cc", "comment": "Malware payload", "value": "6ca4edb2b52ec46c7fca3fd372ca6c00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588641, "uuid": "3edb1ba3-f865-4671-a133-5869b7eec501", "comment": "Malware payload", "value": "d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588641, "uuid": "6c30ace5-fa96-4ceb-a9e3-dda0c1c1021e", "comment": "Malware payload", "value": "3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761588641, "uuid": "6f91c41a-0749-4f61-bd30-e472911dc128", "comment": "Malware payload", "value": "cfcc8fc75dc119d7c5f11d3dba4a8ffb47de96230af038ae907d9856924a6bfe9bcdc3897dc605dd5a3f15324e29b1f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588641, "uuid": "072a2024-fd61-4525-a48e-4edf09438ec5", "value": "T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588641, "uuid": "c353f407-c498-4e6a-9fed-ad9971b9769a", "value": "6b799efc51fdd03aa3707013f22955b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588641, "uuid": "06157df7-d7e5-4d4f-a9e0-301f4271d0ac", "value": "3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761588641, "uuid": "53c9354f-9ff5-488d-bd76-16da725bcda5", "value": 124544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761588641, "uuid": "dacddcdb-8fb0-46a8-b9df-5168806c5c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761588641, "uuid": "7a592935-e48a-4000-8ce0-661f93e88ee9", "value": "VCRUNTIME140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb17b700-b361-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761589304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589304, "uuid": "743bd080-584b-4074-818e-8a22ca72cf6d", "comment": "Malware payload", "value": "7c21316409eb2f5c4b1a99353021801e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589304, "uuid": "f47bb4ed-4a2d-43dd-b9f7-7bc4bf09ad53", "comment": "Malware payload", "value": "d683196074738752029de9e8024f68d24c83dc785f0707eca2a6f5f94bd7cf9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589304, "uuid": "a6e9ec13-e419-4905-930f-05b1e60fe539", "comment": "Malware payload", "value": "7d5c00ccd909b9ecee6d14f4784240916095499c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761589304, "uuid": "8bb4fdf5-399e-4c24-966d-4df88aecc341", "comment": "Malware payload", "value": "db4b48fb5ab0671bb13c8431e6faa07675b2935fd2d4f14e7fb919e3da1724bb6c12e0c95c4faf6f29c6b6585a6aaca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589304, "uuid": "e1059f9d-565f-4ace-93d6-94d336e6bc89", "value": "T179A53319571F01CEDEBF427A74B533052EB8DE198CA4D3CE1B5899AB065EB42028636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589304, "uuid": "35d8b299-28f4-4b4e-af49-9efc8f9bf524", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589304, "uuid": "0a85fd66-68d5-436f-bdb5-f1b225362cf2", "value": "49152:zkqXfd+/9AqbXHeWD/2D0KhMZYnHreNR2lv6fOdSK9/IKYcZNHI8tPzcGBZ:zkqXf0FfbXHR8aFrIv6fOdS8/IK7lIMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761589304, "uuid": "455a9edf-11ed-489b-a484-494fcb65711a", "value": 2157056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761589304, "uuid": "b3695a24-36a9-4275-8ea7-986053bebcbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761589304, "uuid": "1ed97097-86f2-4978-b8d9-3fb6aa1d9635", "value": "SecuriteInfo.com.BackDoor.MythicApolloNET.1.22773.23057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d46ac7f-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577926, "uuid": "39dda9d6-3d5a-4ca8-8d81-71c0b6bd418d", "comment": "Malware payload (Mirai)", "value": "dae87f71e40345ce1487199399dc62ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577926, "uuid": "322d6e17-47e1-46b5-9e87-af73dacceb4d", "comment": "Malware payload (Mirai)", "value": "d69a80eb0a5a8bd159b0c0a30b4696ecf9b3f01b346c17042b7aa710f1d45439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577926, "uuid": "4eacbc9f-93cc-43d1-bf16-ba8db2de6fc9", "comment": "Malware payload (Mirai)", "value": "7c96933f8715da3dc977e6cd638d601d5e7d37fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577926, "uuid": "dcb2ca96-55ca-4bef-8e74-090d30292ca9", "comment": "Malware payload (Mirai)", "value": "007da3ad8897f11909d159dc1c8cadbb2b131268c431497f64f1e6039db7c7cd6ae73544421c154f90bc77fc225c8743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577926, "uuid": "e5024105-a4be-4104-bb73-2bea7783fa2e", "value": "T135332A8DA8012F1DE9D25DBE54379F599D455711B1E30A0F92AEFE833C733296F22288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577926, "uuid": "31a4f368-d73d-4649-bd18-0ef06bd044ce", "value": "768:HdAA1TE/bN/RbBg0emUNv/zDqcLDX/CJXVGy+EHUHH2SZXzsWaA7xN2f:HdR1uZ/tBb3mhX/CNVGy9H0ps1Atc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577926, "uuid": "0629f0c3-aa29-4cf6-84b6-a787605e5c20", "value": 51688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577926, "uuid": "8015c943-0b69-48f1-998d-f529c6137bb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577926, "uuid": "77b249d2-1a04-427a-b92c-4244f1627f75", "value": "kvm.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c9e440-b2ef-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761540224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540224, "uuid": "b3729586-fda9-4add-b161-6a89deeaf7a9", "comment": "Malware payload (Mirai)", "value": "71211fdaaefbf75bd2339024b6e78994", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540224, "uuid": "176c2d78-3a7a-402a-9fa1-8ab94157b6ff", "comment": "Malware payload (Mirai)", "value": "d6bd525515592ce27420a7227026bf638deaa521db151b8ffaa4072f5e0d1006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540224, "uuid": "ce65a70b-e17f-4d04-b3fe-adc62d737622", "comment": "Malware payload (Mirai)", "value": "d9e77292e7a9a385ac12398c5e38326058036057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761540224, "uuid": "66a94d20-364a-4c6e-b171-96bfc23c56f2", "comment": "Malware payload (Mirai)", "value": "4bc842c291bf5b9b0e2089cb7f59fb03b4b3f9ebe80811db0ce10e61ff27c7adfc7681ddfcd179aac8a08dcc04190161", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540224, "uuid": "301f701f-58c5-4a2c-8648-8eebb9389729", "value": "T1B9C3AEC3FA8714A1C46206F003C71BAD6F93A121CE5FE4E7AC1DB63B5A7A4DB1916781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540224, "uuid": "ea27e817-0ef4-4ca2-90a9-e9dedc4a6beb", "value": "1536:5cjBfdqDkFJ9MStjbEI5WOoP/9U/D9Qzld8a2lcqxs5Rlg9iEQ/LWJ:56fwDu1bEOn+/9Ub9Qzwa2lcHgOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761540224, "uuid": "913f0e10-2185-4c2a-b2a0-46240f59e3a3", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761540224, "uuid": "d43c5c78-e0b0-46f4-afd1-0bf8b958a434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761540224, "uuid": "a4b80d3f-1530-4252-a505-5e9fb5b31621", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fa2789-b356-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761584539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584539, "uuid": "bfdb378a-e3c6-4543-8b1f-882133841faa", "comment": "Malware payload (Rhadamanthys)", "value": "b462bb2ef2084f7747eb1bce50678f3e", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584539, "uuid": "f9ad25d6-7c7e-4c59-aab4-450a052ccc5b", "comment": "Malware payload (Rhadamanthys)", "value": "d74f756e6d12886ed446f93fee82fbfd8b9ecd101cb350d5202c7b298c33a66d", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584539, "uuid": "5f0daacc-cbe4-4aca-b0f0-a7ca887c3ef8", "comment": "Malware payload (Rhadamanthys)", "value": "a1db6b2fea29b5de06fb754c851c4cb1457af137", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584539, "uuid": "09898b39-7a88-407f-b413-63c174b85717", "comment": "Malware payload (Rhadamanthys)", "value": "24cd4c4d21e08bec64e602ba74392b1e97039584e20ecebd8a08f83578b572e97774f7a294b687e4defac656da284ff1", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584539, "uuid": "c414ef69-e30f-4417-bed5-6415fdbfdd22", "value": "T1B9F35C5B73A520F8E177C13989920A41E77278354B61ABDF07B0477A1F276E09D3EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584539, "uuid": "aa3288b3-8c3e-4292-acd9-79f093bcccd2", "value": "23aa6ede111f6ac860a5e9008f9b9673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584539, "uuid": "1c73361c-3e59-4a49-bea1-22bd34e70968", "value": "3072:9Zo6yMcAMn7tm4myJwSkN5QdrLD5NtEr/lYRSCa2bhj+8DmKe01jN:9Zo6yMpM7tmpixkOdrnnMOkCJDzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761584539, "uuid": "2e25a94e-a927-4880-9d9f-7747055d852a", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761584539, "uuid": "341e5a8d-22e5-4c51-a701-d6ec7fc9b8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584539, "uuid": "bf15cf0e-984d-4368-a4b0-ba9185ab92d7", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb7191f-b359-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761585925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585925, "uuid": "53d98105-9a42-4059-83ff-e2eb78c435a4", "comment": "Malware payload", "value": "52dcd1b1ef228ea3f2c11eeb76909293", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585925, "uuid": "64d3c58d-1453-4917-91f9-f3f0540b1d01", "comment": "Malware payload", "value": "d799363ba20aa8448cab1928e9ab06780dee56f35aec5b67977e0c1f380c214e", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585925, "uuid": "8bcf5fcf-de3d-4c03-a5ac-69def92d7030", "comment": "Malware payload", "value": "6e39773a3e5ab6cbd06c50900c90ffa127b5dede", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585925, "uuid": "80f88bb8-c6a4-48ff-affe-15354793d215", "comment": "Malware payload", "value": "ee2470020a632be0326b7b9133a5c6315e9766777ee6aa24348150629ef3316308034e7eb339496f64e2304033f3ff96", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585925, "uuid": "cef810b8-61bb-45ea-8c1d-b1607e73be3c", "value": "T1A2514C440D24E643F8CF01F9338F3A8DCAA46A968DB8232F29D139E20088584D5427C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585925, "uuid": "72296b7b-775d-4d6a-bf03-ff606276a3ad", "value": "48:9k+kt3R0wa9sLbei+IF/uwhrt2J3yCKf9E7b0WsfvWKF:u+SR0V9sPaIAwhr4J3yCAUb0jfvvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585925, "uuid": "807b8d18-7d76-4d14-b07d-c68f4bdabe35", "value": 2473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585925, "uuid": "f69bdb40-d81d-4d60-a0ff-bd9e2de9446c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585925, "uuid": "248c4591-9eaa-45fa-82b7-635be9dfa21b", "value": "Invoice_and_Transfer_Cable_Unit_GMISI_Orders_2025-10-24.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2576e36-b332-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761569157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569157, "uuid": "b4d8a37c-8c17-434d-938b-4f227fbdf4bc", "comment": "Malware payload", "value": "712d1b469dba7301c1713a3801f582f7", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569157, "uuid": "7328f002-e72b-4a0b-bd07-7fa20b153732", "comment": "Malware payload", "value": "d7d58cc400789cd519a9fce6347907f1cc6fc0e620f2ad844638ed2e8ac547f8", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569157, "uuid": "cde8a607-9823-4f69-aae4-7e8cde9ddf5d", "comment": "Malware payload", "value": "f71ae09da89534e93441fe0124669c16c8e923b1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761569157, "uuid": "6f1d3411-d0a6-492a-9dc7-2d06b4df1ec9", "comment": "Malware payload", "value": "1b6b7aa185c304392d7c9e5181feec2a2350ba0828e1163c7aa745f6a7c7cb2cb0750d2371fe37e395eab5f0f79d3327", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569157, "uuid": "ff286d9b-6024-4154-868d-93753d3ba0c7", "value": "T136724B4BFBC04EDED029C139C8635929D1B273514B21A7CBA3A1492E0F773E12E762C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569157, "uuid": "a5995dc7-8e84-4267-bfae-5c2efba4cca2", "value": "911ec5609efe667f042f8220df2de28d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569157, "uuid": "fd2daea9-4219-4cfd-9f3d-2e42835e158b", "value": "192:a+miVGzX2EdSIZQZ2IXE8bQs/xgms/sf1kjuMagra+cYF3Q5tfFLx5B:a+HVYX2EdSrZUpsxvf1oagejYF365B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761569157, "uuid": "279aceb4-aa37-4e05-8096-54ba97203f5d", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761569157, "uuid": "ce720dd9-9852-4297-af3f-7942e5bb7fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761569157, "uuid": "7ddf9d3f-ac2c-46fa-bec2-06e398996ea6", "value": "new_fish.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72806706-b358-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761585290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585290, "uuid": "77c1a8d2-13f0-48ea-9858-068b6b120ae0", "comment": "Malware payload", "value": "6686dcf8cd6dff4a5c8d05b9e067a121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585290, "uuid": "d23d6903-7633-4ddb-9239-c955e51bd95f", "comment": "Malware payload", "value": "d84405feeeb445a4b466eb8bec983789879483f7dc4e0e22f8559c120d765825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585290, "uuid": "8aa32caa-63fb-4267-b73a-1df09ab6d870", "comment": "Malware payload", "value": "a071d7a349f98c223fb59d83fe1ed7445ebf6665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585290, "uuid": "5f19dea8-6096-4a5d-b67a-0376bc9c6303", "comment": "Malware payload", "value": "bdfc3edb81d6c170cd22094e0638d7e90970d1efaf578619e1902a7fdc27ba0dea8b008526a7c523ade381fc796eeeaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585290, "uuid": "db2ce1fb-7220-4660-9923-ed3306c55518", "value": "T149F5F50679A1CA75C057DA318CB76252367DB875173333D3E9926338EABE6E95B38300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585290, "uuid": "fb08079c-d2c5-4618-954e-5bcc4341a7d6", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585290, "uuid": "14432cea-b6fa-4cd1-acce-b256a16dddd4", "value": "24576:fA5VQUQn2pjh8ENNUcFRXdUhc6oEViQR4MfTX9EH1Idmbwq5uK5rLGmDFGnz+3GN:fAj7Q2pdNUcFRtUhFZigtEF5L13IdKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585290, "uuid": "ce58ab9e-beca-4735-8bb1-fd540e0d04bc", "value": 3326953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585290, "uuid": "fb374a38-77cc-4e66-a6c7-f9094e06990c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585290, "uuid": "add427fb-2f13-4784-a4f6-07cde58682e6", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05b32fe-b382-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761603406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603406, "uuid": "810fd21b-690a-485a-a48b-1df2352ec5df", "comment": "Malware payload (Mirai)", "value": "370f466bbeb45e5c9836356e76a0fd8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603406, "uuid": "3ff29a07-0d31-4aad-b2bb-da14ef4e1bbe", "comment": "Malware payload (Mirai)", "value": "d9076cbc901f444cc357dc26fe5c8e8a2ed7f1164ccd36ef44b49b912ff7f2e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603406, "uuid": "986869ac-2308-4739-b706-768d0440e0ff", "comment": "Malware payload (Mirai)", "value": "cac3f74342ce70350b2826a059f70dc2ac9d9480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603406, "uuid": "d0df26fd-c191-4415-8104-357caa3fcce3", "comment": "Malware payload (Mirai)", "value": "09c20d6b77cac16eb5523f9854732b25d9947beeccbccb1d5ecf21ae65bac69b17b6bf078e0ad2b8b3e63ad834cc1a7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603406, "uuid": "9a3791ed-50f3-4cf3-88da-69d219120c28", "value": "T18153F26617FDE335E86A91B6DA424FC4B8D13F938BC753D50B8A3D7598AE0243760881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603406, "uuid": "6842ce6f-7ec8-402b-b180-f4b35d33068e", "value": "1536:Nfrzr2ewaNb/Ox8VaQ2g8hIL3aFHG4WAj+P3QSo:NfrPtpF2Jh1GiE3to", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761603406, "uuid": "569188b6-b409-41c8-b83a-f3bf864330dd", "value": 66288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761603406, "uuid": "50d875e7-f8ea-4c3e-88a6-c8424b8ed5b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603406, "uuid": "214c6872-8e15-4525-bd7b-585d21d88e0e", "value": "Orbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653a051d-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595576, "uuid": "616b3320-b5bf-4c4d-a73d-5f726fcadb7f", "comment": "Malware payload", "value": "f32408a39165c8b08371ba61f211c1e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595576, "uuid": "b43efe79-3280-4bdb-839d-daf7b91df815", "comment": "Malware payload", "value": "d9fab54c79e2334cc68cd9d045cf0a95c9e62b1f0ef03ad68b2c7a1f0d0cd773", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595576, "uuid": "0b29a989-3d1a-474d-add1-dd3304fbac4b", "comment": "Malware payload", "value": "fd1f389387321a8f3b7bfec11a78b263bf3784a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595576, "uuid": "2434b1e1-38a9-477c-973c-b06f157fab8a", "comment": "Malware payload", "value": "693095ca41ad709d4dfd3bd3faa418c868e8dc9a28a956f9e07d466c4677759407338d8e31ccd78691a57e1bdfe4e473", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595576, "uuid": "2a515fa9-f023-4d53-b2db-0ac653264608", "value": "T1C815391ABF6C85A5C027E13E95938555F3F278428F319BCB1291572E6F3B7D80A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595576, "uuid": "4ef5b12e-1598-4a2a-91cc-292825cac636", "value": "9e050fcc9970590383486340a11d1216", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595576, "uuid": "fd4ab2f2-c00d-43d0-8251-38643e0380ef", "value": "12288:Yadnl9FjpVIaDwURXNJvm/VzvgpKOVaKaFLeKgAW:Yadl9dIaDwUFfk1gIOVMpgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595576, "uuid": "95d9a2a1-5344-473e-b3ed-07bf438d4502", "value": 886136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595576, "uuid": "1e1bc027-3233-451b-95d2-19c74351a020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595576, "uuid": "17e0cb2f-34cb-4c2c-92d0-4d300d4ac05c", "value": "crash-handler.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2249a32f-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577425, "uuid": "7293847c-a91e-4bc3-8c13-d1ca2f0b0cd1", "comment": "Malware payload (Mirai)", "value": "7bc4b443a584943e22c1afb8256595f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577425, "uuid": "a195e496-9d8d-48d6-bc79-7a71e43a37db", "comment": "Malware payload (Mirai)", "value": "da3b10cf2f8e10fdd56481096c277b34c5c73dadbf375811a779cc81f70f51fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577425, "uuid": "6b393f84-1580-425f-83cb-13beb7364e31", "comment": "Malware payload (Mirai)", "value": "9e107e0ba646780e63cb9d18e2ad4c7bfc7c1f73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577425, "uuid": "6ad71ddb-02d7-423d-b7b9-3a917906eaa7", "comment": "Malware payload (Mirai)", "value": "9adb0e969b3fdab7604e952070077e5ee4f059d561c3f3df81de01ba065a1f2805d1b6925b24a0accc8b4b2b02510d7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577425, "uuid": "aee64fbc-4e28-446b-a5cf-80a8b80120ae", "value": "T172C307B2B904DF66F40BD63604D34B257E30BFA74E931622732B3966AD362D42827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577425, "uuid": "daa6b66d-f3a2-488c-8904-55b7c37f32f5", "value": "3072:TqzSKAOCeVRpkR84/1o0/xypXEYHmqYQcuL/1nFWNb:ySChVRpkS2yp0YHmqYQcuL/1nFWNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577425, "uuid": "e019461d-adf2-4cf0-aab3-48517a132c5d", "value": 119535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577425, "uuid": "fb7d6cb8-e51b-4ff7-b4f0-49d095cba49c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577425, "uuid": "d9adf5e7-72ab-4482-b9e2-6e89118415dc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f2d548-b30e-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761553617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553617, "uuid": "bfaefb40-4fd4-4bfb-ab8d-b4585d27e364", "comment": "Malware payload (RemcosRAT)", "value": "c05f6772e6a0fbf884d6e000e84214ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553617, "uuid": "78eae123-f6ce-4329-9b04-552ab821e25f", "comment": "Malware payload (RemcosRAT)", "value": "dabd1fe619d046219b71202aa9b08107428b27beef8cce69137590dbb2fdce8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553617, "uuid": "6acdfa8f-945f-4ac2-b7df-1495bc53bc06", "comment": "Malware payload (RemcosRAT)", "value": "5b77f30e259ace4dbc3f50e11e404a1b8e012fbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761553617, "uuid": "de5336d5-3631-4bec-8b55-5733e6d4e61e", "comment": "Malware payload (RemcosRAT)", "value": "1ce387baafdb01b331cfb1a6df886b63ff5a6232e480e5d1769fc0d83f7b32036985a0c72a2db8947b337a56ac41c221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553617, "uuid": "70b557fe-b239-43d4-9d15-5955688ad7f1", "value": "T11485CF21AE518D36F12F3679C81BEAD658297EE02E14B84D7ABD3D483F396C37422153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553617, "uuid": "1617b4e4-49b6-49d4-b31f-fd511762e8b2", "value": "f967b7a1a41128b4de93c30ff6b8647f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553617, "uuid": "17681fcc-ba91-4606-a719-c3cc257905e4", "value": "24576:sxPTTSC4O4MIThJR7aGDKsQ8oSjYqDHUBlNQDc3nG8/ZrjWhCpkTQ:sEC4ZK78oSjdUvNQwbR8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761553617, "uuid": "e06b5a8d-6562-4835-a149-cf4f50ef20fb", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761553617, "uuid": "bf542b32-b3c3-41e4-9adf-446731161b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761553617, "uuid": "cbe57b80-ef4f-40d0-90ca-efef98dc8ff3", "value": "MOLTRADE RFQ PO#GB600 SD5900K 687400938.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa32917-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570817, "uuid": "8de06e3d-afea-4a37-b8b9-7767b4729b77", "comment": "Malware payload (Mirai)", "value": "fb55d45aee9d8996cfab731038534e46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570817, "uuid": "8ac5c4fe-fc87-4c47-9c6b-6b2f55b14179", "comment": "Malware payload (Mirai)", "value": "dae8c2c5cc32c4e30f6309fd8a9f7bc3c2287be1fa982e022704bdd14d54a5fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570817, "uuid": "55a50d62-9b28-40ef-afff-3a3f3709387b", "comment": "Malware payload (Mirai)", "value": "341a63c8bcf15c0598104b6ce4b054e2e17f1854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570817, "uuid": "5deb270c-2cbe-4e18-823b-50e56f5964a4", "comment": "Malware payload (Mirai)", "value": "d1dd27f2ebcae4a08f62f9b8c6aaa186696db0fd3be0b66796aa7d0b6a7c73906ceb54f3481b535d13fbb0fc4204c077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570817, "uuid": "64a4e582-32a8-4f63-85eb-61d2cf8c7d7f", "value": "T111C2D0B1FA30FEA2D4302EB6EA498583B895063E00EF253B65141574FED18836BF15E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570817, "uuid": "3bce3064-dc81-43ec-befe-41931c8d33fb", "value": "768:4MKyhegCCMqf32LoVuBvwtl9G20jFEzflFWl9q3UELu2:PKy4qfGLWuBol9p0jFEbTLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570817, "uuid": "bdcd2220-4881-4dec-ace0-fffbedb33bac", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570817, "uuid": "91dff25c-a988-4933-9391-f340d24cec45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570817, "uuid": "ff84f815-4eb7-403a-b524-76612530e819", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37990a7-b313-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761555818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555818, "uuid": "dead9b4d-5e4e-4b8b-ad55-6e2c1903382b", "comment": "Malware payload (Mirai)", "value": "f41e60fbee24d9721894c57e5d0f9e82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555818, "uuid": "1ecd1a1c-9313-42db-99f5-70b5e5f5c12e", "comment": "Malware payload (Mirai)", "value": "db0261205abe69132eec97a6132b214f6a67dc71c152aa435ed626cd29b519ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555818, "uuid": "3a327422-4f70-4361-ba4a-04b39eec8c19", "comment": "Malware payload (Mirai)", "value": "38f84d1cc52e6658baaf6617f27413c9243cf0b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761555818, "uuid": "dc971dfc-bc4c-4f5d-8867-d581a155a461", "comment": "Malware payload (Mirai)", "value": "8be4c4bf3fe7c115a66894e0b06e64910ed9e000c28a9d3234011a06f63899414028ea6bb28167e410f76dc9baf9f828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555818, "uuid": "3db0e5db-f038-44f8-b335-d58963ae634c", "value": "T1D2F375397E11AFBEE278863107F66F70CF9529D326919341E26CF6185E7128C1C9EB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555818, "uuid": "8f691629-703f-4044-9f1c-1868d48942a4", "value": "3072:NMVhnf7YLx0Bedi1ebcRg/r6mUlGPaLEgvI6Nb:NonTqgOr6mUlGPaLEgvI6Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761555818, "uuid": "6f827365-4c0b-4bdc-b70f-005d84a34103", "value": 160201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761555818, "uuid": "0a76227f-03f7-4178-989a-e38c3de16ee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761555818, "uuid": "cdb2d346-8b83-473c-bb5e-96ebee5d96c5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10789b94-b317-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1761557209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557209, "uuid": "844f70d6-c7d5-45ee-90df-f637191511a0", "comment": "Malware payload (DarkTortilla)", "value": "83e6feb12b197c8351b82f46935b489b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557209, "uuid": "d60dd227-4c99-4fb5-b1e3-5373f9408024", "comment": "Malware payload (DarkTortilla)", "value": "db9d3f10e7fe84323b9bfe6a3fd205b98c83625314422b0a8f3b66f424d3d244", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557209, "uuid": "e245f0f6-b9c2-4d20-a85c-80c9c74b25f3", "comment": "Malware payload (DarkTortilla)", "value": "8476a5b32e87603c4e36f8429744b6f0d40aca60", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761557209, "uuid": "067c0539-2e8d-47f2-903d-2eba088a8570", "comment": "Malware payload (DarkTortilla)", "value": "acb9652740fb290260e9df6c22406394cc9744fd1441047a71a838df1c836ffa9d3958178ffae38203bba1fd7d6bf3dc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557209, "uuid": "29b31283-54a1-41ab-915e-f8051c6ce144", "value": "T1FC25C0182BD68F48D43FDB34CA72461807F3ED47CE22D3ABAA4138DCE66A7465511B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557209, "uuid": "54913205-d00e-4dbf-a002-5d8db9f6d2fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557209, "uuid": "2553b9a3-28e5-4b56-8174-ce1df2365b88", "value": "24576:AhuhCgk+pfb2M/4uCPNxPb+cUxifknY9DFrWudXk:Q1+pqM/laxPhX8upXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761557209, "uuid": "c995af2e-5fe2-4c7a-9ac3-043186699852", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761557209, "uuid": "69b2db30-9ff3-47d1-9eb9-392e45caf337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761557209, "uuid": "ae169ed9-2bf9-4c24-9574-d6b4b50a938d", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdee04f8-b358-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761585417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585417, "uuid": "7fae9df3-940d-4d85-9bf9-8c50e39ce071", "comment": "Malware payload", "value": "bd57064bd4a311e39db224c8558342b4", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585417, "uuid": "890e4f9f-1dbd-4726-bf0a-e8de3cfd4734", "comment": "Malware payload", "value": "dc6eb444ff0953df7439d2c661d44ff404f0aa573b21e5e4237dc448c046e483", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585417, "uuid": "95c14aff-4577-4d68-9b58-cf5397a244d2", "comment": "Malware payload", "value": "1b68e6e9e2250be5a26b157abe21c4e3e2dc9fe3", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761585417, "uuid": "db017da1-31dd-4c7f-beae-ff6a62f9f325", "comment": "Malware payload", "value": "a6e8c93c1dbf386eca6b48fdb2dced32f39337caed572d6e57ed3a4a6758bf77393b6cfcbb2f7cdfdcd3e0965eb25482", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585417, "uuid": "d3d71997-a5a6-4416-b602-34c4d4245139", "value": "T114E142CC3DC970B0CB266137196AB816F51BEC41B80C957CE230F6A47EE17289A6F5B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585417, "uuid": "0271be81-221e-4e28-b10b-17689869c56a", "value": "96:iDePivjPdDXCwMktNrUM5QT8UvXzImqn5JgM6ny:WIs7M2xbQImqDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761585417, "uuid": "4c26653b-1622-4b87-851a-8374092ff9fd", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761585417, "uuid": "3350d8ea-7107-4737-a8d9-159c6faed7f9", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761585417, "uuid": "3e89a85c-8f53-40ed-8460-b89fb72205dc", "value": "Payment Slip.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b28e5a6-b321-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761561709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761561709, "uuid": "fbfd2a74-e3e8-4c57-aeea-039695a99a83", "comment": "Malware payload (Mirai)", "value": "dc503b79b49c4a357e476b02322e1de1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761561709, "uuid": "bef3a763-70cd-42f4-97ea-fb0ebeef9f97", "comment": "Malware payload (Mirai)", "value": "dd5780eff90031e8250caafad60e6a0fb5c39cb71c8408b93ad4feed5c7f0348", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761561709, "uuid": "8d3a10ba-e10e-4365-9eea-ad259cd646fb", "comment": "Malware payload (Mirai)", "value": "3846f8d3d8cf57707802b28ac0d67c72e23e9f79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761561709, "uuid": "b6f4708d-c830-490f-9011-a3ed461dc650", "comment": "Malware payload (Mirai)", "value": "6b14571f99226d0f3e7bfd0ffef538dbd1288f3e8ec0db254ae07942c0ad492b146ba9febae8a143fe523de81186c466", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761561709, "uuid": "83fdd858-92a7-41fa-92c6-59c0f473b5bf", "value": "T105B31885B881EB21C6C256BBFF4F428E7316539CE3EA3203CD195F6136CB55A0E3A156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761561709, "uuid": "5c827f77-d6ea-4b76-9d9c-f9a5a02523c7", "value": "3072:xjddh2hhFOWLv2dBji10mV9I7FNe80kwtrmXrd4F+wa63vhBynwvGznz2:9dd0ZZLv2dBji6mV9Ihc80kwU5ht4vH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761561709, "uuid": "29eed9ea-3637-46f4-b298-ea8f6dd7b866", "value": 115968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761561709, "uuid": "e235da18-5ba1-44d6-8e0b-9040cc0b9416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761561709, "uuid": "e0d2c3fa-8f95-433b-9189-6033f43ef691", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40608daa-b33b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761572751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761572751, "uuid": "7a280b93-26f4-4f81-bd18-76dcf54aff9c", "comment": "Malware payload (Mirai)", "value": "6095042009757f7ecb11e94abaec091b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761572751, "uuid": "03d4e716-2355-4d04-aa44-e0ad4a6a5457", "comment": "Malware payload (Mirai)", "value": "de0f6fab97e5a89bbe0b2834615c299dbb605aca1991d1c72278823d1862e319", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761572751, "uuid": "6955bb35-7fe7-4877-b19f-808b51df722b", "comment": "Malware payload (Mirai)", "value": "327859848e0b58323123a80f7adb6006c1355787", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761572751, "uuid": "e9df480d-73ff-4e7a-8e69-4757e6104685", "comment": "Malware payload (Mirai)", "value": "62cec9c48711905392d395c983c7de4eeb3939b2fd84b93a6600792ce3b851de191c9520b35a45fd9150a103ec05efbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761572751, "uuid": "d6408220-feef-4ac8-aff5-dc1471598b29", "value": "T13EC3E195F7377981D09201BDA480498783911AB5CBF2270407ADEA3438BDCFA1FA9EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761572751, "uuid": "6fb1e552-dd14-4c1c-8091-a56bd9085ebb", "value": "3072:GB31iZTkgswEmnQOyPlvE58/q8IdS7Pai51tzeMMTnB:wSNzQHPO5UIdqBtaxTnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761572751, "uuid": "9524237f-cdb3-4a24-8143-a48e7a69756b", "value": 119908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761572751, "uuid": "97236e3f-5c45-46ac-b9ee-b3d450783fb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761572751, "uuid": "3f1b202c-d379-469a-b14a-ffd3c029eae7", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b051129f-b364-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1761590548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761590548, "uuid": "0ba8f009-ec07-4c3c-90c1-393fe92a390d", "comment": "Malware payload (Formbook)", "value": "1e178cfda97095b59122f9d0b5ee6af3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761590548, "uuid": "5a80992e-e6d1-4e0a-9213-d9d168425995", "comment": "Malware payload (Formbook)", "value": "de312dcd59a31066154401efdb6bccba79d20c4f4d9d926c6123ddcea9c2b3da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761590548, "uuid": "1a52d62a-8126-4ed8-a55e-c69c0a7da34f", "comment": "Malware payload (Formbook)", "value": "cb323c30fd088fac6b47dbec49b735bb5e78d8a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761590548, "uuid": "87e48893-51ed-49f4-84c6-c60967ab16c7", "comment": "Malware payload (Formbook)", "value": "d3a708f5d4db78d5f431c2efbe8ab3927575f51bc8ab9ac5051012aa490d1e630890037c441c52cdc043bf085df8805e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761590548, "uuid": "95f41612-29ac-4082-8779-911868ce05aa", "value": "T11A05F1142BDACED2D4660BF44C70F2B113286D4AB005DE2B8FE57CDB35A6B05263666F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761590548, "uuid": "787f01be-6ba3-4766-a615-6ed97ef90b69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761590548, "uuid": "2ba88b09-d17d-4c9a-aa71-d4a88ad6b8f5", "value": "12288:nWNzduH3HU9CfLoCHPGObFGX3PXu+F2jQ/rvzBWmnSNW29/P3hhLXvDIo1SZ5YrA:X3HUc0wPfbM2+FBrKH3hhTv51KYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761590548, "uuid": "479e1c42-ada1-43b9-8826-4e11770e1b42", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761590548, "uuid": "faccae10-cdaa-4c1f-998e-0e04c424e4cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761590548, "uuid": "9ab4b8cf-017e-47b6-a4e5-d8aa1a24e1d9", "value": "jPSSgjTHvKRoft0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bbd5b5-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570899, "uuid": "d6573f63-8863-4b2b-9f94-5ec5a512a1ef", "comment": "Malware payload (Mirai)", "value": "11b7928f85e5fdf4f59bac21b393537e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570899, "uuid": "66e2f0f0-b0c0-4c62-9f2d-f66c3695a551", "comment": "Malware payload (Mirai)", "value": "e024d59c5b2ea325c099ce5b9b1b46e0e0ffffb93e45b6c8d86a312c9afce0c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570899, "uuid": "8a65ad56-b4f2-4fc7-aa29-33637ed3e01a", "comment": "Malware payload (Mirai)", "value": "5ab4e133996589b5c578a33fa3552033dd1fdee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570899, "uuid": "de029b39-d054-4547-9348-dd2341a7e9ad", "comment": "Malware payload (Mirai)", "value": "241074577427c3b165ecfe6e348c9fe07766c3daeee6c272413b42bb28703100ca555c65f1c5e947cf95f7330314e0bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570899, "uuid": "81c5c47c-434c-4f3c-a52f-65328eaa2c95", "value": "T13CB3C41A7F159FBDF6DEC23447F78E21465427D62BD2C041E16CDB502E2238A684FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570899, "uuid": "baa2756f-c60c-41bf-9ef7-7aa730217679", "value": "1536:DcEpqra6qCv/Vmp1G3lhDRTdQCMpzhe+B2lzPQ55ryW6jlFCc:gEptC3VlfQCqzD2lPQ55yW6jlFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570899, "uuid": "9dfda856-f82c-4ed1-9abb-9a520d805982", "value": 114771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570899, "uuid": "baed1098-4255-491f-a49a-2fad60a558e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570899, "uuid": "0015c84c-5bf2-4d6a-a7f4-7cc456774a19", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099164e9-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607019, "uuid": "e0394f8f-3298-4abf-9496-5e57d417fa3a", "comment": "Malware payload (Mirai)", "value": "40d7e1d6709e3c334ab2b67feb0ea268", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607019, "uuid": "48621ed1-3562-46c6-97b9-64344dad05ca", "comment": "Malware payload (Mirai)", "value": "e0e9b45d3d3d35ff9ddc2cf5e3f21e0a1107b0d5fa98608d91ec2aebc7732510", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607019, "uuid": "90d55a38-4272-40bc-9803-8587ec7819e2", "comment": "Malware payload (Mirai)", "value": "d40ce4e6c38a134f5b863740b8a220d80420090e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607019, "uuid": "00ad1613-0252-4a7f-9459-4f54cd4a1f79", "comment": "Malware payload (Mirai)", "value": "a3c79e18a8ce0adfcd06418ba3eabdc4f18de63c0219b8f1a71ea881270cb76edbfdc28e1d2907325deddcae52d685df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607019, "uuid": "eb516d09-0948-44c3-8a4a-caebd8cc423a", "value": "T14004881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607019, "uuid": "0f081b69-96b1-49e2-b83e-dd038f430994", "value": "3072:jg57R17LHZwbq1YSBan1yvbysxr1uGSLI:jglR17LHZ0Bqyy1BSLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607019, "uuid": "16e406c9-14f1-415e-be7e-7382a0a16684", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607019, "uuid": "81f8a06d-d3b8-4664-a2ea-c8b31bf6bbd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607019, "uuid": "adaecdee-4a42-478d-a80f-233cebadabb4", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa308059-b374-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761597410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597410, "uuid": "320e5083-e2e0-4abc-a486-9f53ca622eb4", "comment": "Malware payload (Mirai)", "value": "88ce3a8f0fc5512373abc0cb52461f06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597410, "uuid": "daf61bdd-135d-4c68-a5f1-bf48bf8bd70f", "comment": "Malware payload (Mirai)", "value": "e116857c7966f392d46f95e775334143f01a5e8b479e7ba9d14baa33609bb0a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597410, "uuid": "1408200c-5c06-448f-9533-74bf7a69a635", "comment": "Malware payload (Mirai)", "value": "237cfe0b335639035614dffc10384698adcc5890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761597410, "uuid": "addf0cb3-fb12-408b-91f0-b62027d2cb4d", "comment": "Malware payload (Mirai)", "value": "b4203cba487b50892c53ff99dcc99726ea9bc01993108e885ec506c9e746c183d6a6f03fdd6a333499c692172c2e72d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597410, "uuid": "43b913d7-256b-4384-bf47-15aff5c0c4a2", "value": "T17F24C50A9F610FFBD8AFDE3706E90B0265CC650722A83B7A3674D924F54A54F49D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597410, "uuid": "ffa21d9d-9c22-4bc6-ac16-51083d2cabff", "value": "3072:yWJEZUbavuoDou5prbGI8keOJ76ZN5Q5XpcV+vb3:yWJEnvuoVPbR8ke46xQ5ZcV+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761597410, "uuid": "7948f2ac-e649-4c2b-9bd5-722dfb897f94", "value": 212672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761597410, "uuid": "05e2b2b5-58a0-465b-b459-5b2b78121244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761597410, "uuid": "9394c572-ba5b-404b-9303-9c133e57c947", "value": "irannet.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a73b4f-b339-11f0-91c6-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1761571793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571793, "uuid": "4aa6f2a2-90e7-44dc-8f62-8fe8b0c3e7d3", "comment": "Malware payload (Phorpiex)", "value": "c99680c6dc7f046183d8ea4e5089ef64", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571793, "uuid": "1c1e1365-5999-4351-875c-743c81469524", "comment": "Malware payload (Phorpiex)", "value": "e1c102d81d89d3d406917553c421c6b23cbd3333953a050d650f5394bfd6a73f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571793, "uuid": "81971ae7-21ec-4570-b56d-0ec2ca002954", "comment": "Malware payload (Phorpiex)", "value": "58153e5b767a15607020d2861cffc5e0045f6c62", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761571793, "uuid": "bf4688e0-d5fd-448a-ad0b-cea005a0b44b", "comment": "Malware payload (Phorpiex)", "value": "ad021886f5317dfb16287c762281e4a93e9555115cea3f0e526270dfa4bca75c06d14d3d47719d8301bf5a5d640c01f2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571793, "uuid": "6ecdc4c5-5e8a-42f5-b44b-ad3cb2727118", "value": "T123A21906AA56534AF871187063732E3664797E77230E84CFEF80093A1270DE4FA3335A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571793, "uuid": "3c651b84-9a5f-4006-b2a1-86ef85a544b7", "value": "bc7429c21973649e822dbec2b14ff39c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571793, "uuid": "89979211-d020-4f84-80d6-51efeb10d9d6", "value": "384:Qk07SPPMHliW1uUYzdFYhJ4JVB0TEtSknR:vPPMH+UyzY+IE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761571793, "uuid": "c3607224-ac5d-4379-b1d1-c6ecd95f64b7", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761571793, "uuid": "1299eba6-c0b1-49dc-8292-01631fe9f950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761571793, "uuid": "fb69d862-8544-4457-8961-6b22172218fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926ae48e-b378-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761599088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761599088, "uuid": "53dbfc74-3daf-40b9-a670-6ee1b9c6c3eb", "comment": "Malware payload", "value": "cce64cd9fdca88ebdc476c3d0ff22274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761599088, "uuid": "9e9303e8-a685-429c-a7c1-9124655bcb14", "comment": "Malware payload", "value": "e22b2799b0afd872343083864b58dfef93a1e19838e540944beba1d58cf0512d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761599088, "uuid": "6ab23ac7-5962-4d45-afa2-99fe8d9dadb4", "comment": "Malware payload", "value": "c64d8cd5a34ca9add4affe8b2f160de93a63cef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761599088, "uuid": "2ea09f76-7dfa-4673-8d32-84f0e185dedf", "comment": "Malware payload", "value": "bb8d237d3955e76f219f140a23ca535b55244deccd2b6ffd9037e60da13ead804216e1a63661890bcfd516ee153d6c7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761599088, "uuid": "a9663c61-3e47-41c5-b36f-8d9b3d2c6077", "value": "T11AF471216FEBDDC5E04A213F843A1905876EE2A1170373C37706BA72AE455AFDE1C2D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761599088, "uuid": "4db9af24-efbd-4015-8652-874c57f4ffb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761599088, "uuid": "3f540b4d-bf53-44c9-898e-4dfe4694f3e3", "value": "12288:vak1VDlu1FPzQet+Q1tbATPfTB/QGH7bCOTXk0aRWsRIGPGk:CguPPzl+QHcTrdhbbhXVaRW2PGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761599088, "uuid": "5e5348f8-d332-497e-88d2-f8d89e69a4d8", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761599088, "uuid": "981f46e7-cae7-45c4-bcf2-af0548068b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761599088, "uuid": "9e8b7a92-94ca-4636-948d-f1f431b618bc", "value": "setup.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6fb0a8-b331-11f0-91c6-42010a9c0006", "comment": "Malware payload (AMOS)", "timestamp": 1761568692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568692, "uuid": "0202c20b-faa7-41d0-af26-ebf60bd4df41", "comment": "Malware payload (AMOS)", "value": "0dc5d9afdc09d7b5cc4954f9f9a781bc", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568692, "uuid": "50a2799d-1dc5-452c-b3c3-4f1eb630c0a9", "comment": "Malware payload (AMOS)", "value": "e2b2f42878dbbb41e09cd46f2495d8e645abe352e69f48c122e046d0c5d3b82a", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568692, "uuid": "99fcf002-b411-41e2-a35f-2d122daee77f", "comment": "Malware payload (AMOS)", "value": "a7a53fad9fd35f0fcb39a62f7b80b1eec4bddeff", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568692, "uuid": "225a505a-a8c2-4fa0-855a-048dde82713b", "comment": "Malware payload (AMOS)", "value": "255402ba64a42d99128f055ae2d198e7f79b7102bc2c6a7191906cffb1cc393b36e3c70da17e7aed08f745fe76a322c4", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568692, "uuid": "80bd4412-5f6b-44b5-af79-35ffa07fcd64", "value": "T1BBA395294B2865B2C28C8B3941D753177163F18A0AE39A5F77CDC52CBF86398B970D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568692, "uuid": "dcccd629-714e-4876-b678-95ab85dc3268", "value": "192:dLliVSBJksLUyayHIJj311VSBJksLvy+y:NWM7xXH8jlLM7qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761568692, "uuid": "937c9c92-cc31-40dc-8a56-b84629b38aaa", "value": 101536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761568692, "uuid": "9b44c7f0-e1a4-4623-a764-b7cfc48573ff", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568692, "uuid": "9fbbd52f-6817-40fe-8bec-bbb05ba2b18a", "value": "apps.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7f754a-b368-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1761592392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592392, "uuid": "dd71411d-4a64-48bb-8576-60d14d430dd9", "comment": "Malware payload (GuLoader)", "value": "a3e56a15734c82f70716dc21240ac0b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592392, "uuid": "56a16e83-fedd-446a-b9b1-85a4dc949429", "comment": "Malware payload (GuLoader)", "value": "e2b72232396c9b4cd758cc2c4b65fb4bbba841c2d3a4a4ac45a2a0354ac360c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592392, "uuid": "f8ef28ff-4ab2-448d-a383-3544b732c333", "comment": "Malware payload (GuLoader)", "value": "99f266a01121d8a7e126a2fb30599eb4f8032b35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592392, "uuid": "3dfc6b69-b574-43ea-a753-5a91e2137f53", "comment": "Malware payload (GuLoader)", "value": "4d98862ce7635fc27fe7b6ec2458fb8bbceeb5664b4f78ba85c65ecd91d0381fcaeeb5d76b335a9742ea95c5f82ed525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592392, "uuid": "7fa5d64f-178e-4912-9c73-3ce44e39371a", "value": "T11A64131026E4CC2BD8112F3059B25BB78FF6F2222C54E30B27985D1B3D365D2AE6E746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592392, "uuid": "1090b7c0-1031-41cc-9c8f-81fc839535bd", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592392, "uuid": "8889830e-607a-47e9-8c80-ce80f3dcbc7d", "value": "6144:eHadpdwMVrPg1tNaWJCrEWjgVblQJk43gv8pamoIpOIifafwYBu:eHadtrPg1jfVblyFgv8ppzOIifaYYBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592392, "uuid": "c52c32e4-1a77-417a-8fa4-a3ac04342f24", "value": 313184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592392, "uuid": "13536c03-c3ae-440d-82fc-a71f919eec39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592392, "uuid": "7ea7a58a-de42-49b2-ad09-2cff777a4d1f", "value": "swift copy payment 22 oct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f56b4f5-b347-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761577930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577930, "uuid": "c2844c17-06cc-4bbb-bdb1-3ea24f343217", "comment": "Malware payload (Mirai)", "value": "ebf89cb821db358ee7766e9d24350aae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577930, "uuid": "7b51baa1-71b5-465c-a420-38073d26c102", "comment": "Malware payload (Mirai)", "value": "e48de28ea1f13d46b6c97f2001b21487050c61f7389f6e82d4d37131ff69a739", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577930, "uuid": "f02c7fc1-6781-4986-963b-b7ff47c9f029", "comment": "Malware payload (Mirai)", "value": "a393b46fe5501df7e9d253730ecf2e5612b391e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577930, "uuid": "68a324d2-1b0d-4c22-a669-a063f58e453e", "comment": "Malware payload (Mirai)", "value": "398e70e5844362cfba716637c23ad07a055799ee08e758404c609be593be1e191e673d911cfc5fd8de10931466b85a72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577930, "uuid": "d0a2de57-b903-46ea-a6d9-0e8fefdfe8d0", "value": "T1B7F2E183A4FEA548D596A2FC124F6EC98771FD04A1C0816B78F5723F2D85760BA38367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577930, "uuid": "b4ade462-7977-4667-8065-a06592b6a661", "value": "768:Q9u79yhyIZJ+dIxZZtim5JZAKdfxm0jPxLknbcuyD7U1gUR/:ahyIZpX15kcfxm+Knouy81V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577930, "uuid": "50a0a9b0-0510-4772-8a66-883ebb62fd54", "value": 34364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577930, "uuid": "17c813eb-360d-4dca-b050-e4d3d0714c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577930, "uuid": "eddfc186-ad6d-4979-806b-d25edf319fd9", "value": "kvm.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583b4302-b33f-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1761574509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574509, "uuid": "5a665e0c-4051-4f19-b64b-758d887ac4ad", "comment": "Malware payload (PureLogsStealer)", "value": "0e3517752c543b5ee156189f9c413bf0", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574509, "uuid": "921d96af-ccd4-478c-9e64-e978c2e3624c", "comment": "Malware payload (PureLogsStealer)", "value": "e4a71c6c35b479ade333666a7fabf2436cac641502ca5b1008ea5b756e99beec", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574509, "uuid": "bfbf89e3-a719-4031-b630-21b82be529f3", "comment": "Malware payload (PureLogsStealer)", "value": "412a96cb2ac077d804475cad4f0b1ce292755ab8", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761574509, "uuid": "5bf31661-d7f0-466f-903e-49fa0fe85333", "comment": "Malware payload (PureLogsStealer)", "value": "d4ea7ec87c198ceb53d20bb0fabd0fee38c2934b0680d0155323408f4ee55f5c060d1942112b596b9fe22c632d73ac0e", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574509, "uuid": "49ae9393-f0c5-4d50-ad6a-1861e9ee4094", "value": "T1046533CB248F49A7A49368DE5F8CF424F8CBA5405EEAF4432587199C70027D3E1AFA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574509, "uuid": "bf294c9c-f5f7-4e72-880d-5393e778d9e5", "value": "24576:IuBg/a+89wFl9u6v97s2DiKNNNFrW/caFHu/3hTwfogTnHM6IPxvffj7GZ7giKSJ:pBKUaFl8p2DLRrW/fo/RTwfogTnHMtPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761574509, "uuid": "9a66a1ab-0b3a-4c01-b198-93036914ae43", "value": 1524281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761574509, "uuid": "ab6fd07a-bacc-4921-a97e-f1f1a5de5372", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761574509, "uuid": "119fb2ec-eb71-4fcf-b517-c2d8c8265ead", "value": "8431456230.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b88c428-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579131, "uuid": "062c405b-45be-43f8-90b2-4423fb39a98a", "comment": "Malware payload (Mirai)", "value": "99f122303fd5c81be244e1b403cdecb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579131, "uuid": "5aa5efa1-395d-4420-96d8-9010b9a3847e", "comment": "Malware payload (Mirai)", "value": "e5716cf2e115597a50b18bb0369c8ae8f8eba5a947633ac58e1af60ba2cec813", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579131, "uuid": "3d29cf76-f75a-4882-bd97-af876b59630b", "comment": "Malware payload (Mirai)", "value": "137a593053cad779091eaa5323fc751adb82d0ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579131, "uuid": "ab0df4c6-7da0-4a33-b68c-d8902a1c2df9", "comment": "Malware payload (Mirai)", "value": "f2bc189812b1430292e73c96e011dda418c79d19cd849ed8a38267aa10d3b6af509c09b49ebfe619d3dc938e62e7ac56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579131, "uuid": "7b063145-6bda-4b8e-8345-793d14537b93", "value": "T12B435ED5B801DE7CF94BEB7A80260A09FA35721154A30F27A267FD93AC721564C2FD0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579131, "uuid": "302db71d-6f9e-45df-bf56-7ed92ea1a173", "value": "1536:PtCdFUWyKsSaA1P4T5eY8CktnSygjVJstg8g:2srA1ue/LJuJqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579131, "uuid": "c164d318-2560-4b0f-96a3-0a05c7d6f7c5", "value": 59716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579131, "uuid": "b092aabb-0f92-4931-a026-75cf9f4e58d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579131, "uuid": "d12d4409-ddcb-4612-98bb-f83a853913d6", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e036bb0-b38b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761607133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607133, "uuid": "a1ad6fcd-9e5a-4c36-a939-d5cc3287bf51", "comment": "Malware payload (Mirai)", "value": "7d5fe639bf187ef958a99c2ec1afe184", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607133, "uuid": "10505b69-4777-4b73-948d-906bfc3e2854", "comment": "Malware payload (Mirai)", "value": "e5fde34078bcc8c9acf4d24ad7e35abd433fb37eeeb726edbf888194b5ef2c7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607133, "uuid": "d1f650de-7c52-475b-8d78-741f7368477c", "comment": "Malware payload (Mirai)", "value": "1ca638859111635081c0502428bab13e6703a157", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761607133, "uuid": "bb2024da-e678-48bb-83a9-8d2aeaa5d11d", "comment": "Malware payload (Mirai)", "value": "b5c57fb328830d06a2e6ea322800608c846521a375b91c9f28977431de082349a3a79af792740eb46a2f3726cfd58105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607133, "uuid": "5de802bb-49fa-4cc9-80d0-6144fa742c2d", "value": "T1DE937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607133, "uuid": "90ccca96-4f23-4298-98c7-7567a738960b", "value": "1536:W/QCZaxGdvts3i5JPhoLsxPu++4HRsUIKqI4FrS4LSA:WYCZa8dvm3oJPhesxP5lR+KfUmDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761607133, "uuid": "9659a1c8-2edf-48a0-aec5-29176780b292", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761607133, "uuid": "3fbe66be-1f97-4c69-bf90-c9f4921082be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761607133, "uuid": "b80f4237-ea5b-4496-bdcc-e75b4652df6b", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3de02f5-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570824, "uuid": "524dcf4c-6103-41ec-b557-aa98850ecb83", "comment": "Malware payload (Mirai)", "value": "75261e3749019b37a9bcf9c9a43ea8e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570824, "uuid": "ce77000e-6e10-47c1-a007-fb3259dc3613", "comment": "Malware payload (Mirai)", "value": "e61783e5eadf154529bcf7ae3cb0863134c28c0ef1cba2e2750ffddd3d78ebb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570824, "uuid": "75e7daa1-6c3d-4299-9d27-edb9986bd590", "comment": "Malware payload (Mirai)", "value": "4eac00a0d497baefb2fcb6a4392c3a07eb66783d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570824, "uuid": "dc5eb18b-ca2a-4f16-a4bb-979df7f63e3a", "comment": "Malware payload (Mirai)", "value": "756018039d817613e37a9a1998ca50044c642ae9a7e5370c6d6b96aed7ed2b911337b5c9bbd43053022dc116bc3a6746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570824, "uuid": "2a06f515-e346-469e-b00b-f0f3ff302ef2", "value": "T198F2D03C0D408ADCD548D1B2BFA71B662E664FF51604DC4A153EBB035EEBA943912BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570824, "uuid": "33973380-ee9f-4159-a8b5-9039453f3088", "value": "768:X0fSmam6Bnjsx3agW2lDmH/tmmWCNTgyJrbyJgGlzDpbuR1J/iElRs0eyV:Fm4axlDa8K2VJu1i90e0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570824, "uuid": "43bfce09-586d-452f-99ec-4e32a0ba5857", "value": 37536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570824, "uuid": "a86c5238-aa00-4b68-bc6f-5cfc1be894a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570824, "uuid": "7e42c613-d9d7-4350-b5cc-36af473dd149", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4950f115-b344-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761576631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576631, "uuid": "265199aa-6e88-4ec9-8731-c93479fc6de1", "comment": "Malware payload (Rhadamanthys)", "value": "faad04cd01f59c6783c99736b6ec6726", "object_relation": "md5", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576631, "uuid": "62d48f02-0724-4dd1-b0bb-2b2ddc2a43b3", "comment": "Malware payload (Rhadamanthys)", "value": "e7296999e1d1d04db296f8fe95c864fd8d1ccf74d3cddb916fa556a88e84121b", "object_relation": "sha256", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576631, "uuid": "d74b8159-851a-43b3-b4c3-ac05cc1ffaa2", "comment": "Malware payload (Rhadamanthys)", "value": "ab1cdb32e251940023329ff19303ded11aad8b6a", "object_relation": "sha1", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576631, "uuid": "91464db7-087d-4a32-bae5-b1997a2beb52", "comment": "Malware payload (Rhadamanthys)", "value": "45ec2993584a8f39f12c25251a08a689f2986beecb1d211c5dc43b8e631f1744f1f0c538386e0264a55581a9f8931ba8", "object_relation": "sha3-384", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576631, "uuid": "41960215-e902-4803-85c3-86a70ea39d4f", "value": "T15036232222A30F94C85D063980CB8F0673A6BB8A4563D75B4771E57F3EB37F0AE56941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576631, "uuid": "865caccd-cab3-4882-9b75-79a88750937b", "value": "98304:IRmW25bi98MhGQk8Hv2YzI4kWpb//hI0iIMt1T8K1r/WT0Scyy:rSLhGQHTTbRtMPiT0S3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761576631, "uuid": "bc7143e4-f0e1-4ec7-ae91-dd5cc08f59e2", "value": 5001866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761576631, "uuid": "698709e0-7ff5-44b9-9e38-84d36ec5c853", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576631, "uuid": "33149f4c-05f1-42f7-9aa3-bdad096636c2", "value": "Pro Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfe14a9-b378-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761598970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761598970, "uuid": "f2cc37c3-48cd-4be5-894e-d66b40b5aef0", "comment": "Malware payload", "value": "c7278dfd15fa23b801a0496831fac043", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761598970, "uuid": "829bdd63-a3ea-4900-950f-c16116576c9d", "comment": "Malware payload", "value": "e896b5e795022de66ab1b6eb2f73a3ad7dc8faf2351d9281fd738da8b215121e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761598970, "uuid": "2635bd5d-dcc8-42aa-92e2-42b7cdd3510b", "comment": "Malware payload", "value": "34e9c29079bf25573fbada32d2c70eb6ced952a7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761598970, "uuid": "d3977f90-7b03-4b6a-842b-4939598b2e4e", "comment": "Malware payload", "value": "b8040cfb804e511583e8c644c49a37c5322f4a7bdefe0b587f141c2d92df953fec9b9b25ec3c157f0f2e1efba5d8b9d4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761598970, "uuid": "5ec3e326-4cf1-4dd2-bc93-6734b3bd6e20", "value": "T14DC08C91443ED032A33E0E4FB291E2F89A86A8384BA039A1E828864065A80B00C4F33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761598970, "uuid": "e06d668d-ec1b-4a13-b97e-19e31bfd98ca", "value": "3:WFBIx8sv3uy9Fb+dNMfUQgocmEtUHeeymHgmQmk0QQHFxaFOd6HhC:/9vrbsMfUhocgebpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761598970, "uuid": "16f8d896-6b1d-4ea3-9c32-4f01f93bc0ef", "value": 167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761598970, "uuid": "3f188316-0aa1-4b0a-b3fd-a3f704b8d544", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761598970, "uuid": "051128ee-b948-40e0-83da-9889655a8860", "value": "m3xgxmm85d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e35de4-b345-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1761577248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577248, "uuid": "ea59a761-e046-4d6a-b027-fdbbb4fb45a2", "comment": "Malware payload (LummaStealer)", "value": "a15b334c54b26344be064191bf9cacae", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577248, "uuid": "bffd802a-06b3-43e5-96b1-9f3bd179ea65", "comment": "Malware payload (LummaStealer)", "value": "e951882145a0af906090c3d1610362bfb2c4f0201fa8d866f0de5bba8dd31f42", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577248, "uuid": "ce98f0af-348e-461a-855c-788713370d2f", "comment": "Malware payload (LummaStealer)", "value": "f4ee1eb875a217af2103025dffce8d496e2f1018", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577248, "uuid": "09f3e9e6-aa8e-46dd-abcb-b18fa96ed424", "comment": "Malware payload (LummaStealer)", "value": "b26af0ee1067b1e9d5d4ae9f68ee1e0e17295e30d00f036e3d6acdd7ef7ec18d5aca2ff1dd7fa92c1b477b4162d47459", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577248, "uuid": "b91d3d55-94f1-4551-a579-f6ef961e4d0c", "value": "T1D50811EEA30D945E2ECAC067AB31B9DA17A56E4271B2016C7619341BA712F4CFCCD4DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577248, "uuid": "1dc2a4ba-d631-4a5b-b1ae-f4b5ba5df76f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577248, "uuid": "a173d954-4c99-4250-b017-f1f7222149af", "value": "24576:Tjbcr0Mm9M89pBia0gjltCEbQAUcdrZxLzVXiKmyuT:TjgrYN7vVkLcdr7VS6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577248, "uuid": "45203c21-5641-46a3-b1c7-3fd46217bb5d", "value": 83886052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577248, "uuid": "7523f7ba-ab6a-440c-8eac-1ea06616e3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577248, "uuid": "9e8be299-0992-4ff1-a808-63b1b486bb10", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edecfc23-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570894, "uuid": "9a0f848f-b09d-474d-9375-5347d6f85fee", "comment": "Malware payload (Mirai)", "value": "b7a6accb85c3837cc632e7ef18c66884", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570894, "uuid": "fcf4ab0f-e442-437c-a496-516a8727ce9f", "comment": "Malware payload (Mirai)", "value": "ea82f3f141e702660e88fd4f93cf257b85b2cef506f6376feae5d9b93f3f2955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570894, "uuid": "dfddd443-4a15-4d75-8df4-b3e26184b1a3", "comment": "Malware payload (Mirai)", "value": "25cc85153e804355c0b31fcb1a46f7d662fe012e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570894, "uuid": "a29e2295-28da-4192-a182-8eb854349a83", "comment": "Malware payload (Mirai)", "value": "a1a29841cf55ad8f0b2647eacc6e94825b62a4aab06e7af5bfb1a0094bc14135df7df46a8093662bf3e8bf66d48f4b30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570894, "uuid": "e1e693a7-7417-4001-9266-a00a3142334b", "value": "T11A633985B8818A26C1C516BFF62E018D372563E8E2DF72139E211F3137DA91F0DBBA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570894, "uuid": "dbe0ca9f-8330-462f-aa82-5123cb42d13d", "value": "1536:KBVttXQIQupO7Q5yyEdaUD1C7jDkQO+e2+0ZJ3nQFHfH5xMs:IjtANuUs5yPaphxetGhQFHfH5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570894, "uuid": "cdc5a4c3-af8f-4539-a7b0-3d111a096a10", "value": 67192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570894, "uuid": "65d2edcd-970b-4c75-af23-1634e5902aa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570894, "uuid": "595fffcb-1207-428b-8140-9dc68b85dd36", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c449738-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579133, "uuid": "fbb7bd2c-d57b-4cc5-94cf-77a8d8c52405", "comment": "Malware payload (Mirai)", "value": "9d357f7fdd56bf10733c9f7e600796d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579133, "uuid": "3f575d3f-e085-4e20-a9bd-da79a6867a2d", "comment": "Malware payload (Mirai)", "value": "ebed52fed58aa78ea0ce0b7a8b8b0dc4c7b51c7d2339f5cd33683bff646ed45b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579133, "uuid": "275c3e8d-280a-4cb9-b714-aeebf5bffbcb", "comment": "Malware payload (Mirai)", "value": "84078aaf3c734aaf8fde6480ba1ba3ef1f59a93e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579133, "uuid": "1b0a1382-0b7c-4f97-9e57-1c7f8a564e15", "comment": "Malware payload (Mirai)", "value": "1283fda29d96390f38105039d6001675f687ca5d31634f8ce20c708fef51102e6c60a6369f42104e4fc8e5274ac7e532", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579133, "uuid": "a2b4cbd1-dec8-492b-8c81-3990a119b5d5", "value": "T18B332955BCD29A6AC5D423B6FA6E519E3321A3E8D1CF3217CC204B1437CA51E0DB7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579133, "uuid": "05644b8f-5447-4a1c-b600-abffe0c3c109", "value": "1536:zznFR4PmUmXs00BsHaHRT+Gg/r6rL2yBCNt5s0cn:zrX4zmXs0Cckvkbs0cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579133, "uuid": "b3652f5a-5018-46bb-b75e-246018b79a34", "value": 53344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579133, "uuid": "e8019229-dd96-4704-a9be-32470f86234f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579133, "uuid": "5c8ec28c-b4e6-427d-ad70-ba917411a8ec", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199f9248-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Efimer)", "timestamp": 1761579128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579128, "uuid": "ef5c9588-316d-4483-b48b-56118a18eb1c", "comment": "Malware payload (Efimer)", "value": "4a2299b2379bbfd27cf4c05c7c73433a", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579128, "uuid": "43fb4325-0467-414b-8202-58dbc2b4faee", "comment": "Malware payload (Efimer)", "value": "ec56b54eed222745fd7731a96a2297b9dd2a590e43c426ba537e0a19b256988d", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579128, "uuid": "f464c941-8fc9-4956-8a88-0ca3b5174368", "comment": "Malware payload (Efimer)", "value": "f4ce77a912a9f7289a09a6ab15e4eb4c67aaf619", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579128, "uuid": "ba47497b-e1b5-4861-ad83-5a4bada7d5e0", "comment": "Malware payload (Efimer)", "value": "d6849aecd87d8de09c9a7cf593ad5fd3bacfe25c92608240f0927b0fb83c092a2101305c0c6351cb233ffe73772a052f", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579128, "uuid": "41f5d6e6-660e-4ed4-831d-e4b522e0549d", "value": "T116D6337F27B002AFC85D55B49E8BA5E29195FB3103218547FEFAE303AA67C93053D14A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579128, "uuid": "00b59086-5cc7-4f58-aa66-8e0d24cbf73e", "value": "33742414196e45b8b306a928e178f844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579128, "uuid": "30bc5250-ef05-4211-a067-239ff22d1252", "value": "393216:9PNwJS9U6Wuwh1XMCHWUjGncuI3/PjuUw2:9PNwE9U6WuwrXMb8ZH/rA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579128, "uuid": "269032bd-ae48-457c-b33f-50c1f921791f", "value": 13586337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579128, "uuid": "1fb7e6b5-e0c9-46e4-9ac8-e62dbea23dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579128, "uuid": "e7ddec73-14c0-4953-8724-c218d70b25c9", "value": "\ud835\udc52\ud835\udc1f\ud835\udc53\ud835\udc52\ud835\udc1c\ud835\udc2d\ud835\udc2c_\ud835\udc50r\ud835\udc4eck_\ud835\udc63\ud835\udfd3\ud835\udfd0\ud835\udfda\ud835\udfd3_g\ud835\udc62h_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ed85a2-b350-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761581758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581758, "uuid": "540c4957-87a2-45f4-a88a-f81943773e6b", "comment": "Malware payload", "value": "d011bde4c1e75621c29ddcd814446362", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581758, "uuid": "56517bd6-83a3-4a65-b556-81928d6a73e9", "comment": "Malware payload", "value": "ed3ac576bc97e7e23ae646055399b3053f88686b18cf2db1136dd93a6be293a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581758, "uuid": "38a2c15d-f44c-40ef-bd9e-8bc9fba65502", "comment": "Malware payload", "value": "25e1c3478fb7a17efdab287b5620b900cb18ab20", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581758, "uuid": "898c544a-3b90-4444-87c6-9954eab18790", "comment": "Malware payload", "value": "d9b3e854cf76c914a43ff5c6ac72092772bd4d1fbc54d290ff12d27a744d5a8d9c9c246a12e7bbe50736e417b9482577", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581758, "uuid": "237bb4ac-2b16-4263-8486-c96ecd61f0b9", "value": "T105B163882FC57028477662332B7F75279516CD80E61F84D9E035EAA439A0F11FBAF6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581758, "uuid": "2b2d4422-d0df-475a-ac64-1b4894229ead", "value": "96:OwPmM2XZbXZUyfugcl5vlEABX0mBOYml+YlvwYR:KM2FXSwclllEABX0mBOlhJwYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761581758, "uuid": "cb89e2ff-5cc9-44b8-8617-7dc11332e5cb", "value": 5233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761581758, "uuid": "0d7ba575-53e9-426b-8d68-639bb97c03e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581758, "uuid": "a0e999a9-fc7f-4464-a964-4cdf55d6d5a0", "value": "Shipping documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588624d3-b2eb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761538432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538432, "uuid": "298b3f5a-b89d-4b91-81b0-dfba527a473c", "comment": "Malware payload (Mirai)", "value": "adc47956a938ac8933faf8b7387e3c2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538432, "uuid": "e01249c8-0c12-4eb2-bfe9-738506ffa028", "comment": "Malware payload (Mirai)", "value": "eea60be23345d41703ea4c2569ee98f6bb05abe2e6f0a0dfa763252e7a8d71c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538432, "uuid": "75f17a2e-634c-442c-9b62-c799de7b69e5", "comment": "Malware payload (Mirai)", "value": "cadce15189989ad3630ef252e81f58e8587df287", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761538432, "uuid": "9b6f8990-5c8e-467c-b20a-d421b09ede97", "comment": "Malware payload (Mirai)", "value": "b753be4426904f422373878bb95dc1eaa93f031c1d86197c7be605a35320155696d89a0b7b578090ab0ba3db665fd421", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538432, "uuid": "51b2391d-ed53-4285-83f1-c00dcc7e100a", "value": "T1C1C3C85E6F218F7DF768873047B38B21A75933D626E1D685E2ACD6005F6034E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538432, "uuid": "76314e75-3527-4a39-ba0a-2989102355d3", "value": "1536:Y88H1Lkwwe4eypjkqJ2IzjvCLEuiQpa5VB4nbHGvcEtueK7N5mt9puW6:Yr1L/wvZkyDLB4nbHPEthtiW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761538432, "uuid": "21f06521-bc7d-4a0c-98b3-e23dfc1c345d", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761538432, "uuid": "20b26e32-4a3a-4236-8ebf-77256ca9e0ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761538432, "uuid": "68413a26-da95-4180-8311-e0f95fc89acb", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06c84d1-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570818, "uuid": "a066d4d7-82b7-4b56-93d9-331d0c33789c", "comment": "Malware payload (Mirai)", "value": "cb56f40977d242a6fb6905f1f9d00250", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570818, "uuid": "81e0c286-b6da-4bb2-9c51-d10e53556ce5", "comment": "Malware payload (Mirai)", "value": "eee7bfbc738bc794d81632cb526e294b6a07fb8fefb03bbfeffccfc207c861cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570818, "uuid": "e6eacb4b-52f2-48ee-83ca-cca0748d8da3", "comment": "Malware payload (Mirai)", "value": "6e1823c977ed806d574abd0e463c6cfc75fa0603", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570818, "uuid": "49f0b991-e6c7-4c7d-967f-05404e35fe91", "comment": "Malware payload (Mirai)", "value": "57ebfd4c4ef7df57a06b62cbd495f977725ac8f29edf114b155643f98dfca111dc1cf61ffafc1fee8439e909697ad681", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570818, "uuid": "a1cdfa2a-8397-4f9b-8605-b6fc826370ce", "value": "T169B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570818, "uuid": "8db4361c-2506-4f63-a5ba-bb1f43853b8f", "value": "1536:0u27gBY9FSSpj3z5Qxw6YaWWgg1E/LWy:19sSyzz36YaWWgg1Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570818, "uuid": "e65ba766-6c90-4875-b355-fef251c4161a", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570818, "uuid": "902c5dea-c07d-46a5-b752-9fe1d04007e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570818, "uuid": "45e8f7d1-0b60-478f-aa07-c6ab1997d5cc", "value": "dlr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7ee42e-b2cd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761525580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525580, "uuid": "c28fbf9c-adc0-4f68-9021-862445d2dbfe", "comment": "Malware payload (Mirai)", "value": "1a218b82ed5b90d21580ac015ce54a72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525580, "uuid": "d60b494e-a601-4064-9e14-14b3e4ffd15d", "comment": "Malware payload (Mirai)", "value": "f01cc7fbe8512b85b10f3978b6f45076b2d34d72d165cbcadb5191a103ed91ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525580, "uuid": "f46d7a28-2cdd-4aeb-9293-c8f8e4611122", "comment": "Malware payload (Mirai)", "value": "eab1785c469d70a1fb335ab1f2d190ee5a3ac5a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761525580, "uuid": "9815c267-660f-4cb8-9f68-a4ee7bb638c0", "comment": "Malware payload (Mirai)", "value": "e28bd1f97911a8b01318eff13fe1ce077061faab22a8fd55eeed39d1b94c50df24e2d0329fa46fe95f1209d38cd5ab25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761525580, "uuid": "3c7cf26d-c3e8-426d-925c-9ac9e1732329", "value": "T18B13F1255E627253C2312F7EA0864D4BEFB8283DD1D7626E3C9145D438D76C0A9B62CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761525580, "uuid": "464281ab-ca4e-48bf-961b-7fa8973687f8", "value": "768:JU7bOTAcM88xjGP5Mtr0M96DvI3271ra3IHhfGVlmONNKgCZSpUXGTObyEkx9q3P:J00+V1Ghs9YI3cqIHhfGVvWXwJkLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761525580, "uuid": "def8b59a-35f0-4dea-a22b-5b604546f33d", "value": 42852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761525580, "uuid": "d63ee77f-44da-48f3-a247-b73787a2f43e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761525580, "uuid": "f61b2884-b55a-443b-9446-af7b36248ec1", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1298aaf-b336-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761570819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570819, "uuid": "6736c5f2-1161-4eb7-9cf3-f728f4f60f00", "comment": "Malware payload (Mirai)", "value": "9b00af55b1bc892a493191b3b8898f96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570819, "uuid": "10a2e4e1-fdf6-455b-aa4d-021c5d82b7a6", "comment": "Malware payload (Mirai)", "value": "f08900a0b88b2e4ee385855db2a52c4bb46bb03b62eeaab4f6d4725d26d89e76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570819, "uuid": "b07e0c41-e48d-4c88-9a24-bb942bd98ea1", "comment": "Malware payload (Mirai)", "value": "cb118ea3e0a5b8d42292b63afee205839f674549", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761570819, "uuid": "81827955-8b17-4967-af6f-231e7e85d188", "comment": "Malware payload (Mirai)", "value": "a8e11ac5a765d7e5435cf982080f779310cdd814af742d45d0eec5078fa771bc778accaf0cbf93a9def2c908b5d40783", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570819, "uuid": "8a273979-f89a-4e6d-85c0-d86f5d354894", "value": "T1D5C2D128659F38B1C3740D7BDE34C5CA1983939542F5A2F3064897F8D48E90A16F4AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570819, "uuid": "b8d4018d-53c8-4931-98e0-e5bd3ec1b64e", "value": "768:moPEeJMM4olieRV+X/8ampKKj8YCBu4y0as3UozhSU:hMM4olieH+Ua/Kjery0XzhSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761570819, "uuid": "1565747e-281d-40f4-9a47-11592042e91e", "value": 26712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761570819, "uuid": "835382b3-68be-41b1-b583-3450e286a3c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761570819, "uuid": "abaad3ed-22d0-4bb1-b531-971f323e8320", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151d949e-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761579121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579121, "uuid": "7e30955f-85b8-4c2d-b50c-9ed495380f0c", "comment": "Malware payload (Mirai)", "value": "125db872c87961105abf2e77d956b736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579121, "uuid": "d3449f28-aa6b-48d9-a420-67de37cb2984", "comment": "Malware payload (Mirai)", "value": "f10c69e4c8755ccd10fb173552c10ac69df8a99286dbbc48035bbca89eb55ce2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579121, "uuid": "637bb062-d70b-44c5-b2af-f1883fef357a", "comment": "Malware payload (Mirai)", "value": "57b557015852eb2c4d1f0f31353cbfa2e883b4bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579121, "uuid": "03474917-2a9a-43ab-8fd3-ac0c91da1aa4", "comment": "Malware payload (Mirai)", "value": "d4229ed0ab27af76a373a03d59552ecb6eeb946947a2682659e7f09cc542b2c755ee855ec44e063caa3214605560f03a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579121, "uuid": "83f833a5-9471-4c9b-8b3d-f0de5bf6043b", "value": "T17763F656B8918A11C9D513FAFE2E118D331353B8D2DFB212DE106F60778A96F0E7B852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579121, "uuid": "aa325242-b07c-4826-ab32-a1ffec5d4b81", "value": "1536:+hnyzZgiMAxxQAbHLKSV1YVeHAiczKz8+ZVCcNBD/Cr0aBAULQIuii0ZKZWi:1d7IADLKquehczKrVFNBD/qfG0ZKZWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579121, "uuid": "eb054da4-2698-4298-953d-ba55a621ece5", "value": 70928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579121, "uuid": "8db88b31-8486-4b3a-84a5-570fcca0b008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579121, "uuid": "74316c66-26b0-4fb3-b906-143b2769e508", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802f7798-b2ca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761524325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761524325, "uuid": "c8e3800b-0aec-43c2-8172-363bdc979717", "comment": "Malware payload (Mirai)", "value": "1d8ca455b4598c368ad68ee8b1333ba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761524325, "uuid": "95a05d26-ae9b-4f05-8eba-83b9c75bdf7f", "comment": "Malware payload (Mirai)", "value": "f18362fac7783cb76ed68183f1d68fa86bf1bc126f001fffc2f76c7cae0f97bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761524325, "uuid": "0c846031-1263-47f3-acce-1a2dcda34a20", "comment": "Malware payload (Mirai)", "value": "5c32ceb4e550cbe3bda20205cc48921a7b294863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761524325, "uuid": "d46f3803-8836-44d2-934c-8efdc7799832", "comment": "Malware payload (Mirai)", "value": "1b15ff33a3cad49c9165e3fa4777d74eae5404a168de5d6ab1ad5fefb49bb35022c7d13da6db6d2bf858047997ecbaf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761524325, "uuid": "89869707-8fa2-4386-b3b9-dba948b05570", "value": "T101834B45FC819A12C6C5177BFB6E028E372623A8E2DE3207DE19AF2237C651B0D7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761524325, "uuid": "9a467c34-912e-4a8e-b29d-e4a68617355d", "value": "1536:W6errjFsVj87mxO4cAXoWhTMkaZFq73XjP2a9DqvHh:W6eHj6j8/4bRQTZFwTSHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761524325, "uuid": "f5cd96de-74e7-49ac-b86e-52f32a93aef5", "value": 87528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761524325, "uuid": "92503c48-d91a-48cd-ac4e-a678bc6ceef8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761524325, "uuid": "1ac93fbc-1ea7-4ab2-8717-696f2f6c3195", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdb0866-b370-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761595589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595589, "uuid": "9b33f4a9-649a-45c6-992c-351109e96ca5", "comment": "Malware payload", "value": "ff8eff50eb5617340e3deedbcdf6e631", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595589, "uuid": "f75ea46d-db52-4f06-bf85-e5ae22dd7d9f", "comment": "Malware payload", "value": "f1dd94b6e80e0ab91c7124d9a5ed37bcd70a61ba28721d3247e816de669c3f16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595589, "uuid": "44355d54-d5da-4113-b3d6-c09b5ed92b80", "comment": "Malware payload", "value": "91ebda9ef152340d68b94c7b853f97c806cb3d58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761595589, "uuid": "7d243cff-7028-41fd-8d11-c1dc29b059e0", "comment": "Malware payload", "value": "2705bbd26925ef85aca19e6dff3d0f0e64bb0dbc05c0310dcbc183d766fc50ad7ef730f52578decd52be4e73f5f856bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595589, "uuid": "213768be-ed5c-4d29-a914-65e178d13ed1", "value": "T1C3F58C5AA7AC1194E9BAC07CC9574737D3B1B81A87B05BCF08A6C1780F27BD6263DB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595589, "uuid": "2e6f85f7-521e-4ec8-b48f-fabfadae72d2", "value": "40797fd6f80718b522f96288cfd9d830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595589, "uuid": "ee4c4363-962a-42f2-88be-f13e18ca863c", "value": "49152:HVwASOeGIU6iiLGtlq6DZEDOh5PUTKHvU4SCVllsFngZfuJhXTcES5cyP47w88Um:uB+BFtlsPIL5cr7w8l1CPwDv3uFhi47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761595589, "uuid": "7b13606b-88da-41df-ac9d-8a39f0a8a90e", "value": 3412856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761595589, "uuid": "a52afcc0-a6de-4d2b-8208-563c3c19860e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761595589, "uuid": "4338bb92-87b6-456f-91b7-29dae96d8ab0", "value": "libcrypto-1_1-x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61da425-b34f-11f0-91c6-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1761581565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581565, "uuid": "0f21c9e3-3143-4f49-86ac-063c9b2d9c5f", "comment": "Malware payload (NetSupport)", "value": "be085c8252f8dfbbd37482a2649a5648", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581565, "uuid": "4619e087-0c39-4f85-a84f-a21e7bd5b43f", "comment": "Malware payload (NetSupport)", "value": "f32309f7a5f241d17f20264ce06cd02c66373e05ff3a4a6d281bf343ffc794a8", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581565, "uuid": "d7522e93-8988-4640-8540-5cac44df2db6", "comment": "Malware payload (NetSupport)", "value": "b8febf24dbc32ab9522e00d249cd378dd672e718", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761581565, "uuid": "818a4a20-5688-42fa-8f54-97b602ad97c0", "comment": "Malware payload (NetSupport)", "value": "6ffde78487e2fcfc91e3b17c5b42a0adadba62ce04a58cee2cc567c468c8e8ac9f7016140b44ec6f4432321624cf7bae", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581565, "uuid": "2d40b400-3647-420d-bc4b-dcd4d4be1880", "value": "T1FCB533272F8703F3753B90A9E6607F224404922C67BEB576A61B38E3787B7759311E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581565, "uuid": "0ed5f214-33db-47cd-95e0-d70a43ccd3dd", "value": "49152:266J3WM202p5GutgAJuIxyxWBvZZi7SM5PWZ5FvcBs:T89i7JDmWg7DP+Us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761581565, "uuid": "c3217e9e-34d7-407d-8b20-fcc789cc644e", "value": 2432065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761581565, "uuid": "4ab9145d-aa28-428e-a207-bb8689e52920", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761581565, "uuid": "453fb986-b47b-4cfe-bd90-d00624f3344f", "value": "platour.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06568e19-b346-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761577378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577378, "uuid": "e63b1079-6ca3-49a2-958a-5a3d62d8d95b", "comment": "Malware payload (Rhadamanthys)", "value": "e3e426f6b9e54a8022484ad0a5200959", "object_relation": "md5", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577378, "uuid": "bc1fb525-4eee-4624-8f94-3185667e8182", "comment": "Malware payload (Rhadamanthys)", "value": "f3a655d56120630862bbc94f0c6af9450b5c4b30f5d262138e27ded682c50168", "object_relation": "sha256", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577378, "uuid": "6042be29-285b-4846-954d-9a99b5fce90f", "comment": "Malware payload (Rhadamanthys)", "value": "b9820039b03b412233a69e96ca39f63a5bf3e8cb", "object_relation": "sha1", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761577378, "uuid": "8b8f1bd7-395f-47b0-99a6-74fad92c0583", "comment": "Malware payload (Rhadamanthys)", "value": "863cef8523c198adf278540109eaf84de5f4c662ad816d822cd238bb5a29019073cebc9a4de3f8185a94bb0b3b373698", "object_relation": "sha3-384", "Tag": [ { "name": "45-156-87-63", "colour": "#E3CDA5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577378, "uuid": "8dadb78c-7d04-41a4-a3e1-74b57a87f910", "value": "T13837334BE5785867D1EFD0BFE168835F3E5C095C728E877FB0B2860189E12B91C2A587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577378, "uuid": "232972cc-0ad9-487b-bae0-89fb796e8a9f", "value": "393216:sxKGksbBa2Cc9x9QjA81bLA4F8HQXbsNvJ9ZHx3w7FmlxEuXVhbzKtX:sDzY2CMx9QZ1bU4F8HQrMTlw7FUxEMha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761577378, "uuid": "1d84bf99-7555-4548-a618-9600cd2fb4d8", "value": 24227098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761577378, "uuid": "c4fb9c27-0eb2-4c80-8e3a-c85600d6bad2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761577378, "uuid": "164a97d3-0660-414c-b04c-3263d279b6ec", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6896f72a-b369-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761592575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592575, "uuid": "79170d5b-35a3-4ed0-9fbd-92d88a28a39c", "comment": "Malware payload", "value": "b970f8ea65c2ce8b4dbedc766e94024f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592575, "uuid": "33f2b48d-9534-4213-85cb-be5db043bbd5", "comment": "Malware payload", "value": "f5062c65d9fc8b3acb66da956d62c0119bd9f78b9029b2a52bc2d84be41bc86f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592575, "uuid": "73aab14b-b8ef-4a09-b72c-cd9d1c318259", "comment": "Malware payload", "value": "10240830ab2c07746b8af9bcf3592b76f021e8fd", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761592575, "uuid": "0edac8ca-1fb9-4b70-b79e-e15fa7c62caa", "comment": "Malware payload", "value": "d8f50697cb8313f6460a5e7cadfcf630bf40987ca39aecc0c74c85bf4ccecd4e2275ae890e0ecfe0b294b21be96b628d", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592575, "uuid": "a90b7e1e-38ff-4f3a-9af8-a262362e875d", "value": "T15DC52FA09533C661EFAF60AC503A53D583814E72C5F8ACF8F3B5760DD3297D6582AAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592575, "uuid": "ae3af21b-a968-40af-8da0-165338ebe36b", "value": "24576:HziHgBkQ3g1NVwc5s+RG+5ovs63zg/oS9qi5wG4lN7agiNI+m9QYZKU9:HzAgBkB/Vwci+I5vs2tSMiaXQ6bE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761592575, "uuid": "b94b9d91-51ed-4a4d-a6c7-a86169d4657c", "value": 2744760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761592575, "uuid": "2136e677-6162-4c8b-8a77-bb745b10c7b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761592575, "uuid": "6836a5fb-0ec9-4146-bb86-bee45b4ce2de", "value": "oStarteZ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f70a3d-b30a-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761551706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761551706, "uuid": "27038d57-c79e-44d0-8515-7e30c1d3ad11", "comment": "Malware payload (QuasarRAT)", "value": "53325c85f989794efad017732bb2fca4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761551706, "uuid": "9da6d797-68ce-44f3-b1e8-7d6781e98d14", "comment": "Malware payload (QuasarRAT)", "value": "f5e49e7ec748a0b4cfdecdddc5fdfaf9f5b7f38f73e962a4017b402ba8143d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761551706, "uuid": "2b795b47-2d1d-4702-90d3-60199de0bcbe", "comment": "Malware payload (QuasarRAT)", "value": "574419dc82f400a51b1b00c5518eff09fb102790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761551706, "uuid": "79bc13ef-2710-4acf-8d3e-477ecf5f04b3", "comment": "Malware payload (QuasarRAT)", "value": "df8221046588b363e2376d31d79ffdd4d450cb7b8d66e8e8186b17e9717a74fde22693a016619f5b5aac061992cd2f73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761551706, "uuid": "903bc176-f5d0-4999-84d4-a6288fd95f96", "value": "T1FAE54A0437F85E23E1ABE37395B0041367F0FC1AB363EB0B6591677A5C53B509982AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761551706, "uuid": "5ef3d378-d32c-4906-9627-334898abc65d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761551706, "uuid": "6f0b77b3-4743-401a-9848-373c2bdd2620", "value": "49152:rvkt62XlaSFNWPjljiFa2RoUYIGbqobbR7LoGdrZTHHB72eh2NT:rv462XlaSFNWPjljiFXRoUYIGWoZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761551706, "uuid": "a6a07c17-3210-4ca5-861e-6018d5a20233", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761551706, "uuid": "bd16982d-45df-49eb-82d2-1359ec3d486b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761551706, "uuid": "6a3cfc6a-1997-47d8-a86d-be008fd2d719", "value": "f5e49e7ec748a0b4cfdecdddc5fdfaf9f5b7f38f73e96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612ee425-b344-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761576671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576671, "uuid": "10fe1f3a-ed78-45d3-a3ff-9688b3d3b463", "comment": "Malware payload", "value": "c5dbeb0f4df4ce0b86c5c8b4cf23509c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576671, "uuid": "74fbf114-2394-46bf-83a3-4821306029c6", "comment": "Malware payload", "value": "f5f977688fe5ab1c569958d0ccb27d8c35ffde7d03b6b175bf47990eae18c747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576671, "uuid": "c7719849-feeb-4f17-8ce3-0c9d68c97cd9", "comment": "Malware payload", "value": "a3ab5ba81ade86ea752fcdf62c779d75eb526c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761576671, "uuid": "06489e42-8811-4d01-b69f-2401eb28b81d", "comment": "Malware payload", "value": "31dce7f13198a17dc86c7dd6b437545297f5e71b8f2bcd94faabe26a2035e85d2c11dce8b9cbd47c38aeea1b033293aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576671, "uuid": "7098fe6d-dd6e-45a6-9dc6-d59543c579cf", "value": "T1744633D6DB0EB0DBC61ECEB1375ED7741392BB02A552A8883C08332AD6F595975F7280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576671, "uuid": "ac3ec5a0-e7e0-4772-b6cf-2f2f001d0878", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576671, "uuid": "90133c41-abff-468c-a2dd-810f05e8afaf", "value": "98304:OQARwBxyRVKyzoV91tfpGDH5zP5a0M2SeKdAuI2QUbYD7ytSCda5byw:4RwPmzamz7zdKdAwanyEF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761576671, "uuid": "068600b8-bb3e-47af-a26c-50f58b75ad72", "value": 5509120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761576671, "uuid": "53214760-c6c8-4b5d-900a-594e89f81b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761576671, "uuid": "49a9a6fa-98b9-4a4b-8c9c-f97cf44894f8", "value": "Installer_v461_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed14065d-b382-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761603535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603535, "uuid": "9cde9f74-da07-418e-9a48-6f0e35542aba", "comment": "Malware payload", "value": "a0a969664247a72bc029dab237b7b9c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603535, "uuid": "20c40a94-8a6e-43a0-9bed-7bd3faa2bb4e", "comment": "Malware payload", "value": "f6002d4b799bea2f4d563194b8bb6fabc7332c2f2b638c5d358aeb8a8bba0803", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603535, "uuid": "40a5516e-b026-45bf-86c8-4b9ba25005eb", "comment": "Malware payload", "value": "8a478203bcf05e5af54f66cd56ab1598fc46cba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761603535, "uuid": "48d71563-cb03-4954-b068-845a9c7521bc", "comment": "Malware payload", "value": "25178ecac345c4dbff6408330f771feaada49a405b5982883935ec51ad39ce956d0319c53db599d2769ea130f5a6e9b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603535, "uuid": "de6c949a-cdfc-4c21-80c8-c1b6b82c722c", "value": "T1AF753303466B1F31BAF21F6167A2E4D12683D14AB501F8B4AE93A317431BF4DF972E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603535, "uuid": "65e74054-70e9-4465-863a-c399f35f6ea4", "value": "24576:Z2k+ZWLfIRGeBzA7jPeLrXtQ6alzpGUmyVgmnWVox5pTm9XPuWKqnT5AD15nKcU:Z1fGBk7AMGsV6spTmFKqnTARKcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761603535, "uuid": "373eab0d-31cf-4291-beef-6a4b6e30f509", "value": 1559028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761603535, "uuid": "5155a50a-2803-4680-aff3-2a244fa14eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761603535, "uuid": "ff2190a2-fc7d-4e25-b377-3297b5db2c44", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bdbd11-b37a-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761599877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761599877, "uuid": "14a00345-ed86-46b8-a40e-a3c057ba55c6", "comment": "Malware payload (SalatStealer)", "value": "152dbc863cac4711d12e6dfb3554f1a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761599877, "uuid": "322096dc-d49d-47db-bfe5-a5d317eba8f1", "comment": "Malware payload (SalatStealer)", "value": "f65e66a56aeda9a952782a0b04da1232fb65d7fa45baeb4c6b13f4020412945e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761599877, "uuid": "8a7bd4a0-ba40-45c4-985d-b30d353ca13d", "comment": "Malware payload (SalatStealer)", "value": "62da63ced4a8a425f707deee083b83ac3745bf7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761599877, "uuid": "634c53e4-10d6-4521-bf95-f246b68ff689", "comment": "Malware payload (SalatStealer)", "value": "4fd85af74a6922fddf4884ef823576425c7980f1f3541271561686800f4601197813cc494eb71cb6a9f9fc2f5525f377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761599877, "uuid": "b29e787d-0500-4fd3-b874-7af70265a3b6", "value": "T171F533D01E3D856AE7B6347875476733E3D683A07EA83AE0DE9CC0D593107B49EAC942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761599877, "uuid": "24f1b29c-4b05-402b-bebe-5fdf76586c2f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761599877, "uuid": "ed5c4c94-93ad-416e-a138-4a504cfe7837", "value": "49152:kKXIHl3HSrkRDTK9i3lmeOIUYYE/p0M0J7FUSrtA/UDj3I9nGPi+pbd:kKXIFLK9K9OIUYV6JnuKjIFGPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761599877, "uuid": "3f29af57-0c21-431d-ba30-95c850d47111", "value": 3559936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761599877, "uuid": "4e3a8ba0-fae4-4f4b-ab73-8960ccaa11a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761599877, "uuid": "80b3581c-13ed-4d9e-9df0-3d1de4691899", "value": "Doxtool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f84245b-b372-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761596479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596479, "uuid": "7f8e5411-9a3c-40de-95b6-28e3ed1282a1", "comment": "Malware payload (XWorm)", "value": "54206d3683da08ca3cffad3c7cfd715d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596479, "uuid": "2921b8b2-f1f5-48c1-84e6-21ce47de9419", "comment": "Malware payload (XWorm)", "value": "f786d4b6ec5707431243b941a44f800fedba112076910f3a3e23aa4e89d8b8dd", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596479, "uuid": "dd4d45e3-20ef-43ec-8b8c-c0f2c8183356", "comment": "Malware payload (XWorm)", "value": "6b56a271317ae11b148187e845d0396847a19dd8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761596479, "uuid": "88dc24a5-a68f-4162-92f3-ba94ad1b9377", "comment": "Malware payload (XWorm)", "value": "a8d6b929f5286c1bb141b10e6f2e09f13f690e6a1e3f11466a728676dc7b5c7b0f454e7a51c7743a9ce18fa733281636", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596479, "uuid": "40343f94-cb8c-46a8-ab65-236aad948d49", "value": "T12AB423BCAB62A078A0FE0B5ECFD5509B6640E4D16756CF7BF1E18F22258F112154F8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596479, "uuid": "169f638f-4679-455d-9f30-d18def4dc74f", "value": "12288:Or/cKXi6UDA98qhd3z98Fn3hj2XyDovx9NJWVHdAGKGgAw:ODrijG8qrD23hbD2VWVHd27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761596479, "uuid": "0e9fa645-4f2f-407b-95bb-c01f4364c8e2", "value": 497410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761596479, "uuid": "b2b4a532-4419-4e86-9ffc-b264812550a6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761596479, "uuid": "62bda9f1-d59d-4d70-bba2-998c7bdb77a3", "value": "Purchase Order.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eea4c7e-b331-11f0-91c6-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1761568427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568427, "uuid": "09194d10-6383-48df-b1fd-991969683fa9", "comment": "Malware payload (Arechclient2)", "value": "0396059118adace9827abc0151b4ca5b", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568427, "uuid": "7da549dc-6efb-456e-9338-ce2cd280f8ef", "comment": "Malware payload (Arechclient2)", "value": "f7ebde9ea3592f02418b28073482574c426a40d9b84107b6a216aa5f23fb2a01", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568427, "uuid": "2e312f93-b6ba-4727-8321-4c8b1393196b", "comment": "Malware payload (Arechclient2)", "value": "953b3d03ad9eff7f5473a1efca9e56f57b70b50c", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761568427, "uuid": "086cdfb5-7b43-477e-925c-2f95874dce0e", "comment": "Malware payload (Arechclient2)", "value": "c3469e967ff258cbe7e889fa0233d04c8b4fae2b7ff55434019a87edb081e0c9157557bfa9a6ac73f9235e80d3b5183b", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568427, "uuid": "c0361445-98a4-4391-9723-ce713585000d", "value": "T1346612227185C2B6E16F0370191E972AC2797961377385DB63E80A2F1F336D19B37B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568427, "uuid": "a7d21c82-7f83-498d-a74c-fb919fafe986", "value": "196608:+GLEeH9sL+plPf0NjgDS0F/eo+badmZI6:+eFGLwQjmjuadmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761568427, "uuid": "a0a7a8e4-e32b-4122-943c-aa0ce9f1f1cd", "value": 7042048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761568427, "uuid": "f7263f1f-968b-4cb9-9bb3-d9babadbc453", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761568427, "uuid": "6550e006-e64c-43c6-9d3f-7b90447b7bc1", "value": "ApiSetHost.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5288183-b34a-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1761579497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579497, "uuid": "c3751a1c-de20-4c93-bef3-a6cf0a53ba56", "comment": "Malware payload (DarkTortilla)", "value": "615cb3c8c5408eec21df8aa32e465e5e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579497, "uuid": "886f30e6-6851-4402-bf30-2753ea7d4d1a", "comment": "Malware payload (DarkTortilla)", "value": "f93cef3fe96d0e7bb0c66e7eb851b20e1cf256f1bb50d7eccbb02a29232eca67", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579497, "uuid": "dd6b280a-81b5-45a0-8744-beb4e52f38e6", "comment": "Malware payload (DarkTortilla)", "value": "d7a2989d309f97a88121b72cc73796a030db90d0", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579497, "uuid": "f69e56d1-e3d9-4c64-9381-00ee143f5aa1", "comment": "Malware payload (DarkTortilla)", "value": "e01456a5b421391b62bb8aa56533fc04eebb797a0ee02644b3bd5dad1dbf868f4e32726a6b11bdc0e41e33e4cc85d2d7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579497, "uuid": "6ac1308f-c68a-4cf6-af18-b5ea562266d0", "value": "T143C4AD287BD69648D83EEB38CA72461807F2E547CA23D32BFE4230DD866E7464551F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579497, "uuid": "1810b1a0-c6d1-44a0-94a8-cd9b2863d5ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579497, "uuid": "75464e63-d978-4f96-b148-f66297bf142c", "value": "12288:IhY7hCjck+pf5F3VIARRYC/VrKaMUTL/J12Xk:IhuhCgk+pfb2M/FKaMUX/JcXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579497, "uuid": "06bcc493-aba6-4ed8-be93-56d89da2ffdd", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579497, "uuid": "463b204e-dc46-49fd-8516-b3d8a18dc12c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579497, "uuid": "4e47cf53-6315-4162-9a9e-892f7a0f9ef6", "value": "Presupuesto 1-89375251581 EUR SL.pdf(82KB)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da16c04-b316-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1761556962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556962, "uuid": "b53b8954-5842-4084-8151-e1d91a89061c", "comment": "Malware payload (a310Logger)", "value": "4b63cdf002aa002b17c4bb9a15dc3aa2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556962, "uuid": "f37b3396-06d7-4705-b7ce-480b6438e363", "comment": "Malware payload (a310Logger)", "value": "f9b5fed8925d4ce4c7cbb7e0d93f88f46ed2e7f7a755c7db0c01575ea3bc1544", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556962, "uuid": "a18602de-1420-4c49-9094-cdd2bc5975d8", "comment": "Malware payload (a310Logger)", "value": "805e453583f8f19197084581b1ea077e8013a936", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761556962, "uuid": "f2d66120-c6bd-48c9-8e66-73aeac25302b", "comment": "Malware payload (a310Logger)", "value": "4304c7cfb26b4094122dfd8c09bce3fa7c1791d432a1be15b2e89af1ef5f1800d1a8f619318c0ac8ac58e63ae5db21f0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556962, "uuid": "0ef3de01-de68-4031-99de-e701000cb022", "value": "T120E412583318D803C59206F55DB1F3B60BB86DA98511E7E6AFC87EEBB8E5F049C04693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556962, "uuid": "02ac9a77-a03e-45d3-95f4-224258be67ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556962, "uuid": "30043dd4-a2d2-45c5-91b3-ebe7f6d909b7", "value": "12288:GcVbQRLiGtYC5YJipSbQfeLHfTliJYo1OlMBzwRkJ4zbvCb:GchQRLpNObGyJxqOyBzYkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761556962, "uuid": "ba3e5c87-85c4-4624-9cc1-77da0df75cb9", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761556962, "uuid": "a8754db4-882a-4c76-b1b6-30736595f965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761556962, "uuid": "2eb66a2f-a7fc-4cbc-b6b5-5fb4a4f72898", "value": "DWG-00141842 TEKNOTES F\u0130YAT TALEB\u0130-001 27102025 8325.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e0a900-b35a-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1761586205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586205, "uuid": "bcca342f-0cc4-4108-b06a-d20ab546bdbb", "comment": "Malware payload (AgentTesla)", "value": "0af2c05f7e710c0f87b06bae1d9d36ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586205, "uuid": "c639897f-0926-4bbc-afb6-50ddb29fee65", "comment": "Malware payload (AgentTesla)", "value": "fa4cfaf75907e2a248a6a5783c505ba4f02393f7b0e3433d54bef19673d899fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586205, "uuid": "0684f870-0853-4b7c-85f4-a56cd10fc2c5", "comment": "Malware payload (AgentTesla)", "value": "f9924088e8332a4669e550effbf058f7d67181f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761586205, "uuid": "e5ce2667-b043-40d6-95a2-d809701cd289", "comment": "Malware payload (AgentTesla)", "value": "9859ae7f82e4a635b8121d84f2aeacdf31f0ec709034e268826e70042a41e2b4e3fec37b5e5f86f6faa4304b641f643c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586205, "uuid": "05b42914-2988-476a-8729-7123086ef01a", "value": "T17E7221CC7FD6F6B11377A0A32D1B708EB76A7854F95C8984F334A2B0B960358D492878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586205, "uuid": "2c88b09d-5d07-4b08-9f9c-f48a285f9068", "value": "384:0SL/3l0XSE+vdiXUcYgTh6XhOo3mnAlFl8Z:56XP+vsLY26ROoWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761586205, "uuid": "347887ab-c6a4-4e41-8a34-1acc97c28763", "value": 16864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761586205, "uuid": "ceeb036f-7992-483f-8ba3-85aedaff04da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761586205, "uuid": "eea99958-9a5b-4ab9-8d19-1bd4498a9bcc", "value": "r0091-Resumen_N__mina_Octubre_2025.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10aaeb1-b349-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761579006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579006, "uuid": "3556f265-1e17-427e-8c99-5981aa566091", "comment": "Malware payload", "value": "ecfd0688e85b69dbc56102a79dcd1dbd", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579006, "uuid": "94127de1-c222-459e-904d-9547af19c483", "comment": "Malware payload", "value": "fa7a89528e3648f886bce6241dd5a4d82e074f7b41dae7a2997a16ef3129c27b", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579006, "uuid": "32d9332c-669f-4644-9418-790116e94e94", "comment": "Malware payload", "value": "99ad067be3996f2f8c006ebd6afc551868e2948a", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579006, "uuid": "e09122a3-57ae-4a39-aaad-0ef7612d9d7d", "comment": "Malware payload", "value": "7bef450019fb2ddfbbac8703b5ef0d46373abeea202b0acf7b5e194930d6759e6f0613909d4e9d07952fb4e18ba92d63", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579006, "uuid": "5e52be28-7cd3-4820-88c5-39653acca030", "value": "T1F743025E108A412D563C9784EBEA3B77784343D8BE2ED07F8FD30FD38A61D2A0166505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579006, "uuid": "49f07a8f-84f1-44fe-8fbc-e83d3f29a7f8", "value": "1536:n4gqlZHdwa5jCjMoxBwXx+K5xmzRNuNWe1RfBg/:4T9nj+MawXIKTkNRui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579006, "uuid": "854ea235-5e50-473e-90e4-871c944f135a", "value": 56228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579006, "uuid": "be196eff-6881-4791-967e-33426ec39d43", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579006, "uuid": "96909f60-94a6-4cdf-86f5-8ed78bb46d39", "value": "nAWB_2790383994.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd29ebb5-b349-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1761579000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579000, "uuid": "f5bb5a29-fdf0-462b-b7c8-81ab84000787", "comment": "Malware payload (ACRStealer)", "value": "84adb1de4f580a0358210db3b4929358", "object_relation": "md5", "Tag": [ { "name": "157-180-28-19", "colour": "#CA28AD", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579000, "uuid": "66f00349-a4bc-42ec-83fd-0f966d3f80ed", "comment": "Malware payload (ACRStealer)", "value": "fb09258da201422b1807dea855954a4fcf7720cb91b82a477e380f8519003ecd", "object_relation": "sha256", "Tag": [ { "name": "157-180-28-19", "colour": "#CA28AD", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579000, "uuid": "69d2f152-5b8c-4f7c-8095-0c6c8804e230", "comment": "Malware payload (ACRStealer)", "value": "4e12c9a648f974a92afe3d5ab43c27c99911765b", "object_relation": "sha1", "Tag": [ { "name": "157-180-28-19", "colour": "#CA28AD", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761579000, "uuid": "57eb9d02-5726-411f-b579-61ab5e209796", "comment": "Malware payload (ACRStealer)", "value": "8e2246099318d80585d9d66dfd4545aafe9df57438eb59b6dd3508a5982712722660f515deeb0587b819d701036e839e", "object_relation": "sha3-384", "Tag": [ { "name": "157-180-28-19", "colour": "#CA28AD", "exportable": true, "hide_tag": false }, { "name": "74a65b", "colour": "#8F4F75", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579000, "uuid": "59cacf6e-0227-4d1a-b7c9-3d149a1f37b2", "value": "T190F633FC24E76E9AD2CC4CBA929777D542582E7258F0FB7C4E8C114D9EFAA910403D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579000, "uuid": "fd2d10f9-364a-4b3e-a299-50595092988c", "value": "393216:y8WPTvW9CU1Cr33jENNw80837yqrSRxnu2WnjPny:OTvW4U03XG2qrqn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761579000, "uuid": "8bd2c16f-61c5-4b8e-9516-8cb5b4cf23ab", "value": 16183754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761579000, "uuid": "2768f5c8-4389-4418-84f8-bbb863521a7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761579000, "uuid": "fe5ffc65-6f54-4388-85aa-34cab7bd2795", "value": "lnstaIIr vr fuII 25.8.3.49.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e216de76-b355-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761584189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584189, "uuid": "6809bb75-c294-4c61-be31-d123371f658b", "comment": "Malware payload", "value": "5ad1a1b2a82996a417dcb459151a5dc8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584189, "uuid": "89850f8b-56de-4faf-9249-a6937d1d9b3b", "comment": "Malware payload", "value": "fc812e19cae18ac39a3e064048cc874d7882eb9a2cbfa4017be093a7f4466075", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584189, "uuid": "74196bf8-3e26-44df-aeaa-d346ee40f028", "comment": "Malware payload", "value": "652b45671ae3bd3fa8f59dc1211ee13e492a6cc8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761584189, "uuid": "7035157e-6376-4b01-a23b-00b53968cc8e", "comment": "Malware payload", "value": "3ef54a7cd3417d8611e3d1e9b6d2080891653793266625df777632fa5b533a2d1857707f3b2befa3671170e3e66f689e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584189, "uuid": "232bcf52-68b4-4fd9-aa75-4a9e9dc29b9d", "value": "T1AF179E1593E501A1E46BD734CAA6C333DAB1BCA25A35C20F0559F6061FB7E52CB2F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584189, "uuid": "b8575bea-a50c-4f86-93e5-dc3f211ae36d", "value": "610c87b9b143d2ad49bd8c72050e2ec8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584189, "uuid": "519ecaeb-7bf7-4457-a81b-771b2e7510ff", "value": "393216:YokBBuS0rJOCCGfmKMqVIiXOxioRFiqv+ag69y4O7:YI54jT+ag6MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761584189, "uuid": "c23442b5-369c-4c97-80ee-10a839f525b8", "value": 19428352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761584189, "uuid": "f48131eb-43ba-4867-b854-d72d2c2ad257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761584189, "uuid": "9f58505c-b4a2-432e-ad0b-497bbf99da65", "value": "MSVCP140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625c135e-b2f5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761542743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761542743, "uuid": "4a4e29ee-e69b-482e-9018-90cf66ae37b3", "comment": "Malware payload (Mirai)", "value": "e4fedfb9dc3836c36f40e6a547565d24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761542743, "uuid": "c807e7a8-45c9-4690-8dcf-87b3d9d4feb8", "comment": "Malware payload (Mirai)", "value": "fda491aa2d171ada3bbb02f79661202466636d0bd45bff8cabd7a68be40fa81a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761542743, "uuid": "6903842f-18ba-4c34-ad3a-029d7e611cd0", "comment": "Malware payload (Mirai)", "value": "1c7b1444bc42e8113ecf95da493fac0b4df4f51e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761542743, "uuid": "7d3c67c2-217d-4e9e-bb4f-e97a286715fa", "comment": "Malware payload (Mirai)", "value": "42042d8893545b429b1522b28c6640a348cbdbf9b683d75837dd9461289d97d17262e82db475860a9ec5d25e709fbf6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761542743, "uuid": "d52d40a8-f2e8-4a3b-a5c6-55ef2bf8a022", "value": "T196936C85FB83E1F4D94609B011ABF7798A31DD322014DD6BEB98FE72BC31612911A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761542743, "uuid": "a229665a-840b-47ba-86f1-b8bd14ffc051", "value": "1536:hqj89KwF8ROXbDccj0S/zHj822Rqoi9pUQ31QUHLKVyMyF+r:64F8ROLIcj0S/zHYBIuiE5yM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761542743, "uuid": "717e4af3-541c-408d-928c-f13bad40909e", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761542743, "uuid": "46eaa555-a2cf-4fd9-8cb3-a616e93b5e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761542743, "uuid": "5cab25d4-d918-4115-8e00-f92c574a0a97", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e5e0a5-b2db-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761531668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761531668, "uuid": "89235ff2-61d2-42a0-a9e4-94a16c96f922", "comment": "Malware payload", "value": "4fa09a60c9b0df80af1a9bac26c75f6b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761531668, "uuid": "86c43454-2088-43e7-9aae-eb43be88e155", "comment": "Malware payload", "value": "fe6cb7417e7a818e9af13ed38042b749128ae615be70865ac16b47d49cb8ce22", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761531668, "uuid": "bfef1c9a-b8eb-4d1a-85b4-75ffa0c0430d", "comment": "Malware payload", "value": "3703ec17642f06cdf2628a9c4f8a462326f6a81b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761531668, "uuid": "83eeb40c-e515-4f7e-9351-ee08a57e43eb", "comment": "Malware payload", "value": "0398ee1b37395b0d483a4296a32803e2c5c79244df27a12c677cdec3c352d642024059a84312daa2ab86744528097db5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761531668, "uuid": "b65cad03-377a-4afd-82bc-18e8776e108f", "value": "T12DB612716E80F84713ADDE33BE092DA56D3A9963A2C07197C2C476DC24F8506CB65EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761531668, "uuid": "fc8a5395-3022-4f3b-a238-bbd0585495f7", "value": "196608:1FqkpsDTFwQ2khC8q35xFPBJNRvextxfmHOCf61ZHLyYB6hrDxRmqsXRW4+Jw950:1Fd+TWrjFPbNdetfoOJLLUrDxsxW4+JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761531668, "uuid": "67656015-26b2-4a66-90d9-22b23a287bec", "value": 10733600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761531668, "uuid": "6aba75ef-a581-4638-b9c2-267d18dbd2b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761531668, "uuid": "99e78d3f-ca38-4fc9-86e9-de7dd6b85de9", "value": "ChromeSetup.htas", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }