{ "Event": { "published": true, "date": "2026-06-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-09", "timestamp": 1781049782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "96d03b96-a54d-4612-895a-e2073f4c19d0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da94a381-63c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780984114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984114, "uuid": "7041a186-ead9-4f63-8b04-a33bb3b88f97", "comment": "Malware payload (Vidar)", "value": "0df8ca54c999b310249d87deb1ba9304", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984114, "uuid": "6995a127-94a8-4232-b722-02b3455b32b5", "comment": "Malware payload (Vidar)", "value": "00952930b878cbe158d089329cb03221304ab40a754ee07cdf17fdee9322bdf4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984114, "uuid": "1e42323a-8270-4aae-8f3e-1cf48b0d449a", "comment": "Malware payload (Vidar)", "value": "9a5e71e2a9282174b7af321362ab353ad17c4720", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984114, "uuid": "4fad543b-0b3b-40b6-b5e5-7b64ff41fdbf", "comment": "Malware payload (Vidar)", "value": "b1d1099d508edf4fb2e2471837cf6985b8865f7c8eec6d52e73a76c3b24adc27ed7078c509076ff4c2a9fd4173f6b088", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984114, "uuid": "7607c5f7-083b-4d62-885a-9d27b3981775", "value": "T1B5B58D4BACD148B6C49AA3368CB71292B735F8480B3623D32E5266783FF77D09979354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984114, "uuid": "15dbcdc4-2641-4cd6-a6fb-d8057149805e", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984114, "uuid": "fbbbdeed-c343-4b47-a331-3619412db899", "value": "49152:btSN89melTBklipT4UGbbKTjgQGDErcs7:bwgLcwT4VosDs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780984114, "uuid": "2ace8519-5299-4251-95e7-aff1c6f8d5ef", "value": 2414904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780984114, "uuid": "af461833-c5e2-4fd7-84fc-b4f1af7654c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984114, "uuid": "d396d6b5-28fc-44dc-9390-f9761a7c6168", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66e66f6-643e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781035674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035674, "uuid": "545e0ff2-9909-481e-8714-5f54de699b7d", "comment": "Malware payload", "value": "f4fae5ba2c4bf7c273595e36105b9a61", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035674, "uuid": "066aab59-4fb3-420f-af15-8d1276b90e7c", "comment": "Malware payload", "value": "00a6a47de3b08f4b290ce1126b0e22ecdcd13c4c9a7712fca88f4771ab210529", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035674, "uuid": "20ae2339-0417-4ea4-b497-47c5452ce74a", "comment": "Malware payload", "value": "d613bb949e85896d6204cece6d716e1be57ab124", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035674, "uuid": "733cba77-02ed-477b-b230-91f2ffa47e46", "comment": "Malware payload", "value": "29df1d9de8bfe25acdc14d5f1147aaa8dc699d6a6a826777a7a9dfeab01e36bc224ab00487cff37682229aa0f7a777f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035674, "uuid": "8c0c143f-804e-455e-b469-8434e407bbe6", "value": "T183137D6966857C24AE9988371C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035674, "uuid": "0fee25fa-cb76-4756-af17-82ce8f94ae31", "value": "768:Rs+uk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:S+uJco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035674, "uuid": "e03abb5e-95b2-42cb-a3c9-52ad0aa2ae4b", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035674, "uuid": "a52f0cf1-f6b0-474f-ba45-c9d7bf2488e9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035674, "uuid": "662bc27b-9229-4eb1-b06c-7fe6e02cc110", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1baaa9e-643d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781035129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035129, "uuid": "5d34f9d5-16dc-4c98-8226-b9ff93898fb2", "comment": "Malware payload", "value": "29b79cd1466e3929f8b61706b89820ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035129, "uuid": "ee484eb8-4226-4f36-b1af-7a2d3de602f7", "comment": "Malware payload", "value": "024dc15d27f3e9b825ac0de551d9dd4396f2a1505124097c67854ca55bde8953", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035129, "uuid": "2c6832e8-420e-4bc2-899a-829403b7ebde", "comment": "Malware payload", "value": "492745dc315741402640d2cb519a3c1c92988e56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035129, "uuid": "eef13448-2265-426c-b84c-c43840d6b222", "comment": "Malware payload", "value": "f1508c7640c3471c7000ec4859b95f56e09f843aa6309827bc2deffc652a50a804dd20ebde5a214e66c55c86e54ba7af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035129, "uuid": "7300289c-2b24-4321-aca4-43fc6e4a82c6", "value": "T14013518CF869673FC3E273FEEB9952CE323A17D8678B7626C635425537C8314A825910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035129, "uuid": "9496c72e-4e18-43d7-bd6e-e2d1f498f717", "value": "768:7sJZSH6wZ3wGwz6umOHbTD8URzEB67jkc0qHHHHQ/q:74SHbr4F5XDxpEU8Zqnw/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035129, "uuid": "4399b805-d283-46b6-9caf-e7bd22c025fc", "value": 43055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035129, "uuid": "8c4faebc-b7b3-4522-8402-92ca71f84156", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035129, "uuid": "67727f83-33e2-484e-8ef1-7cbf07d7fb5a", "value": "godisdead.7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ec8fdc-63a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780967965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967965, "uuid": "e8d39ccf-f097-4f84-8b43-69dafc952535", "comment": "Malware payload (Mirai)", "value": "76530e8ba50a494531fe67f64cca89da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967965, "uuid": "408da27c-40c4-42b2-811a-c490b521b512", "comment": "Malware payload (Mirai)", "value": "02de67f4ee3b409608cea354eaabbee9f8978154fbabb4d5207714ad36194ad2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967965, "uuid": "9f14101a-a87c-4db5-85ee-f20cfa25a435", "comment": "Malware payload (Mirai)", "value": "5caebd876ea7e025eaf1f3ca86659e289e6eb4f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967965, "uuid": "711c7045-fdc4-409c-b803-01c8743a182d", "comment": "Malware payload (Mirai)", "value": "d35864783800b271d1c7114a33d6118af4f234c7366b71d3581fc51a399425b68c1cb8ebe12586de6c52d393df2a33b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780967965, "uuid": "be32cdea-795e-4ed8-bafb-1b6f758f2caf", "value": "T131535BC2D543D6F6EC1122B02437A7226E7AE53A5639F917E3EA3A376C03B50860735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780967965, "uuid": "e325d0ca-87ef-4b69-a8fa-758d0630cbd8", "value": "1536:MWP4zC4G4EQOqMdlxtn8Dxe98aptEI711vgwPTFgpwggKsAtxBf:MWPu1EQOqMnxtnm498utEIUwPTFYwgGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780967965, "uuid": "6dcd6b4e-2201-4b35-8d67-867262dcbbbc", "value": 62416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780967965, "uuid": "9f95e672-d0f9-40f6-8c33-11ce0482d96e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780967965, "uuid": "ac20b701-85d9-4ccd-ac86-2933916a28b1", "value": "azsxd.i5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370e31dd-63da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780992430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992430, "uuid": "ea7604d4-49cc-45f5-8ac5-a906d368c9cb", "comment": "Malware payload", "value": "7e951e909e004aab5ea84d8f7cf3bc00", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992430, "uuid": "c0da5977-62fb-4ee4-8fae-1200e3046880", "comment": "Malware payload", "value": "0312dee1ea64d2719d0e4ff46c0d8ef39e2e309f404d74ce14c5cacb437e5655", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992430, "uuid": "9335c76b-15e1-4363-b89a-b357ef7614ca", "comment": "Malware payload", "value": "de173c2fcb6e9a330e2ffaa7e03fbf69e14489d7", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992430, "uuid": "f4faa694-0ea2-42a6-b25c-2beb348f5e8a", "comment": "Malware payload", "value": "4f76fe55afd03dcfffd92aea0d1bc8a3b759067dd849197d8de4771129bf71df360b2b824b6c32e67ee3db4a311feea2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992430, "uuid": "998a2400-37cb-4adb-af04-6ef8f1833f8a", "value": "T1AF0633AD741D892A5F3B4B5311F2821346B90D88F669D3FF55CBC8386106DE8C2CAED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992430, "uuid": "2f9c589c-e6ce-43fc-ac16-3d59817b4a5a", "value": "98304:cFvcsEm8xd5H5Qvb32AJhbs5i1aLT4MYb78VyqN:0KK1XQ5i1RVYVyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992430, "uuid": "a30230d0-5ced-4d6c-8795-ae212e342056", "value": 3721006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992430, "uuid": "ee19792d-b17c-41a7-9d91-90e114c4dcbd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992430, "uuid": "192f6fa9-c3a1-4eb7-a82d-c864e132ef44", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819ab030-6430-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781029492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029492, "uuid": "7b988656-9567-4127-9b1e-074a6047ca7f", "comment": "Malware payload", "value": "e8416ecaf0c400c48d2b1e39c035ffa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029492, "uuid": "dda9b4ba-1282-46c9-9b52-7d955a4434f9", "comment": "Malware payload", "value": "03af9bc830291a80063b30f4c027136ab55d5b6e86f13ebde6796650a7f3dd78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029492, "uuid": "f1098500-f001-4433-ad8d-1ef2d27b9918", "comment": "Malware payload", "value": "ed168f2e301c6785409b18a88b092e7b9743938a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029492, "uuid": "f838de42-1f1d-4bff-8219-d8a0548f96b2", "comment": "Malware payload", "value": "f753202df806a97e6007d444187c60404c51c9d8633f9286026378f2cb93bc87ac3677e1ee9f05497e12ea290f4d28a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029492, "uuid": "a186c424-fc64-4681-8293-4a6187929ddb", "value": "T153B21A05D7B301BCC8ADCAB1C2675143AEFE38071790BAEFA7A12619BC707D46538E65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029492, "uuid": "930a50b7-5980-4f3f-affe-a89f3d6be0c3", "value": "50dbb2e4ba4c1d0f3b238539dbdcaca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029492, "uuid": "e6fb8305-864a-4702-bc9e-2bbd5f4be120", "value": "384:/DK7zSsF+zgguJBGxwK4g6VU7fsvPtUxvwgLxIzY9DIXiQlTRgu+e8ZYqAAAAAAU:rK7zSNzgguJBwwbTWkvPtoLLxFRU+Vej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029492, "uuid": "1c3a60be-9f00-4ccc-8d02-6f44efcf07f7", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029492, "uuid": "0f7f6c39-ed21-44d5-af56-27e702ec48c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029492, "uuid": "bda3958b-ffe5-4331-80e6-702b43d81553", "value": "e8416ecaf0c400c48d2b1e39c035ffa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478b7c24-643a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781033689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781033689, "uuid": "d8c116b2-b147-4813-910b-a93a18eb1533", "comment": "Malware payload", "value": "7cffbd888bac001fd1fbe19a0a74d0d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781033689, "uuid": "ffd59ef7-5503-4e71-adfa-f515492daec6", "comment": "Malware payload", "value": "07298e1dc4311417a89df507d29636699e98c09787b1b5dfaf3bc0c4d853985c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781033689, "uuid": "7436b50d-e3a9-4991-ab30-cdee118f8862", "comment": "Malware payload", "value": "79ac59d720946189e151a76c38cf3829508ef3fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781033689, "uuid": "6a7b9d84-0cf6-4c8c-8bdd-6bc57a5ddce3", "comment": "Malware payload", "value": "c36e11c3876b403518ef1fe7886fc3a4688c34926fc3ff3d78ae7363ff604c1d07051e7e370aa74995bb712bee96c2c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781033689, "uuid": "8b09a425-32a4-4d48-bd85-7b8014ecd18b", "value": "T1E835E10A27E82BC4F1BEAB796574040087F2F817D735DBAE7D4C12DA0962B849653B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781033689, "uuid": "80d9f1e9-0127-462f-9a2d-d66005af190c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781033689, "uuid": "baf1b171-244d-47e4-a45e-0707867d399d", "value": "24576:qwjgbd3vAtr77eHC4s9hCwCQg3oyfJuz0+y+30L:bjq3pHC39Eb3oycry5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781033689, "uuid": "26352a7e-4196-4d7d-88d4-c20e888e21ac", "value": 1160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781033689, "uuid": "35d1cebc-84e4-4d93-91d1-7cfdb1e69bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781033689, "uuid": "af41f7aa-2125-4dad-8475-decb35509531", "value": "New Quote.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bed5ff8-6405-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781010906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781010906, "uuid": "357bd8e3-44c6-4367-811b-6b4e3ba9066f", "comment": "Malware payload (WannaCry)", "value": "eafc95d5f835c86494506cf1b92c6906", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781010906, "uuid": "ae697b19-39dc-4cbd-9cf3-290297f00f3a", "comment": "Malware payload (WannaCry)", "value": "07c8cf374f29075c3c7e8dc2cdf55a30d50b1d209927fdb3a844b082dc91378d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781010906, "uuid": "ad2b6820-d8ad-43f2-a662-3c0772042417", "comment": "Malware payload (WannaCry)", "value": "ddb9ac44bf8f414d82729df969b349435ebf5627", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781010906, "uuid": "95671ba6-5347-4b3e-8f58-1870201910ce", "comment": "Malware payload (WannaCry)", "value": "e3ca3274f0d82462d6ce54d2833f632a0d35e9ac7c114fb2533f560eee6313e8ac652ba9b70b5dd13a3b3942a2510660", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781010906, "uuid": "200bcc95-6449-412b-ab86-710fc742a90a", "value": "T1A636238B72E498FCD82319F6C0628A1D7673F8755B7DCA4F538041B61D4BE267FA0A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781010906, "uuid": "10174430-0be1-4ee7-80ba-25057c0921ce", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781010906, "uuid": "1a63c1e5-3eec-43ed-bec4-70ce2dbb1eba", "value": "98304:DyDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVU:DyDqPe1Cxcxk3ZAEUadzR8yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781010906, "uuid": "5b44639c-0ebe-4d70-9572-17648e759715", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781010906, "uuid": "ef7f9be8-baf0-415c-9520-5540f0ad1403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781010906, "uuid": "067915db-c79f-4c6c-895c-c1d44b4666c9", "value": "07c8cf374f29075c3c7e8dc2cdf55a30d50b1d209927fdb3a844b082dc91378d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f596cd99-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985878, "uuid": "07b633b1-86a0-4371-a746-41ec5961548e", "comment": "Malware payload (ConnectWise)", "value": "93e8ed4422edf7bca927160bacca2ac8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985878, "uuid": "390ea635-3f00-4970-9132-acca547ff9d9", "comment": "Malware payload (ConnectWise)", "value": "08727f11a6d87937a4efa4b67e69c4346e72588ce7651a965f52a74e8a6956fa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985878, "uuid": "702f62c4-931c-43db-bda8-c681168b2e20", "comment": "Malware payload (ConnectWise)", "value": "180c77c5cf39cc8b8b62142190dcd261d502bb27", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985878, "uuid": "7faefb8b-4157-46a0-ab25-109fd145f0a5", "comment": "Malware payload (ConnectWise)", "value": "22381f6ea34e01d75e2ba32220423c4e9a28481de66df1d2487cb239518b3aeaecbff71aa317aae51e570c8076264f19", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985878, "uuid": "903e7c4e-f608-45db-a511-1236be5523a8", "value": "T1AAD61200B3D995B5D1BF0A38E87982696635BC044716C6FF5394BA693E32BC09E32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985878, "uuid": "c7608d1a-6f45-4e9c-b313-90786fd88725", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985878, "uuid": "765a2a2e-4619-4080-8eae-beaf4cbeb9ef", "value": "196608:ZfefPnMXtv0ACJZNXtv0AxXtv0ACXtv0AfXtv0AL:fteZZtJtgtjtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985878, "uuid": "f8f39453-7bdf-4376-b881-e6d1e32f53a1", "value": 13431632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985878, "uuid": "bd5d276d-0498-478a-8cc2-59d708f2c0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985878, "uuid": "33873be4-bd06-4fa4-a45d-07bd7e648167", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4579836-63cb-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780986305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986305, "uuid": "ddd7c1ae-4f2a-4087-ae32-8da5744fed74", "comment": "Malware payload (NanoCore)", "value": "d323632cf288313cb41d6626d48ab1ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986305, "uuid": "fc51c7c9-f8ce-4445-b398-501ca5baba65", "comment": "Malware payload (NanoCore)", "value": "08b1874c71acbadabc06c9eebea0851ee9ebb85f079a434ad323e95b06cb54c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986305, "uuid": "563a03bf-e84c-4e75-a95a-7e4bfc90cb8d", "comment": "Malware payload (NanoCore)", "value": "c90a0453934f94bcf31c079b5906d10799d8edd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986305, "uuid": "0ef64766-146b-4f08-8aec-21c4dc8e9b9b", "comment": "Malware payload (NanoCore)", "value": "550a32e435b7d66479a1e8749cb41311c1b5efa575268b8195426208f15fe4ff57fed231a6b79eb200b6972a47f308ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986305, "uuid": "442e697c-cac1-4c51-a644-03bdfb0d2987", "value": "T1E514C05677A84A2FE2DE867D611212169379C2E39CC3F3DE28D455B78F267E00A0B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986305, "uuid": "9e62fb1c-ccd7-4448-a471-fe12b1e95f1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986305, "uuid": "d305716e-4a30-4912-9b5b-7ccf992f3875", "value": "6144:sLV6Bta6dtJmakIM5+6V2qhLyNPYTbEj4:sLV6BtpmkFM2uL4YTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986305, "uuid": "0d6d20ef-3657-4b2e-977a-292a2d7717bd", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986305, "uuid": "c4801e5b-738d-45af-a02e-7c2c56b18d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986305, "uuid": "aac9c34d-deff-4ae7-9fe6-025a4a851d8f", "value": "quarkjs.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27500495-6410-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781015596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015596, "uuid": "d1fed0f8-5e55-4b7a-8c19-325898d7ebee", "comment": "Malware payload (ACRStealer)", "value": "a37bca78182ea933aa07ee39d498b401", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015596, "uuid": "9afec74b-05bd-4a9f-a360-40b715a2c2d3", "comment": "Malware payload (ACRStealer)", "value": "0906d307d3b34feb2ca135d5985e7684ca0a40a3f8ff6d6f3fcf1f057d382a26", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015596, "uuid": "6b6079a0-41bb-49b6-8414-f81074f348c5", "comment": "Malware payload (ACRStealer)", "value": "14debef9aa5f72ae2b6cd5a30da88930ee0c1217", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015596, "uuid": "30a579f8-2c1a-4fa2-8e7c-20d184573ea2", "comment": "Malware payload (ACRStealer)", "value": "bf7e3fce0ec30aef80cbb37daf5ebe1f6f07aa8ab2183d9dc55570fc449d40e2917988d439289040ed07ecd12e2f07e6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015596, "uuid": "40406eb7-2e56-4813-a3b1-179f0039609d", "value": "T1D3C57C01FDD745B5E40312328AEB62AF2B349C090B32DB97EA447A7DF9B76D54836309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015596, "uuid": "930d3539-a52a-4f3c-af90-6ccd6f2ca972", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015596, "uuid": "ce46397a-8bef-44f4-aea4-a35f40dfeb9d", "value": "49152:arJriOEQZBs9B6CTbNSCLeZ4s3uSYwzGAKbs5:e/EQZBe7TbNSSrDk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015596, "uuid": "455230a0-9a08-4597-9040-484d7c5023a9", "value": 2603520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015596, "uuid": "e51546ae-92fb-4cda-9e35-36157f155def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015596, "uuid": "e1e225f2-3ece-4011-8840-f645428576ca", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041ecb84-643f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035724, "uuid": "9ceb1745-cf4a-475e-89a3-876fa122aca2", "comment": "Malware payload (Mirai)", "value": "00967acca9ff6e6860bb791901eb962f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035724, "uuid": "1d24f727-beba-4d19-b9de-12e1757fe0f2", "comment": "Malware payload (Mirai)", "value": "09af15dc90c186c3dc1a61c71c3b68c13c16be1cad9b8cb4f9d61d0c1a42d394", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035724, "uuid": "409edf67-77a3-448a-905c-56fe1d082549", "comment": "Malware payload (Mirai)", "value": "db62a2175ff9910296696d9f3f537cf05e2ed415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035724, "uuid": "e38c2039-6503-4527-9e88-a45d3370388b", "comment": "Malware payload (Mirai)", "value": "509a27caf45c228ca58ff23c38fa1db1261a8cc93c868633172e4d5a09656eb23e4be8d0d1782f323bb732bf73d2f3b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035724, "uuid": "4045801e-94d0-40ac-a9ce-c4c591bc605b", "value": "T1B344C60F6E228F7DF369877457B38E75975823D627E1D581E1ACC2011EA038E542FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035724, "uuid": "820c7c5f-b157-4061-b99f-e5c2e6d527c2", "value": "3072:IBzK/GCiboyBV8OhAk+uFm7NQBqdmgzzq4t4HCUBzo2xsmf0gi4n3lwfbU:IBzKOCooyByk+4M5r36iOxV0g7nCfbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035724, "uuid": "b36960de-c75c-4143-9eaa-4f02c1e8eb21", "value": 266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035724, "uuid": "12026206-b56d-4525-92fd-381fe4acf070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035724, "uuid": "7e991f52-5c34-4f07-9860-b93934727ce1", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f512620-63fb-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781006563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781006563, "uuid": "a60883fe-4466-4f31-8f20-ac6d9433675e", "comment": "Malware payload (CoinMiner)", "value": "f2c0b8e95ef61f105c10830c6fac312a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781006563, "uuid": "d779dc3f-7b2a-494e-a708-99015d0265c9", "comment": "Malware payload (CoinMiner)", "value": "0a798aca4c5bc3060332c4b31601d5a87a81667474fd746c96b95f35b624a51e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781006563, "uuid": "2e8c256b-fb40-4e1b-b240-36b74935f05b", "comment": "Malware payload (CoinMiner)", "value": "d4beb0e295b0b699902f06b4420563e80b0d47f1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781006563, "uuid": "37bb5b78-d6b0-4874-b468-898ae4da43ea", "comment": "Malware payload (CoinMiner)", "value": "ab9e0b1c06504a978f1ee5ec31a54cc00a7c8b182a78ec3f42b13a19a66fde6c705d93b73091f37423b0df17aa836367", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781006563, "uuid": "293c1d3b-a555-4b9a-826e-089ae07e0c8d", "value": "T133321CFF79EA126916D2B3A07C5759029F9537302CF04449D4DA4B4BE83B6B791C0A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781006563, "uuid": "71801d86-caf9-4992-9fa4-90f409672e50", "value": "192:SyZYsc5fxHq/1wbAXua6eg2pwG3KCPC6P/llOf27HBhwHml5GK28hBPrsAiBDDoR:rCscY1oC3DPC6PGO7Bhwo5GYBQAidZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781006563, "uuid": "d93cb11e-e5c5-452e-a35e-f48289f76a33", "value": 11324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781006563, "uuid": "52c4c6ff-749f-4dd9-984f-5f23dc9c76ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781006563, "uuid": "745e1ce6-ca5d-4bdc-bb9f-d50ccc04ff90", "value": "netstat.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daff6f10-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003013, "uuid": "2d5834e2-0213-4f4f-a85e-91b87b5be1d7", "comment": "Malware payload (Mirai)", "value": "05bc42c29fbb99df0ce60ef6e6020366", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003013, "uuid": "d84023a3-8a15-4915-a7d6-d029615da3dd", "comment": "Malware payload (Mirai)", "value": "0a8c5f75dcf3586f9728f596bfd4cdb4a8a98cc22e4ce947c0090d83049ef3af", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003013, "uuid": "bc3de39b-1ecd-4be1-a3e5-ee5020c313b2", "comment": "Malware payload (Mirai)", "value": "2d119641cb0044215c2d66dd9fcc80d505fe2260", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003013, "uuid": "995ad4c4-7d1c-4252-a959-429594fcdc5b", "comment": "Malware payload (Mirai)", "value": "aee7d175628f0ea9a92633118b86a53804c3e07f0231f4c2c1ca8d43b1f31ed6119d402b4514410116bde36cdfb5a648", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003013, "uuid": "5624a5f1-f243-4e69-8ae7-029d37c20f57", "value": "T1AED4CF03F271ADD7C4864B7540FBD2304316F6931393F381F66A8349286BAA9BF9A355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003013, "uuid": "9c8979d2-e288-498f-b770-9cd41fd2a71b", "value": "12288:jwELiy257ssw408737v4KfS4zKEYVxz357QbnQp1ROd8IJlnTK6:jwEuNVzvhZnYzGwCRTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003013, "uuid": "07ce77f9-4417-48e4-a497-b4621bcc7ecd", "value": 613792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003013, "uuid": "89ab571e-ceb9-4a39-a49d-3635d7c342fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003013, "uuid": "c4c9e995-87f9-4e36-a06b-e4abfd030ad8", "value": "8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c315936e-63e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780996530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996530, "uuid": "181fe2da-787e-4c05-b703-1e61684b5d41", "comment": "Malware payload", "value": "e67f298521df6a7d66c342338738f314", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996530, "uuid": "13678059-1673-495c-8288-939500874358", "comment": "Malware payload", "value": "0c89fbe344c790f15c4ced12140c595746d7d47473e35bc767b958a8e7da299a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996530, "uuid": "9356ba93-209f-47ea-ab40-ded2ac40bcf3", "comment": "Malware payload", "value": "a5e521152947375e8207e5f7413c44013252ac97", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996530, "uuid": "b3217a29-46ee-4194-93d4-fa5e1336a7a1", "comment": "Malware payload", "value": "a7826da123648e9c39de891b4109b28f6c83563184513cc85f123eeec51b8132aca7b86a611660048fc095a993134fc0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996530, "uuid": "add35cd8-5b27-40fa-bef4-4b33e414ec17", "value": "T11601ABCFC005DA6051C6F89C22975044B411C3CB294ACFB4BF6C983E9BAAA58B055FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996530, "uuid": "4f24ced3-a09a-442a-ae91-da853936fe55", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkauEIS9fWoSXIR/Z2NIErMSggVIXgIRX:kXCKysE2hi0ziQvZohaFh9TSAKph50X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780996530, "uuid": "f419483a-8eff-4ef5-9ffb-ad0ab008c148", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780996530, "uuid": "e5615442-709f-4de7-8fb2-4d97f4196a80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996530, "uuid": "4efe294c-cc56-41db-be92-2bf3f2c8393d", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42205858-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985576, "uuid": "ca35f4d4-0a22-47ba-bfc1-f0be8e8d0d74", "comment": "Malware payload (Mirai)", "value": "00b321108d6e44d51113fd96d6978c1c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985576, "uuid": "154505be-8650-4104-ba4e-6630f71ea209", "comment": "Malware payload (Mirai)", "value": "0cc77478fe31c8b48bbd35b4f9690c0e5d91b446cdf5a35d0804f600b52d738b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985576, "uuid": "96196fe2-9889-4cda-9000-cca3ea1992ff", "comment": "Malware payload (Mirai)", "value": "5cae51a9c2a0538e059ca4b9b059e997d559fb06", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985576, "uuid": "1f5bbad4-a6d1-40e9-ba43-b5fa62d89e41", "comment": "Malware payload (Mirai)", "value": "81dc89dd12c119d37334761f4badb58c1336fb5ff8004b14f669dbbf863363db4c2bbccf57f91413968a73ba32b5e9da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985576, "uuid": "1e3f8e6c-8d5a-43fd-9228-1ddc3ba18f70", "value": "T1C1041945EA404B13C0D727B9F6DF42453333ABA497EB73059528AFB43F8679A4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985576, "uuid": "bf0c5fbe-33f9-4d88-b035-1ba2922093e4", "value": "3072:NdeEDR44faLNJ6MaJsZdr/ZRoxCiLVkS6whCoSPM/RUpisN7u:3eED9fahYMaJsZdr/nILVkSHDmM/RUNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985576, "uuid": "e8efdd2e-820b-4372-aef7-291f571acfe7", "value": 181623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985576, "uuid": "1d5d5c92-9a82-4795-a009-30bd6ce98dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985576, "uuid": "0d6d991f-60d8-4017-9522-9733b3e64e16", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e7561d-6416-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781018458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018458, "uuid": "9347e6fd-d155-481d-9018-81622aeb101b", "comment": "Malware payload (PureLogsStealer)", "value": "c018874f7b9049db6dfda5c3245af1db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018458, "uuid": "2822daf6-4a6f-4728-bbb8-fa67d25c96d3", "comment": "Malware payload (PureLogsStealer)", "value": "0cf49cdb5571c650e80af83316ddcb6ebabc205ac5929e14be4962b56ae382a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018458, "uuid": "15e87366-1836-48cd-b4b3-26655fbe1dd6", "comment": "Malware payload (PureLogsStealer)", "value": "8f47811914eff534c7280d75c231f9605e2ec7a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018458, "uuid": "13084065-f3d8-431c-b710-f967e7e95910", "comment": "Malware payload (PureLogsStealer)", "value": "694103371d64073679174972a581abfe0a41cdd5bc3cb51e6135adaa882ce7cd2631be013745ba28957ae8d43be4e649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018458, "uuid": "482acbd2-cc92-4f69-9ec0-a3808f2f6110", "value": "T1A8F4BE5B76968E21E2880233C1DB161187F0684B7677E70E758027DB39063BBEE4B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018458, "uuid": "cf81faba-05d3-4e10-b23a-65aef4197a1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018458, "uuid": "d09b8e71-545a-446c-a54e-32b313137fa3", "value": "12288:T5KgutDlfBODnALnNIvElOAMpwVzwshofegfoNKJYWIx1DMciiqcliT:xaJUkLNoEIVwVzbhYfP/jK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781018458, "uuid": "ae61fb3a-7f21-42c4-8b88-ea47b1674e10", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781018458, "uuid": "1c213624-530b-4759-a85b-7793671c3ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018458, "uuid": "78e44bcc-6bc8-446e-bf9a-008059aba877", "value": "SecuriteInfo.com.Trojan.Kryptik.279.98194381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c855e3-63ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780987561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987561, "uuid": "418fac4f-dfbb-4d5e-8cfb-8f810620855e", "comment": "Malware payload (Mirai)", "value": "02d72c473fe40c2e91496cb38bbacb15", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987561, "uuid": "d7e47705-c694-4314-a089-b0249bc7f1a4", "comment": "Malware payload (Mirai)", "value": "0d86bc61aa6dc7d9d31ec4172d50eb3a73ad4abceaefd4326d85b38f697f9472", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987561, "uuid": "6326abd1-cfaa-45a9-9c9a-49387bef6195", "comment": "Malware payload (Mirai)", "value": "5431bde00ca6eea735f2c1df82ed9bbdda5a3cf5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987561, "uuid": "054f9511-3ea8-48ba-8e5a-81934bb29fdf", "comment": "Malware payload (Mirai)", "value": "e4b8326f31a15de63a08cb03e2f64ff7f0fdd09c4443f6750a7a27aba87de44db9f373bfd7c1b3e144262810dca13fba", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987561, "uuid": "cfa1c142-d161-4d44-9a2c-5784a8d35ec0", "value": "T12E057C8AEBC2E4F1F25300B1068FD7F31A6462365053E6B3FB482E6674767D21E16369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987561, "uuid": "a3c84a38-486f-4390-b363-b59e98e285ac", "value": "24576:IVZ9lRfhbOhxWrSokds+Q2yA2fF2smEqMEi:IVZ9rhbOheSjNNp2ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780987561, "uuid": "cf8ed032-d299-4cbe-85c1-aeb608df289e", "value": 812092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780987561, "uuid": "18c755c9-8c8f-4eff-867f-9ee020e6eb80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987561, "uuid": "7afe1576-e567-4de1-8e13-654f01b2733c", "value": "2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44aa4550-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985581, "uuid": "9f5d6fc1-7821-4e49-bde8-1bd66f3a809c", "comment": "Malware payload (Mirai)", "value": "96ac0b9a51bbd10421bf727342f08db4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985581, "uuid": "7d7fdae7-e88d-4a1a-9aa9-e59c75d19ef1", "comment": "Malware payload (Mirai)", "value": "10583a0663ad4382bd45083b81febdd9c8253cea4f8b0cc577664de1328d1d5c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985581, "uuid": "e39191cb-9c02-453d-a7b3-bd7e7e2f7ba9", "comment": "Malware payload (Mirai)", "value": "1ee18b85b35c7b7f00e18a5a9d253babbbb18669", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985581, "uuid": "0a6bf7aa-6104-4902-9298-15ac86f18646", "comment": "Malware payload (Mirai)", "value": "4969991b45b13b9b7b8e4b82902ad1fcf8cdb11b8b607efda2738715062c5e47237490d46c96581617b654fdeda48c99", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985581, "uuid": "2925a1cb-12eb-465c-bd02-f19a4bbb2907", "value": "T127E34C077582CAFFC4C7D1F44BEBA9369D32B86E1539715677A0BE921E45DE02E0CA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985581, "uuid": "dc15fe07-d719-4846-beb0-16aaad709dec", "value": "3072:vdmS3SvTCDH+qjMV5MnBZJYjkbUBOOQTSKkwHsB9OIE1tD:vdmS3SvTCDH+qjMIqOfzMdqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985581, "uuid": "c5a9b35f-837c-4ce7-b37c-be21601e4cd8", "value": 148152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985581, "uuid": "68482e05-db9f-499c-8225-7c4e4de0815a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985581, "uuid": "eea5e64e-f173-4de2-8962-0f8c1f71040b", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7de582-63d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780989164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989164, "uuid": "69ceb7db-5960-4451-b996-f332081ec1cd", "comment": "Malware payload", "value": "bf78ab2cb0c55d4a00bdc7fa9b4fd785", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989164, "uuid": "c298e385-89d3-4926-b368-f56775f24f45", "comment": "Malware payload", "value": "11290773d851851f14089249b1ab8ee898bd57176342d4db5ce1c3869a363912", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989164, "uuid": "02f4e068-770d-42c7-84a6-3cb29c52ec0f", "comment": "Malware payload", "value": "b46cf0d85e3d8acc936b3f24db6d12644f28b385", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989164, "uuid": "ffd34a5a-c641-4753-9a77-4743c1c9b4b6", "comment": "Malware payload", "value": "3700019b8ce0100ec578b612c16ba7463ea8e4a51c70020805dd87442afc7f938ebca1ef57cbf7c0572981143d218430", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989164, "uuid": "971931f5-76be-4349-a6bf-3a9c0a71dcb3", "value": "T12205E63DCD14412FE9B2C518C899855FF881259B222CE94790D73F5F6EB6882B7C329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989164, "uuid": "23b99531-6c58-4ee0-be5d-37a8c0365495", "value": "3072:24M515Yrd+FNzVcnjVlEPDk1bUAmUSDt1wQykRrRcET1Pu+mWMHze6udJIvnq3ig:a1xgWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780989164, "uuid": "f041a968-222c-43e2-b2d2-9d555491979b", "value": 858532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780989164, "uuid": "90d79fe8-f9b9-4e84-9e71-6a9b673bf19d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989164, "uuid": "0203d7c3-b2a0-4ba5-8b85-90a0dab681d0", "value": "PO 4560195966.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592aca7b-63e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997211, "uuid": "675859cb-c755-4091-befc-c8e11e498dd0", "comment": "Malware payload (Mirai)", "value": "2b8faf52ee11f3eb45ad91f66ac22051", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997211, "uuid": "4425f285-cce2-496b-ad5b-bbdd20323c15", "comment": "Malware payload (Mirai)", "value": "11c576b2c3eced4cafcf1b1c9fa2156d2687b28288daa46b9d3a78e976b1d912", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997211, "uuid": "f1734801-dc8b-48ae-83d0-615677fedf24", "comment": "Malware payload (Mirai)", "value": "d3011fdd3118639fb3fb3787750abb532a513a91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997211, "uuid": "b598c900-7377-4a93-837d-887004b4ff30", "comment": "Malware payload (Mirai)", "value": "f5b4ef6176090c8ca500211df0bc8a471c40f9b1c4987d2b19089be619050ca4d40a0cd707ecdf99cf5f36eb2f059dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997211, "uuid": "9dc3bba2-fe3e-4523-938e-035d41231d06", "value": "T1B933F1369406BAA9903896B3C8304BD3D2C631BD98C735501BD906E9F2F14DAE1E59DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997211, "uuid": "8e228118-802c-4c35-9607-f87c2ad6d77e", "value": "1536:o6AfYnFZ0nvIuGZmUem8YdZSZgY/OE1bxYzA:opfYFZNmETmgY/OyYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997211, "uuid": "2fb51c28-c389-476e-9baa-a6786f1aeb5a", "value": 51836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997211, "uuid": "3bc794da-6c1e-4fe8-b4b8-d711d8b5875c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997211, "uuid": "c3018e33-8434-45e2-89ad-59162d9b9193", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637508b7-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780979619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979619, "uuid": "e1b98e82-65fe-4a4f-b432-70731f7792f0", "comment": "Malware payload", "value": "3dcac561d17b302ab8d930805cefa2d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979619, "uuid": "9037b63c-bc26-4cbc-9b4e-fef03c9fdc9e", "comment": "Malware payload", "value": "1246239c5d05cc4edefaac9d031288b539fbd7866cf1ff59dd0a2b0cafcc4aff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979619, "uuid": "b4a9afdf-e357-4a96-a284-ecf8f1eb641e", "comment": "Malware payload", "value": "ff8b30547ae90f22de732c3ce74e0636f1bff6a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979619, "uuid": "f14416cc-cfd4-4d4f-b77a-aea66e0769a7", "comment": "Malware payload", "value": "cef0413b9c5d6ab25e4bc08504c26ddb5b0d870bbf691c6c20cac8cec18ae068608a90920b43dbd75071bda3c1c6bd2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979619, "uuid": "f6b1365a-b7a3-4a2f-b25a-f5bea5f93735", "value": "T148135CA3CE3A2D18D2A98575B0251B799773D465C1571FAA447AC33AC003EEDF44A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979619, "uuid": "fe17e3f9-546b-4a92-ab79-450091e66d20", "value": "768:d0wIJaHedxarmTX5iq5OnKCrCVZ7ca9N/o15H7nUCD0VpdfXmMKI:ddI8HedDTJp5cKCrC77/9NQ1BnUCDMLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979619, "uuid": "3c249171-73ff-48b7-84e6-5609371ad3e3", "value": 43584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979619, "uuid": "fc0899e0-438a-47de-a198-d7c9942f4a52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979619, "uuid": "b9113d24-74bf-42d0-a717-5d81506e6d12", "value": "11.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b4ec77-63ee-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781001308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001308, "uuid": "cf66c0e9-7daf-4600-9b50-c0b64b21eb01", "comment": "Malware payload (AgentTesla)", "value": "687b324ba50f24f92a61f10813070590", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001308, "uuid": "471179af-be5a-45e2-92fb-45a505876b29", "comment": "Malware payload (AgentTesla)", "value": "12b28d9eac7cf93ffa3089e2c12f5d54e7a814e870d1a3d47668213808419746", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001308, "uuid": "4f17800f-883e-4d40-9dd4-a1748a1483dc", "comment": "Malware payload (AgentTesla)", "value": "9ebdbdcbf1898d091be18edd9137fe71f02a9819", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001308, "uuid": "64853c30-c49a-4fe3-a871-6459d512ec0e", "comment": "Malware payload (AgentTesla)", "value": "87edb9e4a97b7389559b73093f78c1eb8e0dd3c20923be5e85c3a46b5da03c092241df73077352179285d5989ae518df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001308, "uuid": "ef995b8c-b02e-4f1e-a05d-f484493587c0", "value": "T1E4440F027F88E715E1A97E3782EF2C2453B2B4C71633C60BAF49AF5524516826C7E72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001308, "uuid": "9d08a858-414b-49b0-b4f8-7bae06ea31f7", "value": "3072:oZRayCK61EBuTEubUZ3THo9rG8KaG5jnTh4qkufzz:wayCK6WcFgsq8KaWTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001308, "uuid": "d3ea1f40-73f8-4dc4-887c-3fdb6de3f959", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001308, "uuid": "dc31ab79-e272-479c-9785-c4be2fa345f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001308, "uuid": "f68c9fd6-ba1d-4190-aab2-e07649aa0b67", "value": "12b28d9eac7cf93ffa3089e2c12f5d54e7a814e870d1a3d47668213808419746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6fc974-63d6-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780990991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990991, "uuid": "ee43f52e-c8db-4e0c-9b77-56fbf0ffca65", "comment": "Malware payload (PureLogsStealer)", "value": "9b5a759f7972687abdd16fbde7815a0e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990991, "uuid": "5646998c-ecd6-4e29-97ef-eb3179dc78af", "comment": "Malware payload (PureLogsStealer)", "value": "12d51bb5ed6b4db145af16f70b1f498c5757c7d2420bd25f7313f4cb092b0419", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990991, "uuid": "ab656ea7-30d4-47c2-9f5e-39a6adeae82c", "comment": "Malware payload (PureLogsStealer)", "value": "d1749979b1030120bb66ea57b9399f3ed3e13dac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990991, "uuid": "3c3a96b3-6023-4455-bc3c-620554247c2c", "comment": "Malware payload (PureLogsStealer)", "value": "dbf4ce8d356cf21d47c1658ab4cd83beb32f5740411a49bb1ea425bb41c45fbc8664db3b896f3d01b01b2a5ccd28e082", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990991, "uuid": "3187f64d-9324-4960-8de8-62ad42f4c18d", "value": "T1FF05D53DC914412DE531D229C58A096FF8922A8B113CE50761CA7B5FAFA384777D33AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990991, "uuid": "f0b44aeb-57e5-4bbe-8654-adb70c31421b", "value": "3072:kfvz4COnwHUt70X+rWe/sAMFr1UGJ3s9T4IuLn5qTZbtIYppYyIyDFmp5VkiWp0j:KmCTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780990991, "uuid": "7db6750e-5d23-49bb-98b1-58f200e14853", "value": 798342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780990991, "uuid": "5d3160e2-aa44-41e1-be42-b8b6e2628236", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990991, "uuid": "f3e0160d-809f-4895-9088-a534acb323b1", "value": "Request for Quotation (RFQ)-876543456765_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d379d0af-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985820, "uuid": "6bd20a28-1bc6-4b11-b2cd-8b53c4dba890", "comment": "Malware payload (ConnectWise)", "value": "eeea46e4779846dc293ee341ff1696e3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985820, "uuid": "19da0a81-4401-401a-930f-317dff01a310", "comment": "Malware payload (ConnectWise)", "value": "12e77139b098bdc3a4c7aaca1f0d87720588a39695fe0f2e0cf809f92e0a02d7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985820, "uuid": "f0cf414b-03ae-438d-9cf2-1d95ae9635ce", "comment": "Malware payload (ConnectWise)", "value": "b65132ae4de96f2d8b1b5e316860c7206d0157ce", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985820, "uuid": "5b9654f7-59fb-4b1e-87a4-71508e7fcdcf", "comment": "Malware payload (ConnectWise)", "value": "4cd2c698be9e2e4516e8b1580e4378d3e55d58e91ee01baf3dad19e8ae50bdd766fd6d3cee1dadd35c109ab8cf4c653c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985820, "uuid": "7307e29e-336e-4778-8c63-3d072f837416", "value": "T1F2646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985820, "uuid": "241a161c-27c7-44bc-bf47-bb941643fc60", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985820, "uuid": "2b8fa322-a928-428e-865a-a65ad4e5d9aa", "value": "6144:zmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9B:y1iw7gryNkSV1hy1Z1u2JLu9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985820, "uuid": "808cad34-c945-461c-92af-6ed2a6737997", "value": 313968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985820, "uuid": "561aab06-5100-4f1c-aed7-2d262b5a1b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985820, "uuid": "b949c993-d023-4401-a4e3-7a312266342b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40317121-63a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780967964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967964, "uuid": "efa034a6-1e3a-4ffc-82d5-9cc11f8d0f5b", "comment": "Malware payload (Mirai)", "value": "7b177f34d03e4fdc30ddf50dbcc5bbe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967964, "uuid": "04a8420c-8bbc-4535-a0a4-c6d11c095d96", "comment": "Malware payload (Mirai)", "value": "1377cfabece23ad136a215698fdded3b61b766a76beea4650f6770b0c67affa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967964, "uuid": "c5db134f-b2a6-451c-968c-7ebf2cb0415b", "comment": "Malware payload (Mirai)", "value": "a7d9e3a5a769c64a22ce760492beb0b1b5397622", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967964, "uuid": "3acf79a4-06c8-4463-8b4f-5b12d9b7668d", "comment": "Malware payload (Mirai)", "value": "8f7bee92d38275eb7504c46cdb01366e8a62f257855c4746f7c560806534b763a530379447190baa8f4cf8d2fa1cb321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780967964, "uuid": "c62e1a77-d6ff-4876-8722-c57561834c5e", "value": "T10F5339C2C253D6F1DC1265B02477A7319E75A4366A35F647E3EA3B37A803B40AA0735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780967964, "uuid": "c9752374-c484-44a5-a42b-c2f73ba71dc7", "value": "1536:4Ft5tnfKcYZMwqeMxR+TGiSD+Z8BOgJCt1/b2Cgo:4Ft5tnfKcYZMwqeMxR+TGiSamtIt1Tjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780967964, "uuid": "a44db89d-9408-45b2-a41b-ac6cd60186e9", "value": 62416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780967964, "uuid": "fd6b09a5-d216-47ab-ab27-cbb49755c16b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780967964, "uuid": "f27fabe8-703a-45cf-ac98-3e39ce0aab8e", "value": "azsxd.i6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9587f2cb-63d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991729, "uuid": "a48c21c0-0ac5-4423-8216-7606d8668bdd", "comment": "Malware payload (Mirai)", "value": "1b46de609bf4194d6b56229bb5180f5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991729, "uuid": "969cb519-a70a-48e0-bb53-02cb3717f9ee", "comment": "Malware payload (Mirai)", "value": "13acbeeb457d73c107a4c451db609bc541f0a65aa2d810fa71a7692f2f9766b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991729, "uuid": "a55de6fe-0829-475f-b8ca-ee0861daf1d7", "comment": "Malware payload (Mirai)", "value": "3554f9d2bf0c087f6fde02109208b0906688f115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991729, "uuid": "83769f43-6126-48de-942e-2fec207654d8", "comment": "Malware payload (Mirai)", "value": "4a42311b363edc212e6833d8229c6b2b2b093b57d2262697195b60cfc1f18e06000bf2c8ca201c05a1c2cd4458c72da1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991729, "uuid": "e86bfe78-226d-4997-a744-b007b166f855", "value": "T1B7D33B46E7804B17C0D61779BADF42563333AB94A3DB73069528BBF43F8379A4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991729, "uuid": "efabc933-ebd2-4a92-a514-fda8857a0034", "value": "3072:XF0c8vqaEEkfnT6GaAqtB+wX7YAaBM/9N6U4zZ:DcqaEEkfneGaBpX7YbM/9N4zZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991729, "uuid": "de88a4fd-e4d7-4528-884b-88ba1ef2faaa", "value": 132155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991729, "uuid": "5f2bdc77-a45a-4f64-b3c1-fe5736923b5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991729, "uuid": "4b7d66e8-405a-4a09-923d-ab1224422b37", "value": "CRY.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0840dec-6413-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781017088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017088, "uuid": "71853a39-e5b3-4c07-a25f-fbe564fd40e4", "comment": "Malware payload (ACRStealer)", "value": "69451ceee0fb01e9171912603959eff0", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017088, "uuid": "6c90157c-eb08-4bf4-bab4-06749ed744e4", "comment": "Malware payload (ACRStealer)", "value": "15054ba40150acc0ee8ffe9a13a5681965e87b2e827e213444ae2d9cce1bb38b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017088, "uuid": "9392e705-676e-4448-9d1d-410d6d27f91b", "comment": "Malware payload (ACRStealer)", "value": "5299711f6c967e0a2f8ada6ef1cedbaa8af55e8c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017088, "uuid": "abfbbca1-41dc-4555-aada-ca8ca66453ff", "comment": "Malware payload (ACRStealer)", "value": "0c85d9475d4c89c5b54e9ec14e879abb2bd150261d0237bc0a1329bf1996703a1207c1d4f8a52a95469af3083b0bf43f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017088, "uuid": "67ebb271-b696-46a9-8aaa-ae584a02b8ed", "value": "T127C55B46ACE009EDC49A633288E22695BB25BC450F3617C72FA1BB782F73BD46C75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017088, "uuid": "0ba31d64-aa45-4bf0-8c40-a6b2afd4a9e3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017088, "uuid": "be8c71aa-ce62-4b65-954b-a802fa7bcddf", "value": "49152:zPVWPDl85/knjdQHiJKADWsDWpcNzZnfM:z4YynKADW9pUtfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017088, "uuid": "e47168e9-212b-4c0d-8108-24f3ab65fe1c", "value": 2725512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017088, "uuid": "435145a8-3fc9-46d2-9993-320daaac9036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017088, "uuid": "f0a915db-3338-4bbc-b826-d6dfdffac2e6", "value": "kliulij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a1468d-6414-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781017446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017446, "uuid": "4d2f9350-1314-4732-b60b-cc37ba5a660a", "comment": "Malware payload (ACRStealer)", "value": "38e62f0120fbf9bfd3cedb099899d774", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017446, "uuid": "1d6e8be9-7823-42cd-9b26-a45469df2e65", "comment": "Malware payload (ACRStealer)", "value": "166d447eaa1db3b5a9540dede55416adaff729b4fa9a19f47dc0209594b5caa5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017446, "uuid": "2309530c-6836-4e29-a9f3-62d9b65abe08", "comment": "Malware payload (ACRStealer)", "value": "399172596c01fffe297de86bca8ff788d6b87f98", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017446, "uuid": "4929fc09-d5a0-4d59-820e-f5d6452289c3", "comment": "Malware payload (ACRStealer)", "value": "2bda9fd9bcead694b917dac366c6dd82de405252cf1f40de5882e579ed33c549aa4ea8a753b904f8570e2d25049f8f16", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017446, "uuid": "7510de55-da76-4964-8f11-34348e9cb1c1", "value": "T11D052A19E59358F1EB050C31E176255F7F247A18B894EED1C7F20A0ABAA3DE1221F4F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017446, "uuid": "f3daa6fc-9870-4aeb-bb9b-cac861771473", "value": "12288:8dyFn+6jp5ZgK/nO3yYPCKQryzOEFbVjl8Y:4yF+wIK/QySVQ5spp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017446, "uuid": "7c6fd66f-0935-4265-b7e6-1602959e8193", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017446, "uuid": "9236a833-8206-43e2-aeda-e395f4c8c07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017446, "uuid": "77267099-8730-46b1-9f87-ab98b0b1416f", "value": "acr-mix-639160906185480235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2f4394-63dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780993536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993536, "uuid": "4dabacf7-6680-446d-990c-892e0d386903", "comment": "Malware payload (Mirai)", "value": "40f90763f2290d699c38605d092ec712", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993536, "uuid": "ca7505f7-e485-4e74-b05c-949457d1533a", "comment": "Malware payload (Mirai)", "value": "173347e51e0be68c4738dd200fef0e10fdc16ae7f020f786f40c3cf844f732f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993536, "uuid": "e79ee71d-d3ef-49bd-b554-6f12043d9938", "comment": "Malware payload (Mirai)", "value": "a69e8dec5774175d02ed937a302c3afab4e88e07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993536, "uuid": "6a0202c6-3088-4466-aaee-04a239461a29", "comment": "Malware payload (Mirai)", "value": "3b736c10aa51f433e1fba91b45cc797aa08e27763f0d5c84775c3ce2835df458fe654b5d0afa8f8cdefff53f4670114a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993536, "uuid": "52f90f15-aa4b-40a2-85ef-a52152928f15", "value": "T1D2E33A17B8C188FDC4D9C1784BAEB53BDD32F4AD1238B26B27D4AE221D4DE205E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993536, "uuid": "d51ef6a2-f0b2-4083-a9ad-69768881fb71", "value": "3072:z1Bnl46KEAAQOucDKOvyxKOwulIpVgXGh1ai4G+n8q6p:z1Bnl46KEAAQOucD0cHN4ofp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780993536, "uuid": "5ab9c9d3-320f-45e4-ba6b-97c9eb13616b", "value": 151448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780993536, "uuid": "82652391-2188-4d1a-aca8-a7d3355a65b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993536, "uuid": "2cf3882a-ed1a-45ff-abbf-1a8389fcd5ad", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb7d38f-63cd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780986806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986806, "uuid": "3eb0adff-5639-4c50-a295-3170ba5414d8", "comment": "Malware payload (AgentTesla)", "value": "2599180580255c2bdcb8e684dead5f5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986806, "uuid": "bca09c76-9ace-401b-9706-3307e5ca210e", "comment": "Malware payload (AgentTesla)", "value": "177e0df525f2dbd50e8bacd4275c86d41873976700c73bc14b112fb54c267e45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986806, "uuid": "aff77baf-967d-40ba-8674-1c640584497a", "comment": "Malware payload (AgentTesla)", "value": "f050284c68c2f13c72ecca30966903d7be065a02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986806, "uuid": "264ee603-93b7-45b9-8e8f-2c91c240b0a4", "comment": "Malware payload (AgentTesla)", "value": "0a7dccf1bbe69c5df060a19fbae052b94fe522ad39e45d637f00c3e5f44de178488e56bc4919d19527de1959a29eb00d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986806, "uuid": "b68196f2-f631-4bc5-a932-949a1ca792a0", "value": "T177F522DBFFF20BD5895A9DCE1A08CA54DCE4C51FA06E1A8B5C674AD1AEB303C9044D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986806, "uuid": "f47965e1-6ccf-437d-81e6-745455537f2d", "value": "96:tbYWzyrqmdKSKZKs1ChBo35o6erRMKauy:1VmmWB45N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986806, "uuid": "66a67f6c-9a09-43a7-96f9-f52080c084d8", "value": 3434241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986806, "uuid": "245d071b-0c84-4de2-a329-51fcd9907124", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986806, "uuid": "2fab10d4-3756-40e8-b022-5002be049649", "value": "Orden de compra_N\u00ba060825.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf292a7-6413-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781017134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017134, "uuid": "e877066c-8215-4a24-8dfb-7df2d3d208c6", "comment": "Malware payload", "value": "4b99965e047abae2d7ab6cca57cef743", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017134, "uuid": "8444a728-cf29-4322-aac0-8e66e0cd2c8f", "comment": "Malware payload", "value": "17c1c3ae3f9d515c8fd2bf61490d9e0fc9fe01fc0c539607d705e39202163f30", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017134, "uuid": "16180768-9057-4fa1-ad59-67117d443356", "comment": "Malware payload", "value": "97e3cb980dc6ea270afb20637027d15ec290f63c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017134, "uuid": "0035076a-218b-4fb8-ad59-a59c8035e25e", "comment": "Malware payload", "value": "aaf7a2c151bb7db5920becafc7fd7a9c3d2a03ac862a85c36c0ecfaf99ee966c430f300d9ef43254fdced5fd4742e932", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017134, "uuid": "2bbbc3f1-ef5e-4c41-ad6d-107f9fb86fce", "value": "T172D3AE19A36224FAC15AD13A92D746B2E973F83127216FAE0798CF751FD4C503F2E621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017134, "uuid": "b3c127a4-d34d-42d0-acad-2d2e5e0cfbe5", "value": "c1f4184fc0d8e903ea01b5e3159c8812", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017134, "uuid": "32f35497-8d99-4cbe-9c3c-1a1d6137487a", "value": "3072:aMmNJ06fTMvrB4Wj0fs2D6vaVfOT0L+a:JO0sTMvrOWgka6vaVrLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017134, "uuid": "277fe409-deab-4be0-82b9-0e316985b62e", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017134, "uuid": "560e5f10-b46a-4df6-8eed-9fa5ca7b9da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017134, "uuid": "6b85f202-81d1-46e2-8f58-b1cbc068e1d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668c5380-63ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780973182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973182, "uuid": "9cf5be6b-3154-4c93-b9d1-57802b237e30", "comment": "Malware payload (Mirai)", "value": "606a4703235a4dc9228cf6ed7296ac88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973182, "uuid": "1044937f-c7fb-45c1-ab8d-8d9d807e2412", "comment": "Malware payload (Mirai)", "value": "18179078eeca16606a7a9e5e14696572da558c224d92768b5e03f97b13a8b565", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973182, "uuid": "ec8863a6-d8ea-42c0-a0e9-a3dbfc3e96ae", "comment": "Malware payload (Mirai)", "value": "aba40eee95f326123f2178f4fcd61963dcda64d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973182, "uuid": "52ee8500-d14f-475b-9795-497d934b24fd", "comment": "Malware payload (Mirai)", "value": "ee8937a60ccedc2dab5f8d24e39ef816ac4c512e0922351a5f7781328abc86710f9f13e0affd291a91739d020aafb0e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973182, "uuid": "83d98bf1-5846-4f16-bfde-573f8f569b07", "value": "T176D39349ED68A73DC3E372FEE75902CE333A1B9877E671218E314A953BC8B916435120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973182, "uuid": "cbf1771d-4f54-4353-b37b-fcd530a01c35", "value": "3072:Z1hcuJ3i9qQiNn1bx3qVqyD7Si/v+K3+GiF6jh0JdPMF2:Xv0DuF4AdPMF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780973182, "uuid": "338a7cfb-68c5-477e-bff6-2bfb770f0947", "value": 131344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780973182, "uuid": "bd8e6c0f-8c0c-4327-bf1a-3186176e756a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973182, "uuid": "a4e59b90-a20e-492f-98fc-9d9d7016a49f", "value": "azsxd.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe423aee-63ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781001354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001354, "uuid": "c3bcc161-4624-46fa-bb16-5bef8c788fda", "comment": "Malware payload", "value": "a5d2be0affc2e6d7d16b1fe41aabd205", "object_relation": "md5", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001354, "uuid": "fd2c64da-4300-4f2e-bd2f-227a6a7e52f8", "comment": "Malware payload", "value": "197900a76db912fdd93c08a8a25ba09f8ec64244edcdedd35f021b98f16b0fdd", "object_relation": "sha256", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001354, "uuid": "628dba08-74b1-4482-851e-3af2cdf1a9f6", "comment": "Malware payload", "value": "d4de6fc2524181bbaadec52c2737a45c25bdc007", "object_relation": "sha1", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001354, "uuid": "13bbc02c-e9a9-4e39-9ee5-1959ac7500a1", "comment": "Malware payload", "value": "5769546d607d910e0a0cbf70ed11384107d5c52c3469634cbc51bad55ff49c753efd6682a8fd13cc43edc54e0105cdc8", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001354, "uuid": "462fce7f-3ffb-493e-886a-358d59a4803d", "value": "T1258566BFD02C4AC678AC201768243DBDF81A9208BD9353382F565BDDBAB505DA7E4C35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001354, "uuid": "39315d68-1ab7-4eb3-b6d1-36965d074855", "value": "192:epyhXqiezYqDcbAZMCMD2tlqqDzmAMhpAZ2laXlqmk22WDYlD0rAZ2laXlqmk2sd:eIhaPzY9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001354, "uuid": "f28faac5-2a57-4de7-8663-6bcfffe52957", "value": 1805727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001354, "uuid": "c2ff0076-3ffa-4649-9cde-a5281d71460c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001354, "uuid": "6069d00e-0ff1-4ce7-8a3f-901ec62cbe89", "value": "Faktura Proforma.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d41a8a-63e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780996372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996372, "uuid": "4e39d29c-ae1a-478f-a00a-b4ad74f6637a", "comment": "Malware payload", "value": "14c4332a7b84eca62e87236dcaf72210", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996372, "uuid": "9515e744-12d7-4b2f-81dc-eb45e540bf9e", "comment": "Malware payload", "value": "198830b9014d87a31306ba020ffa37eeb35adf2ed6f90e341f12ebe90fb23f48", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996372, "uuid": "a7c8cac4-1ee2-46ae-846c-162ccce9f2dd", "comment": "Malware payload", "value": "a55e26a23253bbd4a28d33ef26c98e9cff98f7fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996372, "uuid": "883191c4-9310-47ad-b10f-94c8951047ae", "comment": "Malware payload", "value": "3d5d882343f4a3ce4ab705f82b2d32121ab0f290a91300cd0b4af83fe512493711d3bc35609b32fc5f2ebeef8403695f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996372, "uuid": "3a1a7ed8-c94c-4278-a74f-a51c5f1f5d3b", "value": "T19CF6DDA945D13364B25936F90C34AE92413EF8BE465DF187E31BD04EA9F2E30439B663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996372, "uuid": "e86d0040-e2a2-40aa-b139-2006d390f631", "value": "1536:5BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB2:AdDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780996372, "uuid": "317ba280-2163-415a-b2f1-e4dc88c3acf5", "value": 15650546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780996372, "uuid": "127376f0-bfc3-4af8-9dea-368e7d7729fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996372, "uuid": "a2a0e621-48b7-48ba-b5e0-2ab09d49c8ca", "value": "Diamond R Guest Ranch Proposal.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122f2bd1-63d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991079, "uuid": "47f5ec5c-e65b-4706-9d0b-eb68de4ba005", "comment": "Malware payload (Mirai)", "value": "c1718cbbaaf7ef06a21941ea76d8b32a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991079, "uuid": "78584485-4009-4005-8a5d-bad9e5224603", "comment": "Malware payload (Mirai)", "value": "1c4f277a3176ea468a8850b38372daf7cfcd3f44ca77de009af5a2ebbef5a9b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991079, "uuid": "bdd369d2-0829-402a-b869-2c179c3e4a37", "comment": "Malware payload (Mirai)", "value": "59db185743451c72097e2ea367fca0ab4c7842dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991079, "uuid": "947dc1a4-5dd6-47b0-be80-853453229c89", "comment": "Malware payload (Mirai)", "value": "0bb137e997caba19ea2ef6d9ae1ace2c638a8b40460ab5f964dbeb93f5a2ee21a018b074d316c6d39425ca49e8b8b946", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991079, "uuid": "3b69ae81-e7a4-4f7c-91cd-76715c185593", "value": "T12F23F23842C3B459CA002178FAFC4F8BD6F706B481EC6B950D41D6C97BE8462B7B6C0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991079, "uuid": "651e029f-2b5f-4fc5-b140-f849ac78e862", "value": "768:N7Fyo7EaXbT5twKkgsBOmUBW3iAjCE+BMml5y7rmKTiaTbOuZ9q3UEL6:N7F3EaXvbV2BeBWd+E+BMmlFKGamuML6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991079, "uuid": "7cae39f8-2a4f-4b5d-a7f1-b88df8001f7e", "value": 49108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991079, "uuid": "1f09bdee-bf2b-4700-bd37-15a894285a09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991079, "uuid": "b403faab-c985-46cb-a5f5-46a72407b541", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6357c06d-6407-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781011831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011831, "uuid": "c88b237e-3399-41cb-8bb4-f3c4f9947b6f", "comment": "Malware payload (XWorm)", "value": "d2ffa3df3281cd2e7851ad9278b1e0ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011831, "uuid": "43f4d6fe-8acb-4823-8942-4b90197f3aa4", "comment": "Malware payload (XWorm)", "value": "1c76b869dd81eaefa28ccb9124c46eaac76f4399232bfa6065ef6b4ea2751e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011831, "uuid": "e9f7dc9f-4eaa-4cbe-b9a3-9acbdadd3b9d", "comment": "Malware payload (XWorm)", "value": "2c4d58f38aef98872b7b68a39cfd9a4c861085cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011831, "uuid": "b4fedc14-c928-4672-8fb8-46367ea6d660", "comment": "Malware payload (XWorm)", "value": "21b86332f322f4f49a1c8cb82e8aedc3f127ced442ef4f80d98757280c841e35fd1c30544153e3edf3194dbd78baf182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011831, "uuid": "3ce215d0-07c9-4ac9-a8b0-da5b4b7626d9", "value": "T1A3050135AE82AB05C73D5FB9C12A149837F4D44B9763E36F2EEC40F46AB33599A17021", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011831, "uuid": "242778f1-011f-4d39-a82b-694f09b175be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011831, "uuid": "f5284590-c040-4ae8-9c7f-d1d748ac5319", "value": "12288:1hccw9rKXmgyTfZXmHlzyEAtzOj//94cRVDuOIP0Y2HRtpaOJu8GbzuCOVoxza:1hccwpGmgm2YEAZKXu6VSVP0Y2RavW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781011831, "uuid": "cdc5d8ee-9af1-4c9c-ba7e-e88bf8a0b0bc", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781011831, "uuid": "6a526bd9-b300-4016-ac92-d89b4ff2e236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011831, "uuid": "bf3c6d6b-889b-434d-999e-871044d2698c", "value": "COTIZACION DE HEROS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32f1b85-643d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781035266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035266, "uuid": "abcc778d-2470-4194-8ff7-10a92f1994b1", "comment": "Malware payload", "value": "46ec0d0b602e0ba8dade8dcd9a7d83f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035266, "uuid": "2dba998c-3182-45f3-a6db-596f4b92ab7e", "comment": "Malware payload", "value": "1d2bc2b32d1ff5f625d9f33ad537c284bff785ea79d28ace986172b8e3f4e8ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035266, "uuid": "56c5f29f-de3a-47f8-90a2-84a904ecc6a7", "comment": "Malware payload", "value": "5dd59e22dd054f570e97194c52b613d79eb511c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035266, "uuid": "6ded2fad-8680-4834-ba78-5f277bf07c90", "comment": "Malware payload", "value": "2166b6d4bd78df5dd00024196ee7f994b0fb3347bf6698e5a60861a5f55adeed2653401e4e039fb7c342717e066eb007", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035266, "uuid": "a69f6c1b-d48c-4561-9475-6c0ba54b88a3", "value": "T1F6137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035266, "uuid": "5e5aee35-98d6-4aa6-a331-1adeca97ce3e", "value": "768:d4XRWNGxVA9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:6lxHco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035266, "uuid": "26e73bcf-976c-4761-b356-3fa8492323d6", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035266, "uuid": "32b6cb88-edca-498a-b549-feedb84f3e29", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035266, "uuid": "cf857573-4418-4577-9e74-26e934a7df9c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432efab3-6414-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781017361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017361, "uuid": "212ff83b-0e68-4e78-b65f-42a2005b54ea", "comment": "Malware payload (RemusStealer)", "value": "5631d77670ef59454319a2b334238bfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017361, "uuid": "500b655a-89b9-4b36-933f-480c295a90cf", "comment": "Malware payload (RemusStealer)", "value": "1ddbe7b6c1c69c893e6eb7b4e72967d19a0326cf34592be09ca15c9f6564716b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017361, "uuid": "6c399d82-f42e-416a-9958-10c19d20d163", "comment": "Malware payload (RemusStealer)", "value": "f0529377bb6d37d61717f90b6f396f6604338c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017361, "uuid": "cc9faefe-29e5-45f6-b835-a9b67efc3806", "comment": "Malware payload (RemusStealer)", "value": "64c74a6c61be4503416a5abd3607c6c3139cdb16f184e98a9acf218da72de6a6bcff41c713f50c1f9ca9fef5a095ec7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017361, "uuid": "f05d71c1-adac-4657-94d8-f957159863b2", "value": "T1C9367D43B88064B9C5EAF53189A6A191B7317C480F3527C32F51B6BA1F777E05E3A368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017361, "uuid": "8d03fdfd-9e5a-4486-8dc8-78d40ab9ddc4", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017361, "uuid": "7bcea305-7e95-41fa-a37b-351d62004314", "value": "49152:LVo3lrb/TEvO90dL3BmAFd4A64nsfJA91oWYiDzugLDd2gaxD1vgXm:y3GoWNjvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017361, "uuid": "bd7ff893-2961-4eee-b636-4ecdb1a03983", "value": 5084800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017361, "uuid": "1f273a7c-773f-4f62-b901-820a377a2b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017361, "uuid": "79d51301-d7dd-4ea4-90b8-c4be5685d014", "value": "qwe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217602f1-6430-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781029330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029330, "uuid": "7987e5f7-58bb-4388-b769-4349868a1719", "comment": "Malware payload", "value": "95d483032e2520b8d0b3ff233e094877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029330, "uuid": "1b58df52-4c7d-4d71-9860-33cdd1dc64cb", "comment": "Malware payload", "value": "1e3266af96e6337ffa9285abfba7e5227cf231e6c53011399bd755ba70006239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029330, "uuid": "8b51bd05-9c19-4d04-8f4f-f4802ed61f66", "comment": "Malware payload", "value": "5a2be0b5109f4e5c8cbf5fc38d68db3b9df12060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029330, "uuid": "ee9087a2-033d-43f5-ac87-bda1279d103b", "comment": "Malware payload", "value": "0536da7c4c5ba8072cea7b952f6603cffb157ae235b500572d79ac9a3db62bc5df5c63662ba434c8a09ca7c628f683fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029330, "uuid": "f0a2e31f-c7db-4bee-8861-0916df71b601", "value": "T1B4067C07B8A404FED0AA777188E266527F35BC440B3267E31F61BB682E327E15D7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029330, "uuid": "afeb3768-89be-485c-9569-838823c44b91", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029330, "uuid": "d8e80aa1-9a4b-40d8-a443-1ca79cffc573", "value": "49152:VXLDwkFCceXCKI10qVMBw3QBgIOKaebAq5tFFhuoFxcl:VPmguBw3NI9ak5t/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029330, "uuid": "4700af0e-13f0-4652-bf0d-6b1be80ab393", "value": 3899272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029330, "uuid": "83f4f904-d697-42e2-9d11-0775e8b6d3ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029330, "uuid": "ed750353-2aca-44bc-af71-78d7e5e54652", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab167e57-63cb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780986182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986182, "uuid": "46cb7997-8cf7-4134-8da1-a34489f60039", "comment": "Malware payload (RemcosRAT)", "value": "1b03e2633ed1586073f911f40e375320", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986182, "uuid": "25c1efb5-fb2d-4b39-ade0-cfdb9460612b", "comment": "Malware payload (RemcosRAT)", "value": "1ed84ce9d187761f9d504f78e1c6645472d0af2d6c35171c2123ddc219cab4eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986182, "uuid": "05388a29-45ac-44a6-9d88-8e076af65424", "comment": "Malware payload (RemcosRAT)", "value": "313df2fb72e9e904189f12070351a96894188c5e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986182, "uuid": "c56ede52-5343-48ab-9347-c889c4b9d6cd", "comment": "Malware payload (RemcosRAT)", "value": "ef1e0a9437a28710a7904332d9649e98659620e8bf0da16e938ba8d9c51a82f1f82a2422aa743232a0bcde8d9d4d2162", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986182, "uuid": "e6b9750f-7c37-4569-ad80-d077fa2bf426", "value": "T1F6265B17D66F974E180D3B61106A5D9AFE89CAFCEF726BC4E0CF90B610EA1110B851B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986182, "uuid": "5a05b57f-d1c6-4f87-9c0d-60f3df632a91", "value": "49152:Jdzw8VY86nhN4jyYPSyFaezM2MT5pK35TfOmlw3Klmv8H/IZz7yFhaM47Xbklnbt:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986182, "uuid": "094d9fca-c9d1-4e07-84fc-4f9f8841b513", "value": 4614294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986182, "uuid": "cd72befa-236c-46c5-b2e1-d3eef0c84396", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986182, "uuid": "ad378292-0696-4663-abce-8b45041c58c4", "value": "Payment Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fa3d4a-641e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781021711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781021711, "uuid": "347a8d71-a799-4f8f-bc3f-431c181d54b5", "comment": "Malware payload (WannaCry)", "value": "8ad98cf19d561c4cc2de3858ade48732", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781021711, "uuid": "393ff359-e5fd-4135-829a-aef38e1ed6ab", "comment": "Malware payload (WannaCry)", "value": "1efeb45e798ee5a11636079c97935f4a7bd4367f7576109c7a11c907cf4a7904", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781021711, "uuid": "6bb0cf99-2fb0-4426-b166-869c6944e0f2", "comment": "Malware payload (WannaCry)", "value": "4fc4492f244bae727540cc43de031bdb2bb1ecd5", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781021711, "uuid": "296bafc1-9d14-4081-80af-3282a9f44fe8", "comment": "Malware payload (WannaCry)", "value": "04260c28114fbd054533bfdcb09ff5fec6878d4d0f729607a56f4184b99c49b3bdb7b81c5aef09428ad703c341ce332f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781021711, "uuid": "4a8216d4-d14f-4eaa-b2ab-86ce492d1dd4", "value": "T11B363358726CA1FCE0450AB444B38D16F7B37C55A7BA5B0F87C086AB0E13B9BAF90751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781021711, "uuid": "29d563c8-1440-4402-9f35-667bc5facd67", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781021711, "uuid": "70ecd4b7-debd-4038-a5e0-7a819c5d6ca8", "value": "98304:DIDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:DIDqPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781021711, "uuid": "645db2af-c161-4919-b338-c0707ed0d283", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781021711, "uuid": "ef71c178-444e-4ebf-ae70-9a8909d28d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781021711, "uuid": "12eddd7b-a7e5-4dea-a5aa-ecd826f4d0fe", "value": "1efeb45e798ee5a11636079c97935f4a7bd4367f7576109c7a11c907cf4a7904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08093989-6449-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781040025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040025, "uuid": "bc954d4f-cc0b-4428-8bc4-2d5afba23ec1", "comment": "Malware payload", "value": "2553ce39d87b9e0ad58ee44878a09c0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040025, "uuid": "251b3b56-4963-4165-813d-4b7d667b3f5d", "comment": "Malware payload", "value": "1f2b22638ddb587f86f508aaffebc0f0eb1acdbcf783b92260e819d2be9cca2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040025, "uuid": "15fe0ee0-5a59-4eeb-991f-e4c5414ef639", "comment": "Malware payload", "value": "89f5617037af63d3256c65a3038f1e198245f82e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040025, "uuid": "d58e4e00-32c8-4a7a-b06b-23a243381f64", "comment": "Malware payload", "value": "a288bb0f799f33231bb7afda1d7759407dfceef1e39cce2619f8b1a20d7417efbdd65e6190385863ccd5fddbe679ef56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040025, "uuid": "c6ab77b2-ee79-439f-8860-d4f966477b61", "value": "T16E05F0F8AAD0BD35CA256830FD519000C37FB84545BFDD5EA8046E6CF7BA2D40992E9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040025, "uuid": "1cedb9eb-a398-45a3-9322-42119ce4163e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040025, "uuid": "da805de1-cd3c-47e4-8179-9f1c7f54fe56", "value": "24576:yCFW9pz9LqRNJOj7j+mUKbIXaW1JkZaXULkM:hUzhyFKUGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781040025, "uuid": "7f064f77-b512-4942-8678-07c76a202eff", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781040025, "uuid": "9dace5e9-ceaf-42fb-b86a-b2f0584b4e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040025, "uuid": "17d47cac-8f22-412a-afb3-e7b210b71664", "value": "SecuriteInfo.com.BackDoor.Quasar.277.6302.27172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4fd939-643d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035012, "uuid": "d951e63c-8ab0-4c87-9d34-11094c3e352d", "comment": "Malware payload (Mirai)", "value": "493a97d452f37f34f64e2d748dca1f73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035012, "uuid": "d69301a3-ab4c-4050-b257-3400254086de", "comment": "Malware payload (Mirai)", "value": "1fc132a2d8a18b278489d54a8fc82c00a415626fdc375b5018551d6824121a24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035012, "uuid": "7a673f8f-b0b5-4a80-86b6-b3815da0846a", "comment": "Malware payload (Mirai)", "value": "bebf16ac4871abc91485c11a88e898c7e27bf11a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035012, "uuid": "7aca5de4-74fc-4673-a6ab-6f0b7fcaa317", "comment": "Malware payload (Mirai)", "value": "3ac24676a501183c6db478ad20b0921df487e4ad2acb43e20641657a9bea172a7a89a69986e66c125313b3a7ccb942fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035012, "uuid": "db23cd38-e801-4639-90ea-83e821b889b0", "value": "T1F9136AC5EA43E5B1FC6211B6213797238A76E53A153CEB42C7652434EC93A10E72F3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035012, "uuid": "92633b2c-f07d-4ad8-b6be-e543879c19b6", "value": "768:hfIKORD0psZQey18F7THoDPX/FOu4aAwrx8uYSdcI7d:h2RD0psZQeio83FvdlrxYSdci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035012, "uuid": "294b0269-fac2-474e-a902-0fc4f2ca866c", "value": 42092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035012, "uuid": "e3bc8dd2-7b53-4554-b859-b3affaef7112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035012, "uuid": "ed7584f5-61ab-4caf-85f8-1bc45a62fa2b", "value": "godisdead.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a294245-63da-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780992408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992408, "uuid": "0f5b5f09-41f1-4c6f-b052-8e7b93e3bf6b", "comment": "Malware payload (AgentTesla)", "value": "b37cf1ebbdc0868393a4473712df66c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992408, "uuid": "ba8d4743-fb3c-4d75-b98d-3bc9b04554eb", "comment": "Malware payload (AgentTesla)", "value": "2015fd8b81d3e6802d589324983e0005fc0142830aa0afc54c3d50301c8fd085", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992408, "uuid": "689f605a-37e4-4b2a-ba59-50a49bb06b40", "comment": "Malware payload (AgentTesla)", "value": "49de42c21b480882b5f34470d13509d452c320d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992408, "uuid": "b928ec5a-e715-4d8a-8da3-9a5e6d79529a", "comment": "Malware payload (AgentTesla)", "value": "f4db819f1cb37a22ff7cf1f3b499b214eaea8e50b569e4ec70d43a8199abfec0596d3e42cda0e762002c4df0f5e6b934", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992408, "uuid": "966c6921-940b-4f8f-8833-9d78d51c7504", "value": "T17253C7D04CEE24BDE295E67BCC6A4A752CF956A14190848E3313B3A4EC4CDF359B613E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992408, "uuid": "95ab3b0a-93c8-418d-823e-e0e59d4d5203", "value": "1536:z6MC+qdsGKDtVktmqW8QxHaFbT1SETzV2FUN:mtsG+EnXQMyGzV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992408, "uuid": "11d1c0a1-fb5d-426a-bbf7-c869d0a6319f", "value": 62340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992408, "uuid": "36d5384d-672f-4aab-bae4-e5208de47729", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992408, "uuid": "28ab10c5-6030-44dd-8efe-8ec3afc55d00", "value": "Product list, HS Codes & EUR1_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019898b3-63d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991911, "uuid": "d7f08732-ee4e-472e-a008-82f7fe3bde03", "comment": "Malware payload (Mirai)", "value": "890c8831e4455ed91c0831d6890b433d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991911, "uuid": "0b85c48b-cacb-44e2-b418-6b3b5f51a23f", "comment": "Malware payload (Mirai)", "value": "209787c1bb3c7b547537d97ae12eeb519db216d44b6441256f886b742b5676ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991911, "uuid": "e8e89a52-00f9-443b-bc0e-4e7e421122b7", "comment": "Malware payload (Mirai)", "value": "3a408a5e39c336b2881226a919e2321c147082d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991911, "uuid": "292a7dda-58fe-4928-887c-d4789482a6a3", "comment": "Malware payload (Mirai)", "value": "5b036ab5c50198cb97332f9a6131be139b92e2e9000a80f611ff422eae01a4f198ea38c4d7f6f1d75d75e8cc5376654a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991911, "uuid": "2dea9a42-dba1-4556-84e2-b0485596f17c", "value": "T18CD329C7F800DAFAF80AE73648570909B530B7E106915A373263357FED3A1991977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991911, "uuid": "82418e4d-c712-4ddc-877d-c8af7ed42127", "value": "3072:AmW6XIozdwIiEfTUZ8CEDEJVojbiAL8rXGmr3ycdoEvd:AmlSIiEfTUtEDECLyycGOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991911, "uuid": "b09fcd38-a7ae-4d40-b50f-027fb9440228", "value": 136416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991911, "uuid": "4b5f8b8c-8f5e-4841-a876-6de8e344e0ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991911, "uuid": "ee4fcf6f-f39a-4388-8112-88120355f6f5", "value": "CRY.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d68133e-6447-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781039363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039363, "uuid": "04a17875-a3a2-400b-8e3f-66b984704721", "comment": "Malware payload", "value": "9fda1e3ec3d9ff9274eb2f1238ff8165", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039363, "uuid": "c9e36c77-3138-4b07-94dd-2ef4be519656", "comment": "Malware payload", "value": "20fc59931ebc71dc26ae5d776f154ed0aa0d06a4e2c4766b572bdad635400e47", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039363, "uuid": "f01d2ef1-bfac-4ff6-94f6-5735560dd767", "comment": "Malware payload", "value": "aa68982b027a038a53f32dff1e8163bf26c7b950", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039363, "uuid": "2660a6b7-606f-4fa5-ad9d-a903df2ac39f", "comment": "Malware payload", "value": "bc207a3aafb2985f5ef6f2e92e3273f2288ce977f3a77d7f96e61690dfc02ac0cdbc91ce947068827a0b8bee470653c0", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039363, "uuid": "366defe1-cf02-4a36-a94e-bb336cb5a201", "value": "T1C0D6123FB28B653EE07A1A393972A210553BB661A5138C1697F4C88CCF254B11E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039363, "uuid": "c58155e6-7370-4432-a5fe-c4af8c931dec", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039363, "uuid": "d8931681-290e-4fe5-bc85-fea726a43919", "value": "98304:k5/M9dq90X2rnPk7CCjlxYtEhVnj+rjo6ojg:Ah9kqc7nj8kna3o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781039363, "uuid": "195c1d72-cb79-49b4-8419-c6816832e374", "value": 13584362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781039363, "uuid": "3b99e508-aa5d-4ade-81bc-8838137d4389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039363, "uuid": "3920aed7-1532-4fe9-a52d-beba0e1ae353", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbaae6a-6441-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781036679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036679, "uuid": "b5425fa2-f78e-4c48-9bdd-8b11da13c9dc", "comment": "Malware payload (Mirai)", "value": "a67c630e151f6d74dd01754ff9025a7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036679, "uuid": "f2042b9a-16b4-49bc-a58d-3e9b4d5fd60d", "comment": "Malware payload (Mirai)", "value": "215cf9dfee1a314b340dd7c180c8dc880027657599444f70c587182dc923fee4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036679, "uuid": "65186442-c98f-4157-bc36-159ea9da5856", "comment": "Malware payload (Mirai)", "value": "f3d46488fe9772953ffbd5b9220ad70aebd152a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036679, "uuid": "4962bbaa-c9c0-43e2-8fbc-ece4cee9bd9e", "comment": "Malware payload (Mirai)", "value": "46acd6fef2cb1bfc7122996a3f48924dd0e755be2aa0a3720310363c260b4778b02d3ce0a9ec8bbed373c7b4e130aefa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036679, "uuid": "476c7f8d-e910-4860-af55-a6dd3e61c6a7", "value": "T12D057C637711CFA5E315D27008F3C7615AD520A22AF28096A27CC7187E6162E7D6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036679, "uuid": "6d85a70d-119e-417d-80f6-a308b8696f84", "value": "12288:UD29saspLVLhB4si6aJSbD4zOGyseF2XdTJf9ymFAgpDLX7PT3FCq:dCaspLTBTiOD4zOGydF6TJf9ymjrPTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781036679, "uuid": "56f3f4f7-6f84-486a-bc5f-6c2b712a456a", "value": 835816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781036679, "uuid": "7b7c0303-4cbc-4b01-b6e9-3e99f357d70a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036679, "uuid": "18e97e47-191e-4c57-bd1d-7df741fddf1e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea19988-63ee-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781001301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001301, "uuid": "62c30130-ea1b-4a51-9f21-401aae155dc2", "comment": "Malware payload (AgentTesla)", "value": "61ceffba64289834a9f69aa3955e0b02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001301, "uuid": "736f9b6f-048e-40e6-8463-253ed91b30e5", "comment": "Malware payload (AgentTesla)", "value": "22437e5d0e7cdaf45be78e76236a2715e7d30d0cad7db4016685106dddf44595", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001301, "uuid": "35770071-4200-4d45-943e-de64824fe0ae", "comment": "Malware payload (AgentTesla)", "value": "f6456607f27dbc0d22b2e6b0b381f73e49d4bafd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001301, "uuid": "cf7335d9-5669-413a-a314-83d088ad2c20", "comment": "Malware payload (AgentTesla)", "value": "67d7bf3d0e5da07651e869c89a2176d400f119cf16dc4be44d93af2d28007630760a4679c374819827e7419dfee9fa77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001301, "uuid": "5d24f974-2ca4-457c-a4f2-f719a08a4cdb", "value": "T18654DB637EB8D248D198423391B28B0717A9B14F493FC489776AAF3934401DD176EBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001301, "uuid": "e79ff877-08e7-42a5-9fee-a70234f71438", "value": "3072:Sqmqf4MQYsIeTINJE4OHreOJBY4XjKaG5jnTQ45fuWzz:jwLTKaWTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001301, "uuid": "83e02035-0ad9-4b16-b9bb-0affed548e15", "value": 303484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001301, "uuid": "ee33668e-35db-4c0d-9eba-75063bd3c710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001301, "uuid": "43f7c75b-5ddf-4653-94b2-0121b994aa52", "value": "22437e5d0e7cdaf45be78e76236a2715e7d30d0cad7db4016685106dddf44595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ae5837-6444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781038115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781038115, "uuid": "4daa2142-e610-4ec1-8540-0adc30fa7643", "comment": "Malware payload (Mirai)", "value": "22c844ce8cbd12a65b3094bf54f64b75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781038115, "uuid": "ca18953b-b81f-4bcb-93ed-66932d3a9a46", "comment": "Malware payload (Mirai)", "value": "233a0b0b247416afb807bb6b8d056f35b171f0c74f91841ef698288be172cb14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781038115, "uuid": "75c23650-2e46-4e06-9c09-ea26574d764a", "comment": "Malware payload (Mirai)", "value": "c64f901d2067e5663fe796c7e5c61f7fa858b2e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781038115, "uuid": "83df4913-6a3c-4dfa-8b42-3ffba548cbd5", "comment": "Malware payload (Mirai)", "value": "92eb39e13c560cc77c2e6c2145d813a9607ae7b2494591175335b8bef15905e55b4f3b65719d8b397bdf28e0639d5d59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781038115, "uuid": "1476578a-c847-43ff-8963-3beba011722d", "value": "T1DA13F1BC117FD5B2EE93A83BDA69438E2B5F0236C8863390B54780DC5EE4A9B115D703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781038115, "uuid": "32f2c962-7265-468c-bb15-eb7260b224a2", "value": "768:kklYKHpE2po238HMNfNLS17NDJ3MIyucsYqrjntd91GVIFFs3Uozzly:kk+K8rHsU7N+I4sYqrjnJ8VIFIzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781038115, "uuid": "207ccda3-51d2-40b1-928d-a98974b90585", "value": 42904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781038115, "uuid": "069110f2-f658-4f8f-b86b-ccddda449c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781038115, "uuid": "7d694334-f258-41a1-9571-eb308462d8c2", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2218ca93-6430-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781029331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029331, "uuid": "50d0d63e-4f56-4414-a048-1d1b4cc8c667", "comment": "Malware payload", "value": "e39d86eea4e0a5b94f567ced7b0aa178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029331, "uuid": "b252c7ea-a57d-41e4-9309-2d232f939fdc", "comment": "Malware payload", "value": "233a1d50e32b92b6c5741cad0e47f38044b8b7d3202afc9fcf5fe4d55b907042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029331, "uuid": "81f54c55-896e-4725-9ad3-d6b256b65185", "comment": "Malware payload", "value": "8a12a25490476667d03f2db1ae0ee15b50aba027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029331, "uuid": "6f5fbace-5cbc-4b0e-a2fa-b9a7f78253b8", "comment": "Malware payload", "value": "cb31c3794da9d34a7617dbbca0e9710d59517f25e98eb3faa4b4c6df108572c103a1830b6b0e7f81fccef55636164baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029331, "uuid": "980d9e93-5d05-41cd-9a67-638cc4eb0e36", "value": "T1F222F903266151D5CA3B81F9D66B9103DDAA36006BA19FCF5034D8811F31FD6BA7FB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029331, "uuid": "17901f3f-d10a-4006-8c80-feb925983075", "value": "528dabdad7b0f5ec2c1fec3ae3d3b58c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029331, "uuid": "6c9d5c57-d1ea-4a2d-b72d-447c01938501", "value": "192:OQQtF4CpmOT0LvnfdExKozLVhTmCzvbYa:RQtF4CpjUd+KYTmCzTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029331, "uuid": "c59e2aa6-4ee7-4388-ad0c-200df08c540c", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029331, "uuid": "e8fb67cc-eb1b-42e3-a41f-220aa1b956fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029331, "uuid": "cf59318d-0f1e-4124-990b-ad46705fe98e", "value": "e39d86eea4e0a5b94f567ced7b0aa178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93d319b-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985830, "uuid": "14873e04-49b3-4c77-b58a-f63b132e996e", "comment": "Malware payload (ConnectWise)", "value": "fe890b7b3352d9344511b10f397db857", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985830, "uuid": "29b2266a-54b5-4440-8ebc-25ed793cf20d", "comment": "Malware payload (ConnectWise)", "value": "240a5d68dc31d50ffa2fcf6757da69e768f3883f03797791ece74cf06b15a0ea", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985830, "uuid": "8c15f110-3370-41cf-b372-5545d97b2ab4", "comment": "Malware payload (ConnectWise)", "value": "58cf30d3dfce192bf495057a6064bd6e944fbf99", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985830, "uuid": "7cd7ad15-97e2-43bc-ad2d-f3907615e27b", "comment": "Malware payload (ConnectWise)", "value": "511363fc4527226034b3c0a1293da7af2c2aedc119f9f1be5fd84d646c1209b8ab402e70cf8487f99b3edf3f5e27dc73", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985830, "uuid": "942956a6-2027-4977-877c-8b1b62ed8d0a", "value": "T1D7835B53B5E18475E9720D3118B1D9B4993FBE110E648EAB3398423E0F391D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985830, "uuid": "f3c11be9-c837-4efb-9864-6586c9cda93f", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985830, "uuid": "c577fce8-794b-4c8c-b675-bf10e8d90319", "value": "1536:iboFsMHqzISrGqx0WiwbqKHxfd6dldV0OCJRpsWr6cdYV7hsYYYM7a:P9q8tC0C+axfdalBqRfbYRGYYYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985830, "uuid": "8d603937-c443-4608-8298-1c02e3925731", "value": 84208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985830, "uuid": "c9d595f6-2ca7-492c-9a2b-da8077262d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985830, "uuid": "93021e1d-d683-4e1e-b14b-01ee4da97c88", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bff14e7-63f4-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781003524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003524, "uuid": "fce24a0b-a0cd-41d9-bcef-1abc5a7fa7d4", "comment": "Malware payload (ConnectWise)", "value": "05651165905c37994ae7ba2c240ab157", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003524, "uuid": "1de96546-ec25-44bf-90b3-446398b3100c", "comment": "Malware payload (ConnectWise)", "value": "24bc3936ae9054ab66ace68d6b23ca3e8853ebb7239c32651d36c93459d51793", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003524, "uuid": "2f540750-ce72-49a4-98ad-3104fca20b8d", "comment": "Malware payload (ConnectWise)", "value": "1fcd53c701f5f2258d32b79aae10ed5041bea704", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003524, "uuid": "97c8e502-a28d-42b7-958f-5daf3814dbba", "comment": "Malware payload (ConnectWise)", "value": "bca16371c3e8c8fa97671ff132c6992f8ee4fc1c404a1641c2d9115465c8c42b3e328488f7f1b94b56895de9a2ef421d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003524, "uuid": "fca401b6-6f84-49be-9581-7750335b6fc5", "value": "T19B673332EA7B0E5CC062B2F04558F2C7925925699F127EC3ED467CF2283D900A69FB5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003524, "uuid": "48c1c1a7-c260-45cb-9c26-53de58ad8fb5", "value": "f4d1e4cd7416ef83f79f7c6a038875b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003524, "uuid": "f52312d3-95ed-495f-8cd8-f94c70c0e533", "value": "786432:8B7mPC3QJyXqHaLT1YdInh+YnYCQB88ExpHWX13E:8B7GHGqOTydSzgB88EbHWXlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003524, "uuid": "de8c8d21-8e5f-48a8-bba5-f1bf10a30896", "value": 31648896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003524, "uuid": "2cd5c62b-62fa-4e56-93e5-08e83085b70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003524, "uuid": "10c72062-7565-45a1-ab31-8176d367af61", "value": "DocuSign_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67049a02-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780979625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979625, "uuid": "5245e219-c81a-4ebe-847b-7023a2c69b63", "comment": "Malware payload (Mirai)", "value": "bc24164497cb3d7c3fb70b3d5c29868c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979625, "uuid": "46d90513-b271-4849-a299-aa06f9f16a11", "comment": "Malware payload (Mirai)", "value": "25f76ee983f1db74229321e36a62323007d5777c1cfd9350c80b58aef874355c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979625, "uuid": "e5e1f847-91ee-425f-88f5-ce5a5214ada8", "comment": "Malware payload (Mirai)", "value": "11c495254826db27163e2f3840536ec1355be946", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979625, "uuid": "44049ae3-fee6-4971-a7ff-856ec50f7b9d", "comment": "Malware payload (Mirai)", "value": "40117f4c453394f04b4162ecc92a4273f95e8199c51a1725cf8c0582453c37fc9b62d27dc9a8d806b0329b626732791b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979625, "uuid": "080b1ce8-2e9a-4bab-a035-5a1589ac9cbc", "value": "T11C330994BD819A17C9C456B7FF0E43897B26639CE2DE33039E25AF24378B92B0D67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979625, "uuid": "4f6d31e0-8d99-4feb-ba4d-728eba540b84", "value": "768:CaZyLx+249sY2pt+GrMsG+Lk8qMYMTKAHcgm4e32deJa71/vbwpnKI:rZasr9hUrh9L3bTKA8MQ2de47xOnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979625, "uuid": "7d7c5309-7bf0-443f-8dc9-4365ee99830d", "value": 50524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979625, "uuid": "b98133e7-ed4b-451e-a015-936714954c94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979625, "uuid": "7ccc134f-1710-4958-8c1f-4da40ed7c613", "value": "5.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35e5acf-6427-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781025817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025817, "uuid": "9ba5999e-97cd-4465-8615-1b0eaa98fe81", "comment": "Malware payload", "value": "a32b6c34700aa583beba68aba55d1add", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025817, "uuid": "4bedd0a8-1d52-41ff-8c6f-e7eaf89b5e03", "comment": "Malware payload", "value": "27228e152cf1ff82532586f91d6be1c8bf1fefdc571b09eaa4953c02e53aa6ad", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025817, "uuid": "be6fc296-475b-4d88-83f0-e3d9da161b35", "comment": "Malware payload", "value": "14f0b537e6957d390c049e9bb35451a5945719e5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025817, "uuid": "a20df82b-f0ba-4462-8a55-bd181ab1c312", "comment": "Malware payload", "value": "6949a128f02085bf30b77b5f12bc574623533297bf7c4a9fb5abad3c78d68633bb035e7d108e0693265267602512810b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025817, "uuid": "1e7071fe-70b7-422c-a3c0-fbbc46eefa86", "value": "T17382B729F406206186B3B77ACE975008FB37002B450B529CBA7CD2947F716F9C7A5FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025817, "uuid": "c6b1d137-d04c-4295-b0c9-754e54faf285", "value": "384:0Jy5Ep706FhwXpYylPi923084ajCD8MWsqvJnDT23NgumlHqW8AAb4fmV/lreHEU:0d1xFLKq98VZz28Vh2KEVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781025817, "uuid": "051054d3-e1ef-4765-add0-0d3f3f70a67c", "value": 18987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781025817, "uuid": "8ebe78ad-85fd-494b-bdb6-36b66b3d1586", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025817, "uuid": "f74db013-c903-4a09-8229-7b1dfd817a74", "value": "svc_8xmlhr.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e9efc2-63cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780986710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986710, "uuid": "050fac35-c8c5-4c38-abb5-f0744eefc400", "comment": "Malware payload (Gafgyt)", "value": "268c9f10abf479eaa32f2d6fca94d2df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986710, "uuid": "4f5212b1-8066-495c-a9d7-e638b3f1eaba", "comment": "Malware payload (Gafgyt)", "value": "28531e18586a06d7ed043bcc740320f7d32a4ab3ba95850fe98abbb4388fde68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986710, "uuid": "704b20b5-d046-4571-a2fe-dd6b702fb1e2", "comment": "Malware payload (Gafgyt)", "value": "4b94fb32dc1554fed00ef69b9eb7cce3d00b5d21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986710, "uuid": "3d07ec02-b63d-4541-8485-3844f0a44122", "comment": "Malware payload (Gafgyt)", "value": "5fb874a24ecb1041164bec674df59873118804e20ab9acbdd65a5806ce51c43c84fb7e86ea04a996caaa71a687a915a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986710, "uuid": "01a8b9c6-79b5-4b74-8f37-e15e4b1adde7", "value": "T1E5549734AC16D313C0E3FFB9EFE9668AE719E7C64B8662036160117D1EF1A59581FC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986710, "uuid": "08b96a9e-e7cc-424c-85ef-5c247a16b061", "value": "6144:srWoaHcv72ogsCLJCca5Ke+jMM/9hmjw4Cb5Ge:sKoa8v72oryJCckKpN/vmjjCb5Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986710, "uuid": "4275b6e0-d203-4e10-801b-17b4bc52f3de", "value": 299425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986710, "uuid": "f5df934b-2718-47bc-863a-4d38f5261cd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986710, "uuid": "ae5d3cff-ba21-4bcd-9382-116e15054189", "value": "dissarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47756a0-6416-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1781018437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018437, "uuid": "e327b510-7d04-43f0-9ce1-87899bd2a15f", "comment": "Malware payload (CountLoader)", "value": "72a04dd1bd445564c769ca5e1eb291f0", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vdsina-vg", "colour": "#3B65A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018437, "uuid": "8dde3acf-1368-4aaa-90a0-89eb62c9d0b6", "comment": "Malware payload (CountLoader)", "value": "286e41a4a73bb6855027eaef518f4f47fdcbbb211bbdc5900e2561ececeaaf09", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vdsina-vg", "colour": "#3B65A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018437, "uuid": "a4a5d8bb-ce13-4476-aed7-9053a457b9bd", "comment": "Malware payload (CountLoader)", "value": "ce49edbd19ee24825c8cbf040c46149039020efe", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vdsina-vg", "colour": "#3B65A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018437, "uuid": "b3aa8ec2-1f7a-4e9c-b4cf-726125331479", "comment": "Malware payload (CountLoader)", "value": "97233ca73e25faae011dcd237b7a4e5efa1d7023ae46a44e445e8c41d8ded476b31f0e4e8a47434621f4c51e6669b06e", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vdsina-vg", "colour": "#3B65A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018437, "uuid": "f14bd4a3-eedc-4f90-ad8f-50f0c0b16454", "value": "T1234455A047E2097AA52E1836772BA71026F37C332C6CD5A0793E53C92F7E59153B8ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018437, "uuid": "7d6fdd57-408a-4694-b84d-55eebd28f6a1", "value": "1536:VCwRivYxZd2hpHRztttZMkH75YQpmjFtV5lA4BivWumEErdRho9Y7GB9ZbV7wLxU:IRp0FhKWHW5wLx0l0Ew14v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781018437, "uuid": "f4ad7680-c4a1-4fcf-ab45-e26d39cd9b1d", "value": 269056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781018437, "uuid": "6e8c40d6-9d4e-46f3-86a6-ccce61af5ffb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018437, "uuid": "abbb62ae-66f1-428c-b0ec-d12c097e9236", "value": "User_Audio_Backup_5550.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b76cdb-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780979627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979627, "uuid": "9367303c-7fc6-453e-a727-15a2e4e9f861", "comment": "Malware payload", "value": "3ad93e6bf581f150c89cb1c6b11a009e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979627, "uuid": "785129ba-ad9a-440c-ab79-96673161777e", "comment": "Malware payload", "value": "295921ae7b3942e80a19cdd3b6473803d2377f3647db582ce79260973dad2f06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979627, "uuid": "9d096e53-936e-4b32-886a-12ddfa729e08", "comment": "Malware payload", "value": "947a6ad489e4a8a2f7407047209e99fb8965c3ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979627, "uuid": "31649d8d-b381-402c-b65b-ac7b3866ffc0", "comment": "Malware payload", "value": "9407b2039f9c791599e18fbea11d73293ab94feb3b5d89167adcad8aa26eb21167a3aabe2fa9ab2f782ea013b70c87f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979627, "uuid": "f8cb790e-cbbc-47d9-b297-ff0a529c8987", "value": "T139331B41B71C0443D1732EB0363B1BD0E3ABEA9122A4E389751FEA49E175E339586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979627, "uuid": "a19d0c2e-1c11-45b7-98dc-34dd1881fd03", "value": "768:zXuhWf/SAoHFUGrWhcL9WSTJHjSueBPl3x0FObtRBrEeIy:6SgHm5h4WyJDBeFlBjbr6eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979627, "uuid": "48ab2cf3-8be6-4ba3-bdf3-d5d333aef8e5", "value": 50624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979627, "uuid": "3aa01601-3e42-48b1-aab7-447e48177be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979627, "uuid": "63db2d64-bd36-4c3c-bce0-8e9427c7fe66", "value": "8.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b064d025-6414-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781017544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017544, "uuid": "083cd683-5725-45b9-ad9e-9cc3ee4c76d6", "comment": "Malware payload (ACRStealer)", "value": "9f4e675383fd95126de3c80f06aaf098", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017544, "uuid": "09ec58fb-ef96-4d8d-8b8b-766358e274e7", "comment": "Malware payload (ACRStealer)", "value": "298604c42121409272567e333eaf2de261248a693716838085b043de61c56228", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017544, "uuid": "74c5c9c9-9ea4-4ae9-bbe0-91f50b8e524d", "comment": "Malware payload (ACRStealer)", "value": "2ca3e29fff91e630673ef2fd27d313cf7ba32f02", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017544, "uuid": "4d1e00ed-88d6-40b2-baa9-772906ccc192", "comment": "Malware payload (ACRStealer)", "value": "7516483a1982fc2f107231b82ce7cb20a16fa6115d167c54ccd122606e093c01e1c48ae3db295063c5479fd97f119e96", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017544, "uuid": "6cf7f8c8-f4b2-4b3c-b88f-06bcda278044", "value": "T120C47D5A629C43F8E1A7E17889864506F7B67846132197CF03F04AAB2F276E15F3F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017544, "uuid": "9e18e1ee-7b50-40c3-8700-d6f7dcdb42e9", "value": "f3f32283e0dcecf9dadc9ab1b83e90eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017544, "uuid": "d6945b47-48ac-4d88-b5e3-45f5fb8f504f", "value": "12288:INI7Xcb2O1VNNDbBeVfbU1xbbX/jguW/pAeC:GI7MhVWur/jgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017544, "uuid": "3bb99530-602b-4a49-9d59-3fa881c18d0f", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017544, "uuid": "1dd4f0a7-4e29-42d9-b572-57a4e2384e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017544, "uuid": "1c5eab92-52f9-46c4-9530-497afde125ea", "value": "h9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a30ac6-642f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781029019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029019, "uuid": "cef373de-9b69-4d12-977f-092977d7ce58", "comment": "Malware payload (PureLogsStealer)", "value": "b39f073eb2323c06f47667a233751c6a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029019, "uuid": "20abcf2e-0a41-4f40-a927-a62bae0a1165", "comment": "Malware payload (PureLogsStealer)", "value": "29bf57b2183e4c3a23fe2703361ac2fe8980be762c43924a5129176188c8192b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029019, "uuid": "cd07d71b-0454-4347-be17-9d5bb83b3e70", "comment": "Malware payload (PureLogsStealer)", "value": "f38a939977364287d3394d27be5a7767c06fdd79", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029019, "uuid": "bf6931f4-da15-4f54-b4ce-4e9a2a889533", "comment": "Malware payload (PureLogsStealer)", "value": "d2f7646d110f96c7f4cdf77b4c64c6917b8225b1c351b9f8070a449106ed966f65b9b4bc0ec4cc33d1dcd12c7d6d707e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029019, "uuid": "778afd4f-00ae-4486-a737-ed3c72bc98bd", "value": "T1F4157F515BFA21CCFAFB4F5CAEB810455836FD2A2D1AD2AD12444E9E0672E40CDB1B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029019, "uuid": "2cf5b8b0-01d4-44d9-bfd4-54eafee76d22", "value": "3072:OoMREB/V1k3H1kxlByYoaB7Tk50zLkP9bd/3iMqa8+29AIv5fzZ2TmVaTtf6Fbu3:qEB902DBHzYVMXO+bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029019, "uuid": "d94e7f31-3838-4e00-b669-1ba7c4e8e9f5", "value": 954144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029019, "uuid": "5987203d-e4ad-4d62-bc48-137d5709248f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029019, "uuid": "9fa25d10-5367-4040-857e-3ee283d47287", "value": "Sales Order & Order Confrimation AVR 3000138525 - 0071-64-EL-Q _pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb92cf2-6443-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781037696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037696, "uuid": "ad83fba7-63f4-4fc5-8fd7-fecb570abc22", "comment": "Malware payload (Mirai)", "value": "26413217f10fc5d11471256e29e66418", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037696, "uuid": "c9f139f1-2c9c-4f18-8213-3cdaf0e317be", "comment": "Malware payload (Mirai)", "value": "2b3da2d3fff55bcf854a406c0ffeaa8c3990da5dcf97c9037fae8082e5cc9a9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037696, "uuid": "289fe5a2-7449-45f8-b30c-2ee7b603a609", "comment": "Malware payload (Mirai)", "value": "bdee2348f9a5b3a01c06795f6afaeafe7f3d4e8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037696, "uuid": "5edef9c2-6f02-4e43-92cf-f0e89013dc94", "comment": "Malware payload (Mirai)", "value": "71c3d84afa589dff283264e6b93476a0d37afef8b68e755d94718de5bd875547404bc1c23872a8035a9305e22638743c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037696, "uuid": "bacf67c6-32e5-4643-ad65-56f3d2f7331a", "value": "T126141945FC915E13C6D522BBFA5E428D372A13A8D2EE3102DD225F25378B96F0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037696, "uuid": "caa6f71b-ad55-41d4-ab71-9c721d84eede", "value": "6144:0Y4W2zwVNZ24l8auFMRtWb4c3oxAuFjq8xs:0Y4RzwVNZ288auaOb4j6uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781037696, "uuid": "1c9ebf18-7c38-49d5-a0fb-af10daa9342f", "value": 202816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781037696, "uuid": "eb6e3d14-6d46-4be6-be3a-8f31a1540e79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037696, "uuid": "2389304e-fd9d-4ac1-8797-39ee8c30c963", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f202605-6412-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781016468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016468, "uuid": "5dcdbb83-c8dc-4a02-b690-1c9545291773", "comment": "Malware payload", "value": "b761bf7fc2194f00d6fe0eeb07d53fbc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016468, "uuid": "f0291587-7326-45c8-a315-445312fc78a2", "comment": "Malware payload", "value": "2c69daf837b446ab8ea41d0aba93ad027003cc51f7e5e630a159fd9ee25cf81e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016468, "uuid": "16ea5670-d3fc-4f6e-bd10-4beea0007423", "comment": "Malware payload", "value": "67dbc5fa5d939c55b7f87d67e9e55caa802cbee8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016468, "uuid": "3c4aa661-d471-49d4-a469-8c24d3acc5b9", "comment": "Malware payload", "value": "1bbb361e3b81a310fa2e9217e907d4f2d08e6ada72e6273fb855f799b9fb6c9741bae940a82288dcf84b82407f08a3eb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016468, "uuid": "461a8c47-b14f-44ca-94ab-e56864ab18aa", "value": "T18C44239734781172DC09A6FD0C1C64603BEAA330AD16ED9791A08BF2DB7E420F7BD596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016468, "uuid": "4afd95ad-e39e-4274-9bb1-5c2c9d1bb0e9", "value": "6144:Xl84/L1KN1oZmCCFUPvkRbBEZZtR5odnhgHG3e6WT3UWfbl:VL/L1KNWBjPveEZrRiR0T3vbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016468, "uuid": "08418948-3527-47da-a3e2-afeb9358f461", "value": 271512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016468, "uuid": "fb55ce60-db55-47c8-bc42-1063fc44d090", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016468, "uuid": "1e4c9e40-2257-4260-8431-6dbf5db24d2b", "value": "Conference_invitation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25617e8-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781016742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016742, "uuid": "083e2908-1ad4-415f-a4dc-b1b1afdd20f4", "comment": "Malware payload (ACRStealer)", "value": "dd5b1f3b2cf0640a30cf1389602d851d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016742, "uuid": "eb455fba-8200-4be7-9061-f86e9d9ef601", "comment": "Malware payload (ACRStealer)", "value": "2e9a39cbff31737dcb693cc7ca3ef6c474c59926f68e1fd4518e6a2b345f3892", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016742, "uuid": "5f7821ce-1552-400f-9bfd-d11f94b8a4c7", "comment": "Malware payload (ACRStealer)", "value": "7d4a31917649b03d7954adc4e09197176e21e40a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016742, "uuid": "d07848f1-ccaf-449c-ae49-32b2e7d22ee7", "comment": "Malware payload (ACRStealer)", "value": "03174f8ad0676a04c0c9e462178e63f4d840dda812ec16a6157bfbfe292894fdb6c301ac542957a1272d04d09795731e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016742, "uuid": "c7a28bac-8987-40d3-a3b0-1e7632faee1f", "value": "T125C55B46BCE009EDC59A633288F12696BB24BC490F3617C72FA1BB782E76BD41C71754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016742, "uuid": "af122f24-0a78-4f8a-9bb6-68feacc74c7d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016742, "uuid": "303e3a9f-8f21-4128-88d4-c2dfd18ada7e", "value": "24576:jdtlc7nihyDiuzCUjHVwB5D3DuVOh3ETgRjtBMkS3JzseFj/nBele7tKDyi/XhC:jdLc7ihczHj1wTzDuVFTgRjHeF1n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016742, "uuid": "47dc2a3e-5500-4d8b-9808-d3141334cff3", "value": 2729096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016742, "uuid": "48b71f2d-99ca-45f6-b1b6-6874ad5d38c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016742, "uuid": "9feaad8b-d571-45f9-b974-59542b555761", "value": "bjbh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ce6243-63ed-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1781000534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000534, "uuid": "94770ce4-a9bc-487b-8aa6-63adcb752b19", "comment": "Malware payload (Phorpiex)", "value": "74cc4cdff7fe07daf995e83a3c494be7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000534, "uuid": "ea715e48-9c66-4ad2-ad49-80af7f415247", "comment": "Malware payload (Phorpiex)", "value": "3006d572f747097bc02341c50ddcdad972d8539509fbf085b5024c6c04cb67e3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000534, "uuid": "2f30b81a-0044-47f7-8977-44ada3d0570c", "comment": "Malware payload (Phorpiex)", "value": "5ae28ec63ce1956374bb10b458c7038d8e69ca58", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000534, "uuid": "70276e27-56e6-40fe-ba9c-7c37d629ffdf", "comment": "Malware payload (Phorpiex)", "value": "2cc7c97f49c1eff5eccf4538bfae5ce64014fc96bdddef5e0e10a7d0ba85efd325029142cc70211d831da88084fd72a8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000534, "uuid": "e4ef1a6f-0a85-4ab5-b6e5-718a36e4f867", "value": "T12DB38E1030C1C432E566117988AAC7B98A6EF8710F756BD7FFC406AD8F366D19A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000534, "uuid": "cb4ef02b-cbe9-4430-a76f-a0731e7d49ef", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000534, "uuid": "c7e3f032-9fc7-46e5-8e68-ff08106184e3", "value": "1536:njKtSmJd7d52Dr59gzmkVa8S9rL2sFTfEcvSn0Mv3fx/h5Km26E8Yj29:jKtS2d6oS8S1LFTfHm3fx/h5Kmuzj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781000534, "uuid": "2481f106-4971-4a36-9d9f-5790ce91f35c", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781000534, "uuid": "5387c63a-af7e-48eb-b909-885fcf8926dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000534, "uuid": "e2dca395-b6a4-4ff7-8d57-65d35726c9d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6641c215-63c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780983490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780983490, "uuid": "a0846a86-fd00-41c7-b86f-fa12984814a3", "comment": "Malware payload (Mirai)", "value": "44dd97d52d837e7256daed26f7de2ea8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780983490, "uuid": "e71a3fe6-2a70-4c81-baa3-465877453f8e", "comment": "Malware payload (Mirai)", "value": "31ea35f2b8454bae573a42fc19fd6923b8e12aeae32eb8002d51329451fad838", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780983490, "uuid": "04771e34-da4e-47b5-950a-227f2d9b05fe", "comment": "Malware payload (Mirai)", "value": "a9ef738af1f515b1bd374df700fc7f16c40af669", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780983490, "uuid": "54d22475-9c71-46af-a9e9-bb943b10459c", "comment": "Malware payload (Mirai)", "value": "683cb867f3c36ce3ee3d5384435ef3abfaa632420402c9b968a515d2cbde8e718482e397339b38ffee91523ca5ed1078", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780983490, "uuid": "174123b4-d7d1-48b1-91bf-975235928a43", "value": "T1DB21618E011AE6BC4A999D2F31520104764AC5EA6593AB07ECBCDE775884D847204FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780983490, "uuid": "16005106-bc98-46ed-bd3f-890169c21197", "value": "12:6FGEzrztr90gXMEllOZ5VEmOz7GzzDGAIffD9dWgYX/AolOpU/ZbBvzVsAzu7D:+GE78yguRACogpUuASH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780983490, "uuid": "f516fbe5-ca10-47f7-93c9-c705d047b5dd", "value": 1234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780983490, "uuid": "14988170-9331-4d06-9f0b-2948e815905d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780983490, "uuid": "63b6f339-bb8e-441d-810a-738ebfab5a9d", "value": "ohshisss.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994a372d-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780979710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979710, "uuid": "dcf67e16-0f45-4f27-8d01-34cdb369332b", "comment": "Malware payload (Mirai)", "value": "56a3c76d9d46f6a0c85817f38d6fb36c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979710, "uuid": "1dd97288-5332-401f-9911-fb342ccf636e", "comment": "Malware payload (Mirai)", "value": "32851f6c31af66742f12832df3947cc30326fbc15ada833f789f89e154f55b62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979710, "uuid": "381f325a-5ae4-41b4-83b8-6a0ecd74381d", "comment": "Malware payload (Mirai)", "value": "43b1b0d69542e5c9a463f7923a0da9ac4167f2aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979710, "uuid": "03d2d885-fd6f-4361-bb65-8089c5eea0fb", "comment": "Malware payload (Mirai)", "value": "54c46db9c738de984e5f63bc1028a31525e1c93da1d17b0570661888c449e78850891aaa1e7108579f01fb8058a431a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979710, "uuid": "65a7bf13-04d0-436e-b727-b5874c1e2df8", "value": "T1F013518CF869673FC3E273FEEB9952CE323A17D8678B7626C635425537C8314A825910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979710, "uuid": "04821ffb-e5db-42cb-b0b3-fb9853e41bbe", "value": "768:7sJZSH6wZ3wGwz6umOHbTD8URzEB67jkcvqHHHHQ/q:74SHbr4F5XDxpEU8Sqnw/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979710, "uuid": "ec0650f3-4082-4867-8d2e-d2942b905185", "value": 43055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979710, "uuid": "4569d9a7-8e52-4452-a972-54721c71305c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979710, "uuid": "9ffb623a-ba4e-42ad-91af-7bb07c6f3746", "value": "7.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70373fef-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781016578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016578, "uuid": "43009445-ab04-426c-9063-15e15e77acda", "comment": "Malware payload (Mirai)", "value": "04bb8e7e54d5e1df5fa0716e31d686fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016578, "uuid": "9e45baf8-b7bd-460a-b61f-b66811a68131", "comment": "Malware payload (Mirai)", "value": "32d136f34846b6e5545c894791bf0a72cb9c11082ae58ee690c6702e34aba2f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016578, "uuid": "5299daf1-009c-45ff-8c40-e444a7b261b6", "comment": "Malware payload (Mirai)", "value": "9cddd4036e92efce02021102e5e01e9b47b67470", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016578, "uuid": "02db346f-7e63-47a6-abe3-89f80a8d5918", "comment": "Malware payload (Mirai)", "value": "dd2ee2bdedaceec4a4f5175fd66c5866f681438235132eab805f6644ceb101887d3d277fad81fdaa120099c562396183", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016578, "uuid": "fc5abaa1-678f-4121-af86-bc60c6852941", "value": "T1F2F35C22B8791A1BC9C4B57E12E34332F2F5574A24BC8A0D7DB10D8DBF2578026577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016578, "uuid": "f0605d16-ff25-4b73-8c40-4fd699937d7f", "value": "3072:R+p4F/w5ju6IRgR6R3k4dyJTooQfRmhCBkyP:RdF/wkzR53sqLfRoYkyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016578, "uuid": "48a66f29-2ebc-444c-8f40-d1671ef5acc1", "value": 158616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016578, "uuid": "b42c3d25-bd5e-4ed8-976e-81ba5d32025b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016578, "uuid": "9c473f04-dfb5-42c9-b4c1-23e36a6eab1c", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d23a6f-63d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780989201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989201, "uuid": "e9446f1b-e417-4da2-9e82-a3ff45e39588", "comment": "Malware payload", "value": "de9010ceab61464f25d368eec4a878cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989201, "uuid": "1c857821-2016-4a44-9cdf-7f10fb79041e", "comment": "Malware payload", "value": "33293f7fc8b24820a95bac9bec9a33c7a169cfaafbf5183395f17a362cdcf1ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989201, "uuid": "5343d13b-f404-4d3c-b3f9-10bf5f5df013", "comment": "Malware payload", "value": "9f16923373c72ea6b8e9bf9cbe4484f42bd5d282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989201, "uuid": "2465b01b-09b0-4eee-976e-032c0a772498", "comment": "Malware payload", "value": "03f40d0daa67ee09a0642d0bff1b909ee8b3c5cbbd64bdb8d121302b3e69388b8d18033c8a76db3263d510bfe8d0723c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989201, "uuid": "b02a24e1-d566-48f9-983b-2da102def0e0", "value": "T133B22A06D7B301BCC49DCAB1C26751036AFE380B1B90BAEF67A12A2C7D707D46539E65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989201, "uuid": "d891f107-ce04-4f06-989c-3989eb401f94", "value": "50dbb2e4ba4c1d0f3b238539dbdcaca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989201, "uuid": "232ccd16-e010-4fd1-937a-39ce23e76390", "value": "384:tDK7zSsF+zgguJBGxwK4g6VU7fsvPtUxvwgLxIzY9DIXiQlTRrfu+jC8ZYqAAAAI:NK7zSNzgguJBwwbTWkvPtoLLxFRU5fVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780989201, "uuid": "b83e4c23-331b-45f0-9888-3922854a2989", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780989201, "uuid": "ee4c974f-dd5d-4dad-9419-68fa3f31e86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989201, "uuid": "378585c0-20c9-45de-86a3-84a49e774561", "value": "KG_20260806520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0a43d7-63d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780990960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990960, "uuid": "bd74a8fc-056e-4f9a-8690-b032cfb58a27", "comment": "Malware payload (Mirai)", "value": "e3fa7b4cf44f573c79d88a06a8bee207", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990960, "uuid": "849dd350-3fa9-4b01-97b7-a71c93feed79", "comment": "Malware payload (Mirai)", "value": "33681bbe7ca8c6706e99025c58216e58e99ceb75a3affbafcef4b6542d2f1c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990960, "uuid": "846373c4-3bd3-4588-9aef-62de7dfac078", "comment": "Malware payload (Mirai)", "value": "f6bf8320d4ceee923437fe0e2b60cd7b79b11833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990960, "uuid": "bc116d3d-2d68-4012-aba2-facd89d999aa", "comment": "Malware payload (Mirai)", "value": "b3119263dfcd46e0f7ae67fd31d72c160faca26abed3835397d54fb1122e3c695473afe1ac08765bd74600a1f03df961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990960, "uuid": "19519121-8f10-40cd-9031-fda36b4f799e", "value": "T1D1F3080AAF610FF7E8ABDD7703E90B0229CCB95725B53B797534E918B50A18B09D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990960, "uuid": "98e74734-9c62-49be-891a-6eb556e0e55a", "value": "1536:d8dJRiZ95AwWK5dJt5WdP/PwAjvt5Jo037NaaOEOy+ZDZY1grDVG9ZHrRik7V8oa:aU9D5dT5QfbtUTy12s9VRiSEUOyI+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780990960, "uuid": "a87f13eb-3702-4389-9658-8b0b3c0cedb1", "value": 162208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780990960, "uuid": "512fe310-217c-4a69-b509-2b955865cda5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990960, "uuid": "5b4b41e5-aaa8-4502-be02-dd1461e486ea", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9d139e-63f4-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781003554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003554, "uuid": "821be508-58d7-4a67-b6eb-9dced21f17f8", "comment": "Malware payload (CoinMiner)", "value": "6505ef77a3bea90ab11738c95531aa3b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003554, "uuid": "306c5c04-913d-418f-b4d5-041ac29574b6", "comment": "Malware payload (CoinMiner)", "value": "33f33aaad09da262eb33c93e4a874bc9b0d643abeaf0947a6e516a89005c8943", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003554, "uuid": "de18f24a-b9e4-442c-be67-59dfda027b11", "comment": "Malware payload (CoinMiner)", "value": "0c7ad092f6329b29beb0687c3320facc9ab3436e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003554, "uuid": "ec1d98a0-e1a3-48fd-a707-1fc2cff93e73", "comment": "Malware payload (CoinMiner)", "value": "1df2713a7b7ba9996b32c2c750a16cc8f6a68cfed5e03aca56b9880be977cab573169068a54e80c29968b5db04df8a51", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003554, "uuid": "2ff4aa02-ed1a-448c-8769-9e30cb5533d6", "value": "T16595F93AFD02DEB6A75FD8A1858A2CCC0D8C365385982CC5F7E80B9D0C99FDC5D952A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003554, "uuid": "646097ad-9ad3-4563-b112-a5eeb59159e6", "value": "12288:xi1U0PD1z2udvJoWG727sQW0XdYiizzO7rfYpyX2vYqk+k8hqTzmB/nmhTEPQtZi:mU0PD5HoX7hQX2Q3g+GP+61ItrfKlOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003554, "uuid": "99c78660-83e4-4a42-93c7-dd76ff02dbf4", "value": 1890435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003554, "uuid": "0a0afd40-8214-4caa-a012-6f3cb1b22a81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003554, "uuid": "3afce150-44e7-4414-b24c-eb1e8f6cc324", "value": "networke.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e4979c-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780979622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979622, "uuid": "d0e8421d-d6b6-48c8-a543-005ebe31d18b", "comment": "Malware payload", "value": "a39eb70c21368302183bcdea3c26e48b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979622, "uuid": "4fe5e44d-1fc2-46d7-bdb0-1583c67b4117", "comment": "Malware payload", "value": "348e58c00e1baa5d6bac4227d98669778507661fa2dd409ba7d73351c8774b99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979622, "uuid": "e2eaf16b-9784-442b-84e0-0de0055260b7", "comment": "Malware payload", "value": "0a0370ebbf2da52dcfa3d6d7d963ece0a79357e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979622, "uuid": "fb0dd088-7869-437c-a0d9-245ba4248adf", "comment": "Malware payload", "value": "31be67aded26056b1c8b7fd44e1b572a9fc698c3aba3da155f124f9bcc3fb36dcf30c22b5ad6ecf9feaa1098838e781b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979622, "uuid": "bf2f0998-bb1b-4817-9ab3-194d2cbfda3c", "value": "T12563B65A2E218FEDF76CC73447B74E2167A923C622E1D784D29CE5001FA034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979622, "uuid": "19c2b0c5-f6c6-4570-98a9-022f621f6128", "value": "1536:exZwvHy+gl35RWwJIA43QTXVneFknUilF:YCPq35IwW3QTXznUilF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979622, "uuid": "efac501b-9d53-4e3d-8a20-a46f60870ace", "value": 68416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979622, "uuid": "cf1de1c1-9606-4e00-840c-3aa0249e5e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979622, "uuid": "b0f004bc-c1b8-4b2c-b792-6b81faf256d2", "value": "2.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93bfe10-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "29a86665-afc8-4c84-a93f-64cc5395885e", "comment": "Malware payload (Mirai)", "value": "e7dac849e1a400828c5cbb6511111483", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "52060c5d-b5ab-44ff-ac40-c5ea83d218ae", "comment": "Malware payload (Mirai)", "value": "349c4975ed4d93398fea2489d43e8e709399e7f4b3ea3476a3c412d581a803f0", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "cdc7966e-0320-4254-a1d8-cec156592900", "comment": "Malware payload (Mirai)", "value": "cea419cdf494a8e53741a007e099ad9f6e53c569", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "72b5c0c0-26fa-4461-98f5-aa47e3a09626", "comment": "Malware payload (Mirai)", "value": "dd54f2ee8a560e9ef25ca02d6625bf5bb1907d0d0fdd39d054bbef4142a220d6154b80278dc0951556b4b985e4f497c5", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003010, "uuid": "a4cb8214-554e-4679-898a-7b310e92a9ea", "value": "T121542315CA3C37A6F8D088766973773D8B4134EB5A83DDE179E7A8C89230885E78147B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003010, "uuid": "167ba4cb-3f88-49a9-8f10-4a6345bc5c76", "value": "6144:gphF4dea0wBm4PgvDHIxIF0mqKq6+cBN2bMfEDhDqNr30Mbx:iqeatmigvDHIxhKq6+DND2Bbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003010, "uuid": "7929dcd5-50d1-47fb-a431-7c5506588584", "value": 292688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003010, "uuid": "e2db6528-de23-4059-a85d-9e405e9eec3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003010, "uuid": "a0696a59-88ef-4802-b9e2-5a5959d4e872", "value": "4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73fb1a6-63a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780968620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968620, "uuid": "02fa8889-2533-415e-a559-5ed8068a1892", "comment": "Malware payload", "value": "c218d6d96423b6c2af52274d8ce81ca9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968620, "uuid": "a38e9a27-f5a9-40cd-9de8-f1a06b46124e", "comment": "Malware payload", "value": "34ec597c8d86a0c34a178ff75e741082df1523d34c8cad9faaba05117740efe3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968620, "uuid": "8caf169e-947a-4c20-807d-264b2b6135bd", "comment": "Malware payload", "value": "d87e49f21bc0490b40ecb030ae8779b1a6b8bcd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968620, "uuid": "264c33da-d86b-48fe-88e3-2146390fccbc", "comment": "Malware payload", "value": "abf5d83f8c9b364e0cbb2cd4ef68f0e071f530d7f11421877d633f0e4cd5324a8a8843f0716803ca34c3f1795369121b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968620, "uuid": "d4b4d867-568d-452a-9ab4-bbee49c508cf", "value": "T1EA04D80A9F920FFBDC6FDD3701A90A4235CD955B22A43B363674D528F54A90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968620, "uuid": "032a8370-7a65-4603-b194-469daef2dd6d", "value": "3072:piJTHRv/TCLH/gmkf4eTkAytpfBFVCf1q:p0rRWH/pknANpJFVK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780968620, "uuid": "f68cd26c-d353-436f-a072-da543dbd4167", "value": 185652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780968620, "uuid": "a276e120-4783-4d7d-bcf6-13cb07ab22d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968620, "uuid": "a0401024-6a12-470a-8184-b7bc3e2f2a58", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b115119-642d-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781028031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028031, "uuid": "61600ca5-580c-4c08-a76d-762465ebd8f5", "comment": "Malware payload (NanoCore)", "value": "978bb04fd4f7066f391e8806325cc872", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028031, "uuid": "693614ca-96f3-45ac-a01c-5465d5e97cd9", "comment": "Malware payload (NanoCore)", "value": "34f0612b6ceff640754500f6c0f4d70e385db4cbe1807fa6974808e9b66cbb96", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028031, "uuid": "3ecae68d-c37c-4bd5-9a91-064e75fdb534", "comment": "Malware payload (NanoCore)", "value": "f67b598cdd9ce2fc23af87636fc422476ca92179", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028031, "uuid": "001f9003-1c52-4661-a1a6-8658c65459e7", "comment": "Malware payload (NanoCore)", "value": "b4b1c3899bb8dea2ae8e9170e0c8d09ecdfdf75d42e01b93c6053970935d78d61fea971777510b346301b9ccc7594cd5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028031, "uuid": "728de51b-c81d-44d7-8a26-5b0561ab8b7e", "value": "T1ABD3B058F7D98B52D7EE2BB990721E4407B8F6139A13E31E999020BE44637C1CB913B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028031, "uuid": "f1440792-94e0-4444-8d64-eac384b52c06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028031, "uuid": "3a118240-debe-4860-bea6-af8172d96bff", "value": "3072:Vbc0SqOSkjM49oRrk4vGLjq4cDBbgJsVMu0rRZMp+MgFUhflS:VPS/4RjvGLjq4cDBbpyRqpWGhfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781028031, "uuid": "04d1bcc5-88c3-41c0-b33a-e0a6e78c03b8", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781028031, "uuid": "6079732a-73c8-413c-9646-a4b9f66de802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028031, "uuid": "542e1d01-d58d-4589-9dcc-11087874f9f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0679d87-63e4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780997009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997009, "uuid": "f713c16c-6e21-4932-a264-e9b108b06bcc", "comment": "Malware payload (AgentTesla)", "value": "91e7836fd5bd30e992cd0278ba5b1468", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997009, "uuid": "d732fc1b-c2bb-4058-9e07-922649a39f46", "comment": "Malware payload (AgentTesla)", "value": "354140219546ef1a4c19a8edbf37041c23f58920739c52ac14d2f0a6a37cc653", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997009, "uuid": "767fa78a-cafa-4fa7-98a0-aa3f9b93936b", "comment": "Malware payload (AgentTesla)", "value": "e66bfad46af4e0422c8e7ca6ab4eb06efe5dd784", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997009, "uuid": "6e3ba9dd-3c89-4bd3-864e-ccc1afda93b1", "comment": "Malware payload (AgentTesla)", "value": "897c289192ffc560b2c4d1636aa1d7a81f436f3c0840bddb73c49b3bb90bd5f08c3a7d82155ab8e08e971a452f4fca9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997009, "uuid": "72ff21e4-86ae-494a-940f-39395a1c22e4", "value": "T11F93E6E832C6F8B55206B17B3D36B0D7F6194C85E3984024F799B8DCF8E4B28A578674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997009, "uuid": "ae8f2a66-1d2d-4252-bd5d-711282bd1058", "value": "1536:ZpKY8fZUc+oyFKHXjdLryxc84yhHlsSAO0Ue4nQQFThvKyqgQ:ZmF+7iyhHGSrFF9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997009, "uuid": "a9353de7-bb88-47e0-b337-2b6b8a8a9617", "value": 91261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997009, "uuid": "506d430b-247f-4127-b76d-08c1cd2930df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997009, "uuid": "ed18ad36-f1af-4b99-a19d-6147f94ae120", "value": "RFQ_New_Order_13459pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedf9e15-63dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780993624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993624, "uuid": "fd6923ac-bd5f-4ca3-aa3d-981273ca4494", "comment": "Malware payload (Mirai)", "value": "de4b85bd56e52af115329ecd1b1baba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993624, "uuid": "7da0bc5c-9646-4878-b3a6-ce2e69d8ad49", "comment": "Malware payload (Mirai)", "value": "3576c665de1482697f869c1ef9e75f86e4403df072c046990cbf8a82229920b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993624, "uuid": "844fb053-7222-4e90-80a7-21c62a2de869", "comment": "Malware payload (Mirai)", "value": "2f9fb281a5498b859b08948cb425be5297e6093d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993624, "uuid": "0c0d4788-0ed0-4864-9e5a-2f77568a9de6", "comment": "Malware payload (Mirai)", "value": "e1d3d38b32a38481222d6118e08a8830ad40f04f472799a84e6e2ea2e9f990fd72f844a80000528f71887e431dbf76cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993624, "uuid": "57055d67-310c-4bde-85c6-1fe2db0fdb7e", "value": "T1FC157C9DEB86E0E1F57300F0025FD7F65634A12A5013FAF6EF452A63B4327A16F1621A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993624, "uuid": "b522f72e-5a61-4237-869e-829c9e50cae2", "value": "24576:fZzy9rpbohAvhbEtt44HHYdaJYRr98wFkm9:Y8hAvhbE1HYOeuIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780993624, "uuid": "3ed91697-258a-45dc-9d74-89ed3d0a7549", "value": 935128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780993624, "uuid": "1f63248f-b800-4d2d-9bea-848ff247e72e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993624, "uuid": "c9f61052-ee4a-44b7-a42f-1f1d7fd15b36", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aed0f85-6411-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781016005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016005, "uuid": "e355df97-bd93-4b49-97e6-cdfa9f84408f", "comment": "Malware payload (NanoCore)", "value": "354e05b41d727e2dddb45d3eb46427ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016005, "uuid": "e054b3fb-4301-4385-9137-c6c2d721dffd", "comment": "Malware payload (NanoCore)", "value": "361200a878a7178db2de1251c90148b5eaccc53251fddf62282e16901d334ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016005, "uuid": "9130dc41-203e-45f4-bb3e-53f7179c4417", "comment": "Malware payload (NanoCore)", "value": "1011cfcee71027e1afec4b561992c91d3db6b9e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016005, "uuid": "08784d52-6fbd-42f1-ac4b-a189ab04137d", "comment": "Malware payload (NanoCore)", "value": "5f3b0f5f231ad9230fdfee990ee12c1032f628ea60b57fc3d18310a69139a0e4920f8569c54763000ecf27a97b62e578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016005, "uuid": "02fafc9c-9c1b-4fd2-b969-6f35c1b0a29f", "value": "T16C14CF563BA84A2FE2DE8579712212139379C2E3E9C3F3DE28E451B64F567E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016005, "uuid": "cb39f7f2-0bd2-47d7-88e4-2e4b34299131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016005, "uuid": "37a6fa89-61fe-4c77-ace4-57096054968e", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIV0sC6wwBLsjAIZnB/nFgMbsz/:sLV6Bta6dtJmakIM53+LsjAcW/zhIRNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016005, "uuid": "e34ecd7f-3945-4d11-afdf-26fdb4e4bd36", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016005, "uuid": "a6fb5f3c-cddc-4207-b416-998068e84858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016005, "uuid": "9e1695d6-9639-463c-b315-3d4d1d835822", "value": "354e05b41d727e2dddb45d3eb46427ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ec4113-63f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781003541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003541, "uuid": "358aaa31-6c4e-4d50-a040-6d8b68995c07", "comment": "Malware payload (Vidar)", "value": "b2fa5ae46f210d0bfaac30061f5e8567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003541, "uuid": "b0fd5c39-cccc-4421-b581-a69796c4f630", "comment": "Malware payload (Vidar)", "value": "3620b5538aa6862349a2198c79be831754923e03ef84089fb209603dd2b97062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003541, "uuid": "df5cfe8a-8ea1-4e5d-bf30-4e2e6214e164", "comment": "Malware payload (Vidar)", "value": "fb87f026b02fdd60cada96072d28f7dffebcad28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003541, "uuid": "0e644740-587d-40ac-a049-abfd9424cc4b", "comment": "Malware payload (Vidar)", "value": "de497bbd035735cb80b6050b9fdaaaf514dc4067b2165629a6b175d7f2210a84c90d773ab7236f7372c2d25a6641038e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003541, "uuid": "97f17c4f-531d-4168-8ffe-18a8cff1322c", "value": "T1FAE56C46ACE009F9D0A662328CE26592BB20BC490F6623D36F51BB787F777D11C72794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003541, "uuid": "f527e436-3f82-404d-84c6-837d109868e2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003541, "uuid": "2c551779-5678-426c-bb90-ad6aba1a751f", "value": "49152:caC3VM1J4nngFAOoJrma2s2y1z2QszJp+ex2a3AnJ:cEeDrma2ryh2QszrdQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003541, "uuid": "8cc596c4-6fbb-4c87-aa5f-44f80c5c2bb5", "value": 3212424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003541, "uuid": "26966e0d-a0d2-4741-96f8-108e8c25c4e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003541, "uuid": "fb493f97-4e4d-42b2-9669-bfe272755ad5", "value": "Fly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bab830-6417-11f1-a769-42010a9c0008", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1781018548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018548, "uuid": "09e643a7-2005-4a59-98ee-4743511894e9", "comment": "Malware payload (LxBaseRAT)", "value": "e6683b1f68d9db7eba3a14183dd6f08b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018548, "uuid": "348174c7-329e-42f3-8f35-f852e8b7ef07", "comment": "Malware payload (LxBaseRAT)", "value": "3661390834c4b7b0fd1118923cb5f9f70963340b4e11bff0c3c53d3c1e934f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018548, "uuid": "c93a5b79-0f26-4d59-babc-ed0cf8a1ed2a", "comment": "Malware payload (LxBaseRAT)", "value": "a0be0440a5fd1a72bbc324995482442da2f70f95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018548, "uuid": "3e2019f4-bdb2-4538-957a-e9010730e126", "comment": "Malware payload (LxBaseRAT)", "value": "296e03ab90ba1736c0070ff377b26ff061ec21e9b5dcbdd248aed25400fa380e53c0cdfbf7de4297d02c343fa7307fc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018548, "uuid": "3c8bcedb-0d97-4623-85fe-151f76efa70b", "value": "T136F5922039FE9059F077FF794AD87796996EBE232712D41E501A338A8B33942DDC1239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018548, "uuid": "234378e1-e7c7-40df-9cee-dfeb22cb8d87", "value": "24576:OhzQoRNXnGu8pq4hUqYJqcIazZDniSLQeqTzCnh55KW4kWqE22CeX27YMlYJmu+T:OhzQQz8Uq4PZcWlTEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781018548, "uuid": "166b8954-b9a8-4e4f-8f05-1e6447019e99", "value": 3376128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781018548, "uuid": "f1906ebe-0b71-4291-bc41-60a48e57c578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018548, "uuid": "de476ecc-5750-467c-ae88-f5d90db331d7", "value": "xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250bb8ec-6440-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781036208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036208, "uuid": "07ce4b8d-9ce4-4c24-a315-3e89ad974bed", "comment": "Malware payload (Mirai)", "value": "c24b0f6a1c356c5cbaa9989abbef7c05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036208, "uuid": "a543c62c-2db7-428d-a425-010a5dce1cdf", "comment": "Malware payload (Mirai)", "value": "36b95fb721be440f77cb7a82f854a45eaecc68bce9feb5ee96a4a0fd93f1e51b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036208, "uuid": "8cb4ee36-2a66-4a03-a6f4-1105d8962b38", "comment": "Malware payload (Mirai)", "value": "ac331a15790e348dc99e7128ac746799ce49b896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036208, "uuid": "7de3ccbc-f003-4ad2-b3ed-83874a929cf7", "comment": "Malware payload (Mirai)", "value": "e8c1727d675af535ea21ad688f4ee0f31a8b991e2231025829fedbc0b0ef10bbafb7147c8966816e873c99437648d9f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036208, "uuid": "d4055716-0563-4d74-9faf-24580ba2eaf9", "value": "T102B34B21FD745C3BC9C5617A10E34631F5B3439925B89A5A7EA31D9CEF18310323FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036208, "uuid": "87465785-833c-434f-b7bf-46d599374840", "value": "1536:tdNKm27Y8j+KhlwrklsjBBUl+aN9W67Cu6NW55A/MbeyZt36gEHx:HNS/+KOr+76Nw+HgWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781036208, "uuid": "12c360e9-6513-49a8-9573-92feb53f9cca", "value": 111800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781036208, "uuid": "b7bcf930-3f18-48a6-82ca-fd9de5c4c262", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036208, "uuid": "6eac169d-1750-4b16-b1f6-4e064edb4aa3", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7499ba7-643e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035675, "uuid": "c1321fb8-7b5d-41e3-9483-ad6a26dcbd36", "comment": "Malware payload (Mirai)", "value": "fc47f39b72fe7aca74fcffec47d3bc4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035675, "uuid": "77174f85-5b08-431e-9f26-fd1ddfbf6602", "comment": "Malware payload (Mirai)", "value": "36c5aea74bc2ad656c110809f9fb59ba3a26454ba977525da25dc817e43dd794", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035675, "uuid": "a5bf25fa-6163-4858-844e-769590fd7dd0", "comment": "Malware payload (Mirai)", "value": "542f938c5fff1242f2b1ee46b94f16d9ef3f3300", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035675, "uuid": "202a552e-15c1-4ddf-ad92-bec4dcaf9ae1", "comment": "Malware payload (Mirai)", "value": "e7b469c4dbf37687e0ad141ba73e53f1946553e8d2dcb4ca51fe1564f87a0284884c12b7ce4b510e3bb00eb84e2e878c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035675, "uuid": "cb16cf32-4989-40e5-bbc3-309278c318d5", "value": "T16C8302FE0B651BCEE0C6D0F362BA4A631C624B7785435C4BB431E7975BCB4215CD2592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035675, "uuid": "4a87f99a-dab1-4bc5-bbcb-8291b2292639", "value": "1536:HSOnRBxXIq1Q0r6X14BcPZRzLrr1U/xKfNMasfQKQxVJuO:Hp5fYuBKZFvr1U/0FMauQKcVQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035675, "uuid": "7cfd406c-c307-4fe1-aa4e-3416dfaefbdf", "value": 83740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035675, "uuid": "f0fc78bc-feea-4fdd-a9ca-10f2737dc202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035675, "uuid": "548eeb8d-1ac5-45c8-89db-f5d36f00cb8b", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26674127-6414-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781017313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017313, "uuid": "ef99db9b-cc0d-4747-8d21-a498c493432f", "comment": "Malware payload (CoinMiner)", "value": "8432fbe4025ee91c49dc7bdedd42c86d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017313, "uuid": "fa0fb013-6bb4-431f-82b1-9797671078a0", "comment": "Malware payload (CoinMiner)", "value": "3795b41acec5b2dff194891266e6765e8ad19c539080eda3f846caeffde25a7b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017313, "uuid": "bd6de990-e4a2-46b9-8b31-d69620bb6c59", "comment": "Malware payload (CoinMiner)", "value": "7c99024bd2f3bb76f4d97f47d221756dc72628e2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017313, "uuid": "34392ffd-6793-4b15-824a-ccfb0be260de", "comment": "Malware payload (CoinMiner)", "value": "526dc16d789bc261bcbaf722724b4af9d8e950ea9709f19402942a62e16089ecbcdb4c043a61c1254dc8c31853d89f6a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017313, "uuid": "6f90f24d-1341-438f-9ccc-497fb8d03060", "value": "T164822A76F941C272E24FD9755A0A6C4D0AC87592D8EC2C82B7FC0B8D5C92FED6C812E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017313, "uuid": "42d62769-3f22-4272-be47-5d41eedee566", "value": "384:rCscY1oC3DPC6PGO7Bhwo5GykZRgkiR6GD6BewOvP/u84jWSCc8bMx9jHdWlRyjy:Jc8oCLCaGWBLGykZRgkiR6GD6BewOvPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017313, "uuid": "0b05b451-14aa-45a2-8cfb-eab113aa757d", "value": 17596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017313, "uuid": "327973e2-ab20-4913-81a9-d4d5bac0b541", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017313, "uuid": "473e4652-9c31-4ec6-b09f-0bb4a6d97f31", "value": "netstat.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9362a1eb-63ec-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781000316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000316, "uuid": "9fe3c95d-df0c-4e53-aaf5-6bb116072e78", "comment": "Malware payload (RustyStealer)", "value": "aa30f1985975a5d1512e7ee4a946693b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000316, "uuid": "e7539120-0287-47a6-9ce5-e96892b62518", "comment": "Malware payload (RustyStealer)", "value": "37e20d8578128db13a53c1003cef95f96f610fad78f07f5231de996d9bd60ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000316, "uuid": "726fc976-1418-4024-886c-4d394b1eadfd", "comment": "Malware payload (RustyStealer)", "value": "b037350e0f7b56696aad34f44a1e17b6dd66804a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000316, "uuid": "033256e9-26c5-40e4-bcfb-25faa11e1517", "comment": "Malware payload (RustyStealer)", "value": "c676ebeb83e5016dc2c26411ea86ade3d051e1c7ac4909722341fe05e14a854ba4bc99a4974e06e8b3818002c8faecc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000316, "uuid": "9d2be987-655f-4776-b963-167d4d1a3ce3", "value": "T15616225428E205BEC057C371DBCBE8BCF24BBE428D31CD0BAF6A64519E71919E872E15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000316, "uuid": "f2a2acdf-2d60-4af7-a0ca-6bf7cca38926", "value": "6c9a61eef7a32e87e02e373f1b4eb87c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000316, "uuid": "e18cc3ce-7b54-420f-b3e7-b01dc70e20f5", "value": "98304:mkZBaplLHY1+WpnkJgmXTwoQ/3jl093U55qDRvGzA2PzmTRJ5KD6:5mVY1+Wp8Bc1/3h093U5p02rQRJ5q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781000316, "uuid": "36287652-2cf7-4f6e-acaa-2ff5edb96aa1", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781000316, "uuid": "88c4b119-4304-49fb-87c7-62ad77195168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000316, "uuid": "c5bb5695-3f4f-40c9-afea-a66977e9d41b", "value": "New_Terms_Conditions_agrm_confirm_Jun8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6e9e3f-6413-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781016997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016997, "uuid": "b1c795e0-4734-408e-9c3d-42453473cff7", "comment": "Malware payload (RemusStealer)", "value": "a24f270869387cc71de249588f455466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016997, "uuid": "22bcb079-92c7-4f5f-825e-8b67398d9d9e", "comment": "Malware payload (RemusStealer)", "value": "37f05f0dccbbebdd3eb3ec0d832b00ca217c2caf830290eb38ea5d1f92bdf43c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016997, "uuid": "1928b6a7-6c77-44c1-bdb6-39fbf7308a5f", "comment": "Malware payload (RemusStealer)", "value": "0bb848f0834755f0a3a2795d56c41313787193fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016997, "uuid": "d2b9e446-5a48-4538-8e63-feb8abbb6010", "comment": "Malware payload (RemusStealer)", "value": "bcbb2c4106128f874518ed65fe442c63e2ff4f1505c7cbb780b6e55d65468c081c9eae57b6dca702ffbe366a1f4057d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016997, "uuid": "b1c4dca3-9864-4a9c-a808-bb753e189fa5", "value": "T12AB53A46BCE109E9C09A633288F22596BB34BC440F3613D72FA1BB792E76BD05C76745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016997, "uuid": "de327a50-7ccf-4a63-8463-923657f80df5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016997, "uuid": "b006599d-6f5d-4bfb-9f12-fbec8560b4f1", "value": "24576:pd+nBR+pEPnGmYBZVgSyCq/y47Anm/jUE6S0yrsn/nBele7tKDyi0IKvKJ+a:pd+BR+aP+BMSyCf4t/jU+0ks5n8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016997, "uuid": "8d7c0690-647b-4e11-a885-20d4af1569f0", "value": 2378376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016997, "uuid": "54582b18-98a6-4544-b6a9-82b5d1fdad88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016997, "uuid": "4686affb-4570-402f-bb50-d23c193a505d", "value": "iuyuh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da54d6af-63ee-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781001294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001294, "uuid": "492ed11a-8b03-4ed3-b62e-dcac4da7d30f", "comment": "Malware payload (AgentTesla)", "value": "cbc0fe0e3ca3f3b2b1202204f7be26c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001294, "uuid": "666f31e2-6883-4c29-8551-5f67fab53356", "comment": "Malware payload (AgentTesla)", "value": "396d1d9a377663ac67dc0fbd7f881f72c8097f5e9e0d967d680d3f93effac2a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001294, "uuid": "7a324fcc-641d-410c-807c-294c9b58ce2d", "comment": "Malware payload (AgentTesla)", "value": "87e0f505aad12d8318ad9572f53b6e8e66e11e28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001294, "uuid": "06ba6971-582e-418f-bcd6-aab5c54d144d", "comment": "Malware payload (AgentTesla)", "value": "33e529f559b8697fd025d973f2014def9f997b522d0646a870393eafe97f21170aaf1af9a70a8dd093bbd390b2479aae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001294, "uuid": "217082a4-e51c-4a25-bd9a-93e2d9e87ff5", "value": "T1A523CF663981122ECDDFBA30ED245FFB9686A3F8CD385B832C87592A1720F05B615F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001294, "uuid": "c7e0325e-8630-4dae-bc27-4b53b07cb2c2", "value": "768:Ab27dlRcyEr6eH/NS9A6aFXSrit625gyXtihlDYlCM:A0dlGyEdHz6QCmt625gCt1l5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001294, "uuid": "b9ca55ed-d6fa-4254-bfb7-6d7371ede781", "value": 46025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001294, "uuid": "cd7f964f-cc5a-43ba-8142-2cfa68401e85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001294, "uuid": "ad2cb60f-fdf2-4ee6-92f9-ccfeee52515e", "value": "396d1d9a377663ac67dc0fbd7f881f72c8097f5e9e0d967d680d3f93effac2a6.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c3ba1f-63ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781001558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001558, "uuid": "5362b57e-6baf-4f8b-b826-d450360ec7f9", "comment": "Malware payload", "value": "eb2a3ec73469552f6bbf57bce3348b29", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001558, "uuid": "ead739fe-ed36-4f31-8c67-edc5db647d60", "comment": "Malware payload", "value": "397460bc4238a624b462f33879bcd600bde6ab255e848e1f108b0f0ae4750720", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001558, "uuid": "97da0650-dbfa-46ae-b1d4-b34339bace59", "comment": "Malware payload", "value": "dee9736b688f2b84299528cedb5b6b599878f81b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001558, "uuid": "87f14bc7-d9fc-4d53-8114-bdf4f6e22aff", "comment": "Malware payload", "value": "60611586badd10282a09ad06cfe59398588a50e5bf369e3c453d619b9004a6304a12fe95ab9b46de710ed3824304890c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001558, "uuid": "f5652b0c-f5e3-49dd-bd30-db1fc04af495", "value": "T12384DD3CEDEA502EB1B3EE598AD47597E95FB663371E980910D203864713942FDC223E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001558, "uuid": "63ac8a06-7c03-4deb-b4d7-bdfb27777090", "value": "12288:KN/uP/7xJdhY4+Ox8pyL73HixvqIdlsQfmF5hYv:JhaTlam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001558, "uuid": "631ced4c-5b7e-4135-97c0-a30d65bcd1b3", "value": 402188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001558, "uuid": "52be9d43-1d7f-40b2-8efd-5da8fbec706d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001558, "uuid": "aae1e891-3e21-459d-8b07-82deb7d48b3a", "value": "POII_5296_TEC003_JMG_SA2026-06.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ab5fb0-63c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780984086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984086, "uuid": "7992f908-3fd3-43e0-9eff-e793f79d9772", "comment": "Malware payload (Vidar)", "value": "47fc4ab17f0b0aa2dd34eb26ab11f375", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984086, "uuid": "477bb91c-ebc3-48e6-b51d-0ddbae1911eb", "comment": "Malware payload (Vidar)", "value": "3ac233edc9975bfcaa4fb14a745b394f6c9948679532772b7e8feb52a61ab748", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984086, "uuid": "41439202-9e4b-43ba-afa1-d4c69503e3d9", "comment": "Malware payload (Vidar)", "value": "505ef1f7fd2ad10b1af61bb84dcd4042a3010609", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984086, "uuid": "93e4638c-3843-46f6-b65d-66a93307365d", "comment": "Malware payload (Vidar)", "value": "41fb0e1f07b7e186488f2b2791bf3a2aa6d0b00446957634345819c758736dfb3f883dea084792763fa17d97615d885f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984086, "uuid": "db1b6fbb-85dd-4526-ba34-78bebb2cf4b8", "value": "T130F58D42B8D14CADC555733189A62656BB38FC440B3263D32FA17A7A3E77BE0AC36345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984086, "uuid": "3ab4e633-5322-438d-b421-7a26002eac92", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984086, "uuid": "566a4169-ecce-4e04-99f6-80e69ee66c2f", "value": "49152:03J9lTb27C+HDj+IASDwS5z3QrYzTq3zctCYlf9JKXvfzvZzw:0ZYKazdQMzTq3zctCYlf9JKX9zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780984086, "uuid": "abd8648d-bcc5-466d-b13a-d0fb60514ba6", "value": 3624400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780984086, "uuid": "3a2e6a63-6bef-4001-aacd-6b717814a15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984086, "uuid": "8bdf8843-09b7-44b7-8992-9e496736f927", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b272b9-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985579, "uuid": "82fdc5c7-3338-4194-8bdb-5273efb320d2", "comment": "Malware payload (Mirai)", "value": "4a5f8f80788da35979eb2e4415c8647c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985579, "uuid": "e8612aa8-ddf5-477f-85da-1e976af70798", "comment": "Malware payload (Mirai)", "value": "3b5a2c168f6b90719494da70418e45643f4db93cd672bc2c29038117f153a074", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985579, "uuid": "79739f39-6910-427f-bdb8-69c0827e775b", "comment": "Malware payload (Mirai)", "value": "bef3a957f42e22f3c6a9b02a1a888769ec0871f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985579, "uuid": "f382a048-3705-4c49-9757-fc4a0ec475d5", "comment": "Malware payload (Mirai)", "value": "32fac18203b40ecef885cdcd5d6afbb2621c586925af986ebfe78c6f7f961705bb1103c51e09fab2406f88393106849f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985579, "uuid": "d5862b53-6459-4c25-9355-6ac87e671a32", "value": "T195D30702770D0F03D1633DF0277B1BE097ABFE9629A4A580B52EBEC99271DB21445E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985579, "uuid": "77a2d5a9-0aa1-48fd-bca5-a89f4abe0bc3", "value": "1536:VB7U22ajuV/+GaWxJxfhFg7DYqjJOUwoOVV9jHqvAE1nYTJpYo1qqYvC9Sz:1/97WxJxw7VtOoy9HEZ+Az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985579, "uuid": "0107e85b-e643-45d2-a08d-f4918e3cad03", "value": 138872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985579, "uuid": "4c5d5364-f566-447a-bd65-d1d358513f53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985579, "uuid": "83d4ea59-756b-4e99-b2ed-0835ad7741dc", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f170c7e1-6413-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostPulse)", "timestamp": 1781017224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017224, "uuid": "e5b5371f-b6f2-413d-be16-f219bc88f237", "comment": "Malware payload (GhostPulse)", "value": "23114f1ac0ce1f638ddb9cb0d606759e", "object_relation": "md5", "Tag": [ { "name": "65-21-96-131", "colour": "#8E126F", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017224, "uuid": "890e4222-c6b1-4bbf-ac8d-92ed3495231b", "comment": "Malware payload (GhostPulse)", "value": "3c4a658ac06ea08c0370f045f8f811addf114af2c8dd071daf59316fca4be0c0", "object_relation": "sha256", "Tag": [ { "name": "65-21-96-131", "colour": "#8E126F", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017224, "uuid": "79339c1a-2f1e-4a8b-8220-aacab9084f9f", "comment": "Malware payload (GhostPulse)", "value": "5fbcc2a1468fe46938fef6e6c3a135d32909b033", "object_relation": "sha1", "Tag": [ { "name": "65-21-96-131", "colour": "#8E126F", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017224, "uuid": "07961631-1566-4138-828f-aa1f24267a25", "comment": "Malware payload (GhostPulse)", "value": "24385b9000817700c44a66cb93decc40c9220d3c9c7c3c04bed5f49fa3920cf5d6326703c13b0c2c17f60703beefcd58", "object_relation": "sha3-384", "Tag": [ { "name": "65-21-96-131", "colour": "#8E126F", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017224, "uuid": "c921fcef-bb6b-4db8-9882-d01df1b3dd97", "value": "T173C63381B3001876E75B8BBDCD1A8F2196BBE3B2E35717E53B422F167C924C8A1172D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017224, "uuid": "d21e1158-0817-4edc-a01d-9452aaa4bd34", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017224, "uuid": "63582fd8-1665-4db1-a858-a00bf94c9fcd", "value": "196608:+p9cCn+gt2lnSxyHPqdLcydKYt0njA+MYGxB48ImSYZdk+Y18BnCnVhW/aUtHtwi:+pzTsExSSdLcWYUIGH4Iwt18BnEi/aUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017224, "uuid": "a5b8f75b-6b1e-4c36-85af-1a6f270667ec", "value": 12224721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017224, "uuid": "5a0c83b5-874c-4f7b-97a6-cd7993e8f96c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017224, "uuid": "e3b4a6dd-74b9-46ea-a3bb-f527562e2f11", "value": "kythy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aeae197-6447-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781039251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039251, "uuid": "682bae5c-3ef6-4ef1-b90d-56121d38376f", "comment": "Malware payload (Mirai)", "value": "7e56fc36a10683a82862caf875ca311d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039251, "uuid": "a7bffba9-564c-41bf-824a-e86c3e6feda9", "comment": "Malware payload (Mirai)", "value": "3c5d4b34802e88dee998232e3c1767948c419cc03bd05b8f460402db03e9b614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039251, "uuid": "9084be8b-35a2-4c65-81b6-2496fff3ac1e", "comment": "Malware payload (Mirai)", "value": "eaf6e64a725383afe167f579c3a0819238ed672e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039251, "uuid": "ce2198ff-525e-4b4e-aaf7-db78c7ae0920", "comment": "Malware payload (Mirai)", "value": "2b824309024f52cc2f458bf59bb80052a12cc12381bcc2e79438d17652807bc689e0f2012476617b1071080e392e98ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039251, "uuid": "785c12e2-080a-42b4-8069-ca0f417de2eb", "value": "T1C1937CC9D683D4F1E8190975607BF3376632EDBA0068FDE2F7249B36A025B60B14674D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039251, "uuid": "9283fb94-66d8-45a9-9ea0-51d3976fc38d", "value": "1536:M5PV31C4WqyzZpllDhK+doEj04o+qArsWGkH3jxb/pw13Gnsg1OJpT8Ge:KNF4qyVpllDUgcZSrsZkH3jh/pSCz1VJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781039251, "uuid": "9da4a1d3-1588-42bc-b219-bdd22e417e7a", "value": 94556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781039251, "uuid": "202a6744-f99f-4257-ae98-a22338acb8bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039251, "uuid": "9ff1af60-0011-4e91-b0ed-8550a468f327", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a95382-643d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781035132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035132, "uuid": "ff9aec54-4229-4213-9572-015f48627a36", "comment": "Malware payload", "value": "451dfc758291148c9152564d014d4e79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035132, "uuid": "7dc483ea-a300-4b24-a5b1-96b8e3635470", "comment": "Malware payload", "value": "3cb3bb905576ab01f867f5436e261e79ebd5a9ca69c10b7c0dd2eb5a40b25e96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035132, "uuid": "cf07d3e6-d211-4d20-b59a-2d0414cd69fd", "comment": "Malware payload", "value": "3c96981ebda26e193480b371ddecd110b39b89bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035132, "uuid": "2b2e0624-2b3b-46ec-862a-6f8e219cba60", "comment": "Malware payload", "value": "1369f93dccf7f2fcb5daecf5b2baa34d5b3f5b3788e6b54c0cfeeb8f60bdba50b87c7ac32aa2b115a7e6c4400ae15cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035132, "uuid": "3b483d17-7e0a-4264-a3e3-5f37de7d6f25", "value": "T181331B41B71C0443D1732EB0363B1BD0E3ABEA9122A4E389751FEA49E175E339586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035132, "uuid": "27aa7365-41e3-4a79-b995-39f5b3e0f32d", "value": "768:zXuhWf/SAoHFUGrWhcL9WSTJHjSueBPl3x0FObtRBrPeIy:6SgHm5h4WyJDBeFlBjbrheZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035132, "uuid": "2b7416bf-9524-4a61-b05a-ced00abb52b4", "value": 50624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035132, "uuid": "00a7634a-38d9-483e-9308-779afaf98640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035132, "uuid": "8c9b8d13-0d48-49de-915f-77a2398aedc7", "value": "godisdead.8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729515d2-6407-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781011857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011857, "uuid": "b0fe0c2c-6b3e-49ba-b299-bed3f715febf", "comment": "Malware payload (Formbook)", "value": "58a0064aa583b6d6cd7c77c429f8028e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011857, "uuid": "ac77db7c-74d4-4863-9203-1a23ec5f3052", "comment": "Malware payload (Formbook)", "value": "3cc0a87fdfbbc3f7c80120f05959eebeb82f29fb70854eff4e50d5b427968e57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011857, "uuid": "35d6c3a5-a267-4565-80ed-6cce3d0400e5", "comment": "Malware payload (Formbook)", "value": "f4398612e553bd0105b69f3ea14656da2f88aed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011857, "uuid": "7b4339d0-b7c1-4f0b-ad1d-359d6cf675e7", "comment": "Malware payload (Formbook)", "value": "0e4e2a272c23e59015228324ab0f3d084816ed0719b6524e006f4cea7ef53887b14e4a100c791c1cc82dc8f551ff3027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011857, "uuid": "39bdebee-c599-486c-a1e6-1bfafcef10eb", "value": "T1474501251D866F44C73F4E78C22904A823F79D075E53E3EA2EDC4DE07AB2789A957123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011857, "uuid": "3443cf23-368a-4873-a559-b3c433718024", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011857, "uuid": "5b81f1e0-8415-4a6f-9a7d-95a7d290fec4", "value": "24576:Ilrhmmgm2YEAZKXu6VSVP0Y2RabKcedMZGRMkRTh:Ghm42SK+6V/cQMSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781011857, "uuid": "1d613eb5-d43d-4134-981f-8e276b1ac1c4", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781011857, "uuid": "f054f73a-248f-40ea-b38a-41af6eb03c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011857, "uuid": "18886003-11e0-40b2-9553-a6a2adfb7e0e", "value": "first_order_20.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3b693c-6421-11f1-a769-42010a9c0008", "comment": "Malware payload (XTinyLoader)", "timestamp": 1781023173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023173, "uuid": "c3659aaf-890b-48f2-9c9e-aacbb1c121f8", "comment": "Malware payload (XTinyLoader)", "value": "dcfd3dcf325584a32cc194b3ec450289", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023173, "uuid": "3ab774cb-59e6-4a54-bbd4-2d9766c5eb07", "comment": "Malware payload (XTinyLoader)", "value": "3cea9df086d111a71c24822aa626380105347dd6d458ae7971557684bf12e097", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023173, "uuid": "3d682ac2-8779-4f85-bad9-673c21ea05f7", "comment": "Malware payload (XTinyLoader)", "value": "a7733b0f25f024fc366c1912202004bcc4bdcc5f", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023173, "uuid": "7637cd30-4ad7-496e-83c6-8c1a079421fc", "comment": "Malware payload (XTinyLoader)", "value": "8133d7898f472566fe602256893891772d018aef19ae172544edac32f0cfddeb6e7822d548e33c33d1053237af321d91", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023173, "uuid": "6720e76d-4759-44ab-8350-0d7c855cc588", "value": "T12F835A11B251C035F0F300FADBB54B7E9EB8AF10536490EB57D819EAAB21AC1BA31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023173, "uuid": "fb4683a1-5fc1-49a0-b1fa-cba5ad4b5828", "value": "831e79c08ed03b3133b5d43967c87952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023173, "uuid": "f83b596a-2000-4f29-8391-8668bfbc09fa", "value": "768:pMIKYhMC4r+dsq6sBtNl8uEss/HY/aax90BBhhNVLsbkkqEDo6nDAiOVFN0A3Ah4:pbMC4PqTNl87bsl4BUkiX2AhoB2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781023173, "uuid": "9e6ccae7-b973-4b3f-a76c-3c551e25cb34", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781023173, "uuid": "65cdba56-f43e-4854-a4fc-c6305937c981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023173, "uuid": "03f92196-65f6-448a-a2b8-3c6024f4c563", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88b90cd-63a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780969508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969508, "uuid": "a04f0494-8a84-4529-b318-f62c201660ff", "comment": "Malware payload (Mirai)", "value": "2a5b78fe39d72cab85a188a4fb344ea8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969508, "uuid": "8160e0ef-b00e-4a06-805a-a8ab725b43bc", "comment": "Malware payload (Mirai)", "value": "3d20d10cb57685e9e23094ac32efc236340449523ba2bad00799e3d5d1bbdd86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969508, "uuid": "e5c054f5-12aa-4f2e-a19f-58443c01cecb", "comment": "Malware payload (Mirai)", "value": "1e7eb1c0fbd87d83e7287dc8561ab25431a5886f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969508, "uuid": "3aed1e7d-983c-489e-aacf-5e2bb13c3f6c", "comment": "Malware payload (Mirai)", "value": "e4595479177545813a4f960c2790535ab816f41cdb65b136598d6b03fb18427fb143e829401a80056aed866f004def83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780969508, "uuid": "46329ff7-cc2b-41f4-b58d-39a80d766c5a", "value": "T17DC30649ED416F01D9D635FEFE4E028933530B6CE3FE7112AA245B2123CAA6B0F76506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780969508, "uuid": "32ec47d0-f37b-46b1-87b8-3ba025b027b7", "value": "3072:M1x3E2ZXMl7bkAKyaakbqst2yJ4Spapq29pOsvd5DT6t7:M7JRS7bR/aakTt2yJ4BpvOI5DT6t7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780969508, "uuid": "ef21b3b4-5514-46b2-a402-71f21e01d76c", "value": 124640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780969508, "uuid": "0e64579f-df71-420b-994d-a72dcc225f05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780969508, "uuid": "a864c16b-972f-4f11-8872-e0bc4157f7cd", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97fead6-63ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781000487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000487, "uuid": "d99cfb9b-fdb9-4fc4-acfe-56e60d98d9e9", "comment": "Malware payload", "value": "4c7b83405da7541165d333f780091d65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000487, "uuid": "63f807e0-f0b8-44bd-9361-b02250da5a86", "comment": "Malware payload", "value": "3d21d84009b854c9ce26541075b37186418355b1a182b1bd59e432e3b1ba2e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000487, "uuid": "811c51b0-2356-4f3c-862a-81229060b88a", "comment": "Malware payload", "value": "acfa82a66c41e6b9de79f7f0526bc14665cd7bb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000487, "uuid": "180102a5-9005-4122-858e-f6f8ff0bdf66", "comment": "Malware payload", "value": "8e2776c862a503037ce921229964c3f94c5ca7c80a861c9569409653db497a8e9621716c010cd47cd6962097f241dfe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000487, "uuid": "f904aa36-5909-4e12-826e-264384113ff6", "value": "T14FF4BE1B73958F21D2840236C1EB150197F16A477A3BE70E798523DB29023FAEE4B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000487, "uuid": "b77ffc63-82bc-4366-b818-43288f51a84c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000487, "uuid": "b83ffea0-03da-4bbc-ad67-cd121f40174e", "value": "12288:zPBvhMVPvGM11Qi3v8AZ/lJaj1jK6IxnO+QY3SdV6UBcgaVWYBS:k3Gyt/8w/lJUG6IxnLQOSj6UaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781000487, "uuid": "8d578fa1-ac61-4284-96c8-7af79e667e48", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781000487, "uuid": "08bb5247-c2a0-4044-adf3-efa25aa8663b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000487, "uuid": "5fc0e593-27d4-4ccd-91b4-16ec294be282", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.53828594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456c9353-6419-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1781019512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019512, "uuid": "e284b1b9-f6bc-4bf2-909e-6af742428a6e", "comment": "Malware payload (Joker)", "value": "5813298c848d2c1c340e13164146815d", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019512, "uuid": "92f14831-e86d-4501-a832-5886ef41ee18", "comment": "Malware payload (Joker)", "value": "3d68bedaeec7721037d25622486c6e7095d0bba82382404408d5e83b4c4e34ce", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019512, "uuid": "e3df1f0d-2439-4347-bf37-b740fc0e3038", "comment": "Malware payload (Joker)", "value": "3b8ece1443cee104e749519a2ccaabc21216a8b3", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019512, "uuid": "e45312ba-36e4-4d24-bf10-760ee3850fef", "comment": "Malware payload (Joker)", "value": "60ecdb112b5f10e4e4ac89df679f86d3732040dc45018746726f5a5ced9484fd80b7a0a26b3a70bb671ad2afb70f6d03", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019512, "uuid": "7af6312c-442c-4c57-9dda-b922aa9cf635", "value": "T1B727224BE71DE86FCDE6F17A89750222A22764245343E3D32D15A138FE976C89F19BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019512, "uuid": "d0743821-9f35-45b2-8bba-6efb3eede43f", "value": "393216:UPLgXe1j37b+HKxWh28nHmhWvFu0L00fcKGmRUFXsbAjfFVlihso:KLJ5L6HKx2HmhqA77T16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781019512, "uuid": "9691c4d6-fa30-4a6f-87f4-3696c9ae1926", "value": 20473237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781019512, "uuid": "448cda9f-4cba-470e-b896-4fca690d1cfc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019512, "uuid": "3e1622be-a6fd-49ad-9c25-14e44700fc46", "value": "com.filego.junkclear.clean_1.68.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f1fd90-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003033, "uuid": "e46d6d15-090c-4664-8801-1840317aabef", "comment": "Malware payload (Mirai)", "value": "8e3d6c6221fc899236de9ee5fcf750cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003033, "uuid": "074319bd-67d2-48cd-b835-b7d9f7c5f998", "comment": "Malware payload (Mirai)", "value": "3d7b5ce5ba0d49a0415f9a86f9bed4d50eebe96aa226a1469108c613c335faf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003033, "uuid": "7ecf07ca-ab38-45f5-a986-42be70acd7bd", "comment": "Malware payload (Mirai)", "value": "452a202951a8224cb006c7f9a562578259533be2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003033, "uuid": "8c649f11-2272-4350-9095-b7046aed0d58", "comment": "Malware payload (Mirai)", "value": "09190520df77ac436fb979f85df179ad43afe78ef4e773deb63a63c2cd69821ca94421acb840a40fd103e68f7339138f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003033, "uuid": "d9b05762-4288-4ef4-96e3-b078ad60a5eb", "value": "T127058E1BB2E2E0BCD05BC030479FC6A25535F47522322D7B36C4DA353E6ADA1276DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003033, "uuid": "7d844572-4293-47ee-ad02-a040f069d584", "value": "12288:kmxDM1upuGM9zcnpfQNgYyYoBddtHktcBWqSK+QLwybayfr5OHX:jRM1upPppoNgYyZFB+QLwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003033, "uuid": "de9f8e22-7ab8-4fdd-86e4-d806b7ea9347", "value": 860656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003033, "uuid": "d1e5f916-5dca-4102-8778-7243be4941e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003033, "uuid": "3596a879-c116-4836-9d8e-8ee69f8f0531", "value": "1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6353cc24-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781016556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016556, "uuid": "be912590-b91f-4729-9288-d9efa6c14ce9", "comment": "Malware payload (ACRStealer)", "value": "a410bcda0948e09d09917618dd6d8644", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016556, "uuid": "70536e55-a016-4862-ae33-0d14e553fe59", "comment": "Malware payload (ACRStealer)", "value": "3defed8022613e5956f6e1c2605ddfadab3043dc1bea85e42dfdddaf1e14c0a2", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016556, "uuid": "d80ef368-1fb1-47a1-82c0-652a9a342426", "comment": "Malware payload (ACRStealer)", "value": "916ceea41dba7fbde8184e5851e8df6ac72efc67", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016556, "uuid": "18a14c3c-8797-4277-b107-ae46b940022b", "comment": "Malware payload (ACRStealer)", "value": "083d3d253abe2e8dfa5c4f64553d46851e5858f309c1a1b24200ecc4a1e474a3d7a827c554261b4845f3f024a9433a45", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016556, "uuid": "a223b442-54e6-4762-ad25-ddfb793bdda3", "value": "T1B6C57C01FDD745B5E40312328AEB62AF2B349C090B32DB97EA447A7DF9B76D54836309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016556, "uuid": "6d368a94-c661-4c6e-bef6-d2574739ad80", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016556, "uuid": "8d932215-f979-497a-849d-fad1401ad4b9", "value": "49152:9rJriOEQZBs9B6CTbNSCLeZ4s3uSYwzGAKbs5L:F/EQZBe7TbNSSrDk5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016556, "uuid": "092e34a8-0dd7-446a-ae59-0e51bd96bf34", "value": 2591848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016556, "uuid": "2bab9f85-e446-483a-a553-3d6f8195a5a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016556, "uuid": "29f27228-f2d8-4d8e-9619-1ee309cd0210", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4720b98-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985822, "uuid": "5e95916c-fe05-4288-bc98-00e9eb684ed8", "comment": "Malware payload (ConnectWise)", "value": "25030ccdca1428124441dc250b1ede1f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985822, "uuid": "d9913898-5ff4-410f-b4f2-aa6220e222ef", "comment": "Malware payload (ConnectWise)", "value": "3e0183bd2acc8c761faa91d2fcb00dfacb189a44b4c9518140b808826479cdd4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985822, "uuid": "1b2d7e2c-17fe-4e28-8dcd-3301ccfac986", "comment": "Malware payload (ConnectWise)", "value": "fb97706f9617b96685993e4ec464664f9933ed1a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985822, "uuid": "5f57011c-22ab-4ed1-ade7-e33bd8e81f98", "comment": "Malware payload (ConnectWise)", "value": "a20f042e422035661c15237bd56f8fad5f76cd7ac98b8279b3c8a99f27330e2231265e47f42537de238b72c9855e793f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985822, "uuid": "707bae9c-0cfa-4089-ad7e-a71d52e9bd57", "value": "T1FC46E101B3D695B6D1BF0638D87A56656734BC049712CBBF5394BD392E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985822, "uuid": "738105c7-979e-4b7c-8690-c0da22b9a86f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985822, "uuid": "548add1f-bb59-40c7-a66e-e9475a811135", "value": "98304:7z3us6efPcIdoaxcp8wy5c3trGflkQ5DUOgJ9zlfm:7CfefPlHxcp9ym3WltDUJVVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985822, "uuid": "ad5e6b68-c6cd-49a3-ad3f-99b548c3dd78", "value": 5673952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985822, "uuid": "7e3b336b-0709-444a-a599-3166a8b20c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985822, "uuid": "b0003d0b-2650-471d-b1d7-ea2139c1ab53", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d10b142-63ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780973596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973596, "uuid": "ed2050b6-d75b-4384-8cc9-98e2883e07c8", "comment": "Malware payload (Mirai)", "value": "76574a3e5286372aa0c74fa55aa7811f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973596, "uuid": "d8a461f9-7f20-4ec8-af34-e3874ccecb07", "comment": "Malware payload (Mirai)", "value": "3e29c7115cc1a0cfdedceb010b4c31224ac78dda793813e06807842fe34166d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973596, "uuid": "95a833d0-42e5-4b06-83dc-68658d50dcdf", "comment": "Malware payload (Mirai)", "value": "e490d057731e0761204a07b36e25d4d511eaebcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973596, "uuid": "9b6c2f2a-e7b4-437f-851a-81097557b28b", "comment": "Malware payload (Mirai)", "value": "5535d5f6632c4fae6c970371f117877d41383576930ac5728b9529af552de8416c1f16fb21de1060be4d5f9070958023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973596, "uuid": "29c8c03c-f258-46da-b3d8-1caf768de951", "value": "T161D3C70A9F910EBBCCAFDD3706A90A0639CCA55722A43B753674D538F54E90B4AD3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973596, "uuid": "0e5dedf9-9cd8-4d59-9b34-c50e8026dba1", "value": "1536:chM3RUljgLadT6Cf6m+qeUcn5swQkyy2JHgBYFVvydl5Ot89RFm5:J398vO8ABYrydHu81m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780973596, "uuid": "b614479f-f301-426a-80c4-1d907a87e487", "value": 138136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780973596, "uuid": "6182f3b4-1c1f-4fca-b292-821ac6a4922b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973596, "uuid": "6ace01d8-2ca2-4950-8faf-0968547c2221", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bfee35-6414-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781017369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017369, "uuid": "bdfccdf5-d90a-4d25-891a-154ca8a91bf7", "comment": "Malware payload", "value": "3b68067fe3497691c871f42274adabc6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017369, "uuid": "a5e3f3f2-87d2-4cfc-9a7e-66f6e917131e", "comment": "Malware payload", "value": "3e37053c36f83c855c98cd7303315fdc2cb57e69c7c1512df43a481ee0b63708", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017369, "uuid": "e91629db-5a09-4b3e-8e0d-99a76bd34673", "comment": "Malware payload", "value": "fb3fd42f7f1701e02d198cd94f50c2978e06d9f1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017369, "uuid": "7c057325-51fd-41bf-8c33-05a3c012cad0", "comment": "Malware payload", "value": "4c096a20d4e8f26bf9269fcacf022970b8ca7da8b4e09e8a5ee3708abe941467bff7c702570913f565d45be73c8063ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017369, "uuid": "deb598b5-d727-41f7-8fc3-99bd17339380", "value": "T1510188CEC401DA104295E89E22D726907820C3CF26860BA87FDC443DEBA9A48B01AE89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017369, "uuid": "f5499223-ab20-4420-ae27-e726f4373f81", "value": "24:kXCKysE2hi0ziQvZohahnk5J9F624Pj4O7:e9Qp+Mshnk5Jn624b37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017369, "uuid": "a3807dde-9f60-40ba-8312-2f036dd12981", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017369, "uuid": "c8a95ba3-e9b6-4712-bd27-8326af7d65e4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017369, "uuid": "f02e5439-bd6a-4bf8-b524-5fb1a5823f1f", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26db88ff-63aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780971787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971787, "uuid": "f5636f21-7cff-468c-bc03-2dd07a3e654f", "comment": "Malware payload", "value": "4cddcaebf96c249ad59aa0afa1aad45e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971787, "uuid": "8d95a102-f52b-4765-a4a9-ee8ff87be7ed", "comment": "Malware payload", "value": "3e92944470ab20081922afa6dd08d67c952a738b0b2bf805388467a2cadaa000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971787, "uuid": "8cb35b5e-51c2-426b-9af0-a4e2caab56d5", "comment": "Malware payload", "value": "1cdb28dcb9dca7f45238941a296e34f60a6d7ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971787, "uuid": "05a53ca6-8b96-42f1-992e-98b899aca338", "comment": "Malware payload", "value": "20b73a8df8a7fa4c0e13a6b9f6f544d47240cbfa61dc0038620a5188b5a8465ba221302eeffa74f87b815cb3a261513a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971787, "uuid": "d90b45fa-c895-4a1a-893f-b474a6b8ab5e", "value": "T14C7328791512B22CEEB550B8F40331E524010F183BDC92E378D3A579DE79B88B65AE7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971787, "uuid": "490c2169-72b9-409c-8ee7-bb5c9d5799c6", "value": "768:PYliefv/UQ1XtMYSeSdzK7VfgHLyPMK0oywkhC94dpruGlhMHZbHzD/:PYwupfwLyPMKywkdd1uHZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971787, "uuid": "ad62628b-1d69-486d-948e-a592df38aeed", "value": 75364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971787, "uuid": "07d0789e-f9b0-41f7-8a13-8bfdb915b52f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971787, "uuid": "62645aee-cb40-4c92-a100-f0ead3a516b2", "value": "azsxd.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb7b927-63cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780986022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986022, "uuid": "1410e5b5-bfe3-41f2-8b2b-872c7c1fd212", "comment": "Malware payload (Gafgyt)", "value": "927c6eba5a3c69d579b16f88591a3c8d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986022, "uuid": "6708df73-9095-4060-932d-fceace70af04", "comment": "Malware payload (Gafgyt)", "value": "3ecd73fa5e674766df28d19f2b4f77c1758209ead473af9d15c053744703b19d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986022, "uuid": "c65b8e3c-8082-4845-b1c8-5d93a15b1c2b", "comment": "Malware payload (Gafgyt)", "value": "1e527cf5d1fddf2e5dc799d1d30992db7d792775", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986022, "uuid": "b21d217c-1b5c-432b-9240-5718388db520", "comment": "Malware payload (Gafgyt)", "value": "6330a5f9dc52b612a3d9f686149e27e4462467e9827c4a60ee71e05f86250fb31ab1bd7548a03e3827c9f6d6012c3ca4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986022, "uuid": "07767d7f-192d-4b9b-87a8-bbb186b21e01", "value": "T16A345524BC16D317C0E3FFB9FFE96A8AE718E2C64B8663036560506D1EF5A59241FC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986022, "uuid": "1f2cf80e-4b0e-4aed-b024-727718fd69b9", "value": "3072:/HjfEPl10XeZ60+SvcNcAcTn+S97ecNWcC72nfUDITFwmJdrQP0J/LMP9:yTz+I7RbnfUmJdrQP0J/LMP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986022, "uuid": "fdc8361d-790a-4166-87a5-2c2b8e8101f4", "value": 245402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986022, "uuid": "7dcf473e-60a2-407d-b4db-87fe036279d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986022, "uuid": "9e5304aa-6518-4255-929f-339bdee0ad9f", "value": "dissarm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e3895a-6447-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781039250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039250, "uuid": "72ada865-bbcb-415d-9798-d202a7af9ed7", "comment": "Malware payload (Mirai)", "value": "094e73bf66e25f60cbf598a57fa45bc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039250, "uuid": "e6fb9866-1e60-48e3-a285-80957ec8a489", "comment": "Malware payload (Mirai)", "value": "3f2f76194be8ef9dcca6820a0ff688ea4c7995c970096cb4d5ff87cb3efa1af3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039250, "uuid": "0f9f2ec8-dcd5-45d8-92d2-a6ec6095c9d7", "comment": "Malware payload (Mirai)", "value": "4f5980364e0d7a4cd7fb73ee7e4524977c56c572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039250, "uuid": "f3f471e4-517f-4c0c-af73-49205fbeb97a", "comment": "Malware payload (Mirai)", "value": "0ced2c1f3fdde62d4200162793033b3494a0cdef9a8760aed107506d0c29284cd9939342176d120b1d713acda0708d41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039250, "uuid": "3f47cd31-fa0d-4911-82de-8e179eeee303", "value": "T1F2A3021916BE78B044B444F3BD740481647BAEC89EAE0C53FB251D391967B5BB7E0AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039250, "uuid": "6f6b4ab4-1db9-4c06-a3af-b8099615ba9e", "value": "1536:nlEPwHV2QaZmbCekc1uVOaukaGHl25459WsYVve4FWpehbqngL/xNod/yaFhnfNJ:nlvMEpN1uVHzwXW0qngLTodHFJ6IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781039250, "uuid": "af241eac-780f-4517-941b-fcfdb5771446", "value": 100764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781039250, "uuid": "fc424bd8-e549-4e88-9706-4249de5daa3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039250, "uuid": "8f0976f7-6ca3-492f-92d5-78b99ada1109", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14af4ad9-63d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991084, "uuid": "dd38eb0a-a5ee-40cc-9df5-9197be1aed91", "comment": "Malware payload (Mirai)", "value": "2479041988e4434965392d1538ca4710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991084, "uuid": "ae867655-905f-4cfa-88cf-b3509e333c28", "comment": "Malware payload (Mirai)", "value": "3f94454e4d0936cec3238bbeaa19beb16b1abadb8d2d238754860e43748fbad7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991084, "uuid": "f44821df-f1d4-44ab-8d35-39457657708f", "comment": "Malware payload (Mirai)", "value": "279f342eb754aa9db87f065bc395cbb636c1a927", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991084, "uuid": "487a81aa-fc9c-40d8-b228-76b76985f113", "comment": "Malware payload (Mirai)", "value": "11101f8a92f4217af9c6c3e00465c0785dd09beda145d0c60733e56a788eb90137c908b2d8a995392374487192e205b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991084, "uuid": "a5f2a646-486e-4e36-976c-3d9fa8588a2a", "value": "T1D7E46D9DFE4E3C42E2D7E2789B4D87E1B21B71E0D32391A37582034DD5C69D9CBA1A21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991084, "uuid": "30f12fd4-be77-49be-a290-a96127dbd563", "value": "12288:ozLnD59hv1UPMH0o8ZuxFn0t04EIFryQYiWIhTGa0i1o7uw5XKtLV:YLnDpv1UitxF0y4EIFu6jyWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991084, "uuid": "cdb28d03-066d-4753-9814-0ed9ba69fd3f", "value": 708976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991084, "uuid": "bae71b0f-29c9-49e6-a3e3-42aa4988b70d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991084, "uuid": "29581523-e9ac-444c-8f34-5755f892e27d", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2920c00e-63db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780992836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992836, "uuid": "b85ad007-81b3-4d6a-876d-7cf8dc8e2654", "comment": "Malware payload (Mirai)", "value": "c6f670f61a9ed997b13bce889723727f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992836, "uuid": "2f95398d-c82a-401b-8fcc-8f99bca3693e", "comment": "Malware payload (Mirai)", "value": "40dd117e477760d96c445a67e65892af405122c54f5dbb99bce4543cc55aabdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992836, "uuid": "21030e59-2c74-481c-aaff-4b8c7707e0e6", "comment": "Malware payload (Mirai)", "value": "0da0fcff0a1a7e25c14e6de860c6c8a0be18d356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992836, "uuid": "fa7812d7-c959-42f5-bec3-2693e8e91f2f", "comment": "Malware payload (Mirai)", "value": "15d0a403837c5ff6f59bb3d1e51726889b4ec6a5441948f2db5ad3cb392119b9f7a5eb54cbee8eaf01a5a92a8e1640dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992836, "uuid": "48809155-9e8a-4291-af98-f040dd29dbc4", "value": "T17AB31A52BE418F13C5C321F6B7AE465C3B136B79D7EA3102ED257F90238B8DA0E66611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992836, "uuid": "fc85bd15-39d8-4788-bdf6-d8f1a6e9e3ab", "value": "1536:iOCMwE/uw1uGMNyISdlK6+f065tujpdlv9L7xBformRCXbO+wpPdgMJEZrnUZkfS:Lwvw1uGvINMau13FnxBfElWgay7CDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992836, "uuid": "9ab33849-474c-4223-9895-499da564cd90", "value": 118140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992836, "uuid": "444d08bc-ef97-4b01-b3a8-d9a2aee0464f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992836, "uuid": "c98a521f-609b-45ba-92e6-a7603e57a6d1", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cd840f-63a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780969507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969507, "uuid": "029ca003-f10b-4349-b56e-eb6bae6ae84f", "comment": "Malware payload (Mirai)", "value": "2880b844ab91d86864f93534942aa086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969507, "uuid": "303a2a78-8e62-4f63-8711-b8ff9b1a1766", "comment": "Malware payload (Mirai)", "value": "41dafa9619817371bb2f59375d10f26835f318a1811978ec9f074e235ed6014f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969507, "uuid": "b63ddc11-8231-4d9a-8c8a-58af8059a29d", "comment": "Malware payload (Mirai)", "value": "937796395030a8aea5a9685d877b7cad8236139f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969507, "uuid": "479964db-8640-4c57-a9ea-dba2868f768c", "comment": "Malware payload (Mirai)", "value": "dad5e1d3c326fd274fc41085b2bcd2d952528e5fbf4afbdfb00846c2051662a437bb8be91085ce7ce49cef43aab4eb5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780969507, "uuid": "10c48fdd-fa3c-46b8-9bfd-111bc880dfcf", "value": "T171D30945FC459F16C6C265BBFF4E428D7B2A0768D3EE720399256F20379B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780969507, "uuid": "f86ea105-f0ff-4c2f-b9cd-c6deeaa99c01", "value": "3072:FSuanS0OTYycUuB5wQFJhfLR4I7ZjmMWu+w:F+1m/ctjwyJhfLG+Zjmvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780969507, "uuid": "14414033-2877-4235-8042-11bdfc406c9e", "value": 131928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780969507, "uuid": "6e1fbeaa-139e-4a23-9e9a-478ac8cdb1ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780969507, "uuid": "02a6f77a-6539-4809-86bf-a4a731cbe628", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404b9524-63d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780989439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989439, "uuid": "343e8417-4f57-49fa-b9d1-2283152a8188", "comment": "Malware payload", "value": "d17a93808189197c17fc0434b234b1a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989439, "uuid": "e02dd52b-abad-4d36-b9ee-34901de81f83", "comment": "Malware payload", "value": "42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989439, "uuid": "0d532da4-db47-4b57-a45b-33706c2ff3a3", "comment": "Malware payload", "value": "9195ed3bcdf890fecace24ed38a8e0dfdca20a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989439, "uuid": "d95c420f-0afe-4707-a5c3-4922c01a165d", "comment": "Malware payload", "value": "2f9555d4d0c477c4d9f1357eafc04fafb70f785b4442345298f7c0817179e4b0661b272f00567123a51b29a159214206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989439, "uuid": "df1dbace-4186-4ad4-bdb5-7db8f3e758ab", "value": "T171F733E4126AD172DBBAE6BF50205F317358430692223D1B27A9B46C763C786672C37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989439, "uuid": "f23cde38-61b3-46d6-9bd6-7ae2f573f160", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989439, "uuid": "609fb150-4736-4512-aa02-93be6de5cb49", "value": "1572864:At9IKP1K02VRWYpjzuEK8PfZikmOkP9N5cdJd4OSP0OfurISXt7:AUKQ0yRW2zuEhPobOiNKd4/3sXt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780989439, "uuid": "e385b226-f376-4136-8537-420a66e2856c", "value": 75897957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780989439, "uuid": "fb570078-23eb-4a49-aa15-a01e56d30844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989439, "uuid": "c23fd0ea-adcb-4e8b-86da-834d6a7e0d34", "value": "ClaudeMythos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d476d102-63f0-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781002143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002143, "uuid": "2e546b5e-8ab1-466a-b0f8-c224dc51fee5", "comment": "Malware payload (RemusStealer)", "value": "031117a2bf05d0971d73a7ef6216f767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002143, "uuid": "452ee06e-cb1d-4da1-9e32-d4fc6d9cbf96", "comment": "Malware payload (RemusStealer)", "value": "438ddb05451660c60d9843e3a32faca34a448071c716083c96cc97c781878563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002143, "uuid": "78d97841-9002-4a50-8957-ac193fbff51d", "comment": "Malware payload (RemusStealer)", "value": "74f3a03c9124775aec7d761f014ee374bc3df8f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002143, "uuid": "1ec67757-2d02-4944-b296-3d11ba74cf35", "comment": "Malware payload (RemusStealer)", "value": "c7aac63e2ac1a39cf2ee1eedb39aaad7a00627168be444ec3614ee6c9fe33f12def704e3ad94a9573278aa625bd32a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002143, "uuid": "ca0d810b-8489-407d-bf28-1f7a94e5b2f2", "value": "T1EDB52A06BCE109EDC496633289F22596BB25BC440F3613D72FA1BB782E76BD06C76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002143, "uuid": "20c09597-ab4a-4e3c-a8ea-725331e28fc6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002143, "uuid": "3b90fe07-a27b-4bdb-8b7a-949a37b56485", "value": "24576:jNmnxU0t3RHLy+NDqmkCKPhNV60Mz+wHkgxMvqap//nBele7tKDyiRthkS:jNmxU0RRtNumkCINV1YuRnJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781002143, "uuid": "5ef37346-2951-46ca-afde-d6dedc7be136", "value": 2340488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781002143, "uuid": "ae9b723e-fe73-4eaa-bd5d-d76827ad92f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002143, "uuid": "a656065c-2c87-4000-a28e-d7ad1ac59dea", "value": "\u041did\u0435sinstr\u0430\u0440\u042564-v.9.812.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11653dd6-63f3-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781003104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003104, "uuid": "2c77e098-b56e-4dc4-be0d-03479bf4e75e", "comment": "Malware payload (CoinMiner)", "value": "26de8c37fb6061d53d738441c0b11d52", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KBAgent", "colour": "#9A691F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003104, "uuid": "11033fac-c7bf-4d1c-a3fa-0ad492912bb4", "comment": "Malware payload (CoinMiner)", "value": "43a85ade4f6c9c75e87cc893795af7bd439c9cec810751ee5a23d234d5def9c9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KBAgent", "colour": "#9A691F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003104, "uuid": "839c1a7c-d343-469a-afb9-39d6709afd71", "comment": "Malware payload (CoinMiner)", "value": "b6d2f68c81dd4af3638abdedad30f3f0922ba0dc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KBAgent", "colour": "#9A691F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003104, "uuid": "05ea545d-50f7-4617-83a8-b5308a53127a", "comment": "Malware payload (CoinMiner)", "value": "f88ed3ee35bd219ac5cc02f629830769a4e5da51213d0f755b52a27c424a3f949afbe8c2f6376e857201c231bf018510", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KBAgent", "colour": "#9A691F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003104, "uuid": "4162e5cc-1712-4d6d-9133-fc8934052790", "value": "T1B8C6D883BFB47158CBA390776E3E6393E73B649D08C7114D5069417869E32AB83AF58C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003104, "uuid": "cd7119f3-07cb-49da-b828-2ab39327ca38", "value": "ce2fbfe6e8ecbd2a09c217db5d802dd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003104, "uuid": "273cf435-53fa-4e02-b8c8-716e6577dcdf", "value": "98304:nm4u7pWjWEn8X+7iUAs4pxN3hSIayku+s:nml7pUi4Mku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003104, "uuid": "7213e3fa-517b-4fdb-a71b-b53c448497e7", "value": 11587072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003104, "uuid": "74ea6d94-daf5-486b-83e9-54732ac43664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003104, "uuid": "285aded5-2c27-4fcf-a279-487676d2fc22", "value": "43a85ade4f6c9c75e87cc893795af7bd439c9cec810751ee5a23d234d5def9c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77caa62-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985854, "uuid": "405a1ceb-b07d-49cf-94f3-211cdb557916", "comment": "Malware payload (ConnectWise)", "value": "57765fa94f3ee27bf72d3fa4bcdd5cf1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985854, "uuid": "03b78a87-d2c6-4672-b541-2ed1570ed3c8", "comment": "Malware payload (ConnectWise)", "value": "43d2e35e27f952e8f4a14d9746a994657fcc55b3f5d5bd03b31e31d2050c969b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985854, "uuid": "6fc08bee-0b8b-486d-8bb3-602e57842f4c", "comment": "Malware payload (ConnectWise)", "value": "24b196c9a94ab12af17c1b2cad7a3e3c1ab09bf1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985854, "uuid": "6410da53-d04f-425f-a752-089b15e269c7", "comment": "Malware payload (ConnectWise)", "value": "f78c237fa1ba4014ec6a949a80a28827544be4810676a2a68194208d48d6f59e0623e0ed86eb8d18c5b5b5748472ef94", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985854, "uuid": "cc7fafac-5634-4985-bde3-76aea67cb22d", "value": "T1C146E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985854, "uuid": "e20ae1cc-c716-40dd-af42-6942f2a3830b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985854, "uuid": "6b5eecf9-b797-42fb-b360-6df1c7119e2c", "value": "49152:sEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:FEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985854, "uuid": "0a7b07c5-6eec-4cde-af94-9e93fd21decc", "value": 5622120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985854, "uuid": "25782358-247a-4acd-824f-3af9bc1ba8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985854, "uuid": "bab54bc3-058a-4773-be0b-e910cda6eec6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f6cff1-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985579, "uuid": "32526a34-1246-46b1-aabe-1919bfd25738", "comment": "Malware payload (Mirai)", "value": "a0268e3818fc3584ba2a3b7249216b7e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985579, "uuid": "dbbe87fe-0abb-4171-b0a7-0e7411128d1d", "comment": "Malware payload (Mirai)", "value": "456990ee7c7c7d2e99f50b132fc42bef32bf2046cb93414bfdebc31b79587ce3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985579, "uuid": "57297c7a-1a3a-4e92-984a-72740e9cd40f", "comment": "Malware payload (Mirai)", "value": "d2fb803b1ae966ab16b22d3829748c79caa30f6c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985579, "uuid": "d70e7bf2-c717-4980-be8a-c4e2d31c1257", "comment": "Malware payload (Mirai)", "value": "c0d6ab69a68d593736d1c279363fd981f27cdcd3ebe2aa41ced8e5896c9ca9d1c54e124cce7464796c48bdf8c8515b89", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985579, "uuid": "e53a69c5-8b6c-4214-9f31-c3e109382cf8", "value": "T11893F782BA43CFB3E84310F152F79B325A31FC7E182BE582E375BDE29A511D1A505768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985579, "uuid": "07eb8c9b-b8a1-40ad-8f2e-b30eeccc63e7", "value": "1536:0tz+ZLan9FdqfJc4RrgGlPeiT0bqpM+yb2cNnSLDTtK:0B+ZLa9PGJc4RMGlPNKqZy6kSDtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985579, "uuid": "c5c2322a-af88-44cd-8d6a-fecaeff228ce", "value": 95076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985579, "uuid": "0cbaea43-1f5b-4502-bcf2-9391eafb5149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985579, "uuid": "34105c78-a147-4c89-a981-6e7e16e14ebe", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd8a2c3-63da-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780992656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992656, "uuid": "0bfe20a4-f67c-489a-bcbc-a16b608eee62", "comment": "Malware payload (Mirai)", "value": "310d7880731b49fac1ad5482fb6baf0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992656, "uuid": "89babc49-bffd-4b0a-ae38-8da356c571f9", "comment": "Malware payload (Mirai)", "value": "4584054446d0e99b8d13dfceb60eb3971604a497d5932af5b8f1ccfefe988d01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992656, "uuid": "6841c732-f573-4252-bd22-72172507e32a", "comment": "Malware payload (Mirai)", "value": "cfe542e52c7f893c72ad565b6be819e4c6fad291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992656, "uuid": "e3f1dee3-cf9d-461b-b7cf-317e82d368a2", "comment": "Malware payload (Mirai)", "value": "c101f09ae95a3ac3e8906023ed0377ebdd1f671c822cb84d2f5880134a9ad221157d218f01eba662c69a904facb9a3f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992656, "uuid": "acf639d5-5773-4934-9c48-16f6a7f038a8", "value": "T1B3C36A7BD829AF98C256D574B0A48FB92B53A59042475FBE29B7C2B04043DCCF9097F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992656, "uuid": "e5a1ce19-9a25-42de-8cad-06b54cdce3ab", "value": "1536:poao/TaVhdWtxwLYj95FgYq7u8KKD3sD4i6CjK+Qlkp8et14LPVWIIz0rAw13aT:poZrUatxwFMb6L+eet0VWDz0rAuaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992656, "uuid": "8b5194ad-4781-4e0a-a9a4-54ded0ed3406", "value": 129632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992656, "uuid": "cc345297-24b8-45b7-8a22-8688e3bf7b74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992656, "uuid": "de8d8331-448a-48b4-affa-53e3dff13885", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf316c3-6447-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781039253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039253, "uuid": "41586512-673a-4647-ba7d-6fd1ed373b7c", "comment": "Malware payload (Mirai)", "value": "9ddf1376d2a33053ad8246fd569b2e5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039253, "uuid": "8fe4f043-15b1-40ac-ad5a-54b6ce5905f2", "comment": "Malware payload (Mirai)", "value": "4590b759a13fd7bce2e2dbd9d802f1241853890cd1bd01328f0cec2e47434c94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039253, "uuid": "a0c2f3ac-a912-4da9-9fd2-03de917c1d8a", "comment": "Malware payload (Mirai)", "value": "9e811924752f98940e90d896192e5fa4eaa9d3e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039253, "uuid": "56138180-bbf7-4a67-bec2-514900bfb535", "comment": "Malware payload (Mirai)", "value": "aac4366edd6c159d41e502b1488773bfd086cbf8343bc80e215b281ad343431e24db4d8fdc4fbade23ac22bcfb177512", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039253, "uuid": "35883b7b-36c4-47c6-b96b-70ef2b73855b", "value": "T12FB31986BCC1C711C5E261B6FB1F928D372643A8E3E67113DD18AB29774B86B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039253, "uuid": "12385b63-815c-41e7-afae-d4bc02b3e344", "value": "1536:WGPKcLX5W1T3kmvP0qE9MmiEf9IeASGSIZnClVSKGhkJNJvA0k+:WGll4TUmvAMmDf9/AmI9CvVtZA0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781039253, "uuid": "c088ccf0-272d-446f-abda-7c4fcfc6d1ba", "value": 111000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781039253, "uuid": "3396362a-b641-4384-9fa5-b0d986254981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039253, "uuid": "cc8606e8-26c8-4398-937b-1e0556dba696", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4d73ce-6416-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1781018475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018475, "uuid": "111450f8-14ff-4e72-bb22-4a0b49226ed5", "comment": "Malware payload (CountLoader)", "value": "ae5581378adc4af1d6ea52700e0982b1", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018475, "uuid": "62176283-c43a-407a-9fd0-69d57af05cc4", "comment": "Malware payload (CountLoader)", "value": "462dee7c6980414d4b0774a46b38bb54da2d64b11b6f191137e1433c9b6a81bf", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018475, "uuid": "bbd0e13c-8582-4fe0-8341-0ad7d5f687a8", "comment": "Malware payload (CountLoader)", "value": "36a9488375adfbe184b3dbf21466a2fca1dfb6ea", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018475, "uuid": "bcec3c4e-facc-48db-aa29-37d4f334a65b", "comment": "Malware payload (CountLoader)", "value": "725bdd5325b72c536d418adb5acca4e49209a573661aa1e7d0a3896bf8b4539552c4850fe7c3ebdcd169e6ec6c4791c3", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018475, "uuid": "d5a8d31f-ebc5-4786-aeb6-26d557dcaac8", "value": "T17CB4AD03FD92D97AD51940B02D78B39785ADF942073159EBB2D6C93E5CBACF08A3D260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018475, "uuid": "26e240a5-ee83-42d6-a7ed-6c8ae95a4579", "value": "c1b5f476d6680d12280e06bb8d4b5f9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018475, "uuid": "6cb4a991-8511-4a01-a71e-938485038875", "value": "6144:zMMlTpyaFO/B/r6vDa3Mdrz6Xx8wZRPJB4OvUiUAg8xXRKbbITjJKoGGLzc:Fyaw/h33MZkZRP0Os2hY+Kqzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781018475, "uuid": "6a3472ea-0942-4d51-97a4-c32e7ccb9091", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781018475, "uuid": "e6cd39d0-6997-45c8-b638-f6034d96500b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018475, "uuid": "5981f4eb-88c1-445e-a21e-8da3c52317f6", "value": "package.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c78387-63b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780974307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974307, "uuid": "b0a610e0-4375-4931-9529-af6aa374ee22", "comment": "Malware payload (Mirai)", "value": "7f5f6d8a3a4597c840920e86086f40e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974307, "uuid": "aafd0830-b6c1-4a60-b1e0-279dc07db60f", "comment": "Malware payload (Mirai)", "value": "462f81f0d0de893a40af01925d419a3dddb3f5490f74c17ce60a27b452ab357e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974307, "uuid": "29d8bc71-101a-42fc-ae2e-d5e707499439", "comment": "Malware payload (Mirai)", "value": "d6b526504a4c1c04c9a5c783826308bf04fa1476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974307, "uuid": "3014e281-51ea-4e42-82d0-08e755d634fe", "comment": "Malware payload (Mirai)", "value": "18f5ef26bf9ab3467f6a21e9d6acb4754b3b1c20dec97aa911cb5884672b3edd69db8c328c9cd60256581fd19ca5b757", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974307, "uuid": "3750aa69-5321-45b7-adfe-eacffacc9ab5", "value": "T1E0D3885A2E228FAEF66C873147F74925976C23DA33E0D684D29CC1146F2039E545FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974307, "uuid": "6aa0cd4a-4bc2-41ba-a6e1-a4866d92e518", "value": "1536:MKVl5zuOh2HjUz4nr0DeU0IBSgN1ETiYIK8tr3nvr:MKl72DUz4nru0IBBuIXtr/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780974307, "uuid": "66650f2b-2376-4724-b29b-bcab8eb3b893", "value": 137304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780974307, "uuid": "ea67ab8a-0e0c-4398-ad36-6c5f4907d6a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974307, "uuid": "7844fdf5-e035-4178-80ee-f076a976f718", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582e10a1-643c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781034576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034576, "uuid": "798dbcbc-9c07-4d67-9f65-66c1720c3a7d", "comment": "Malware payload (Mirai)", "value": "268ba87f58131d2cc75ea95d944ec93b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034576, "uuid": "d7bf3cb3-0575-427a-9453-f2ed6cb84df4", "comment": "Malware payload (Mirai)", "value": "467774e4aa80665c06b153d49e2726ae56f3f6ba8e905e978eb086176ac5d730", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034576, "uuid": "ca16a137-8dcc-4340-b284-5291e166b777", "comment": "Malware payload (Mirai)", "value": "aa2ab927df1efc3bfab81be0b434b4d33c6b9ff6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034576, "uuid": "c8ae68f9-c2ef-44cb-9762-60fb1736cef6", "comment": "Malware payload (Mirai)", "value": "2bc9f8a9ab2948e76bd6fb9be5809282b36be2c8620220bda3afa7ceb0a2bcad62d06b23c29890f8cbc84c19c2e7a831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034576, "uuid": "cd3eff2a-76ca-4c34-a09c-e027131803ab", "value": "T1FB44F70AAB610FFBE8AFCD3702EA0B1125CC541722A97B767574D918F54B64B0AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034576, "uuid": "eb7dff46-cd07-443a-9a29-a730565f9593", "value": "3072:g1IDYOHtZ4gOGaq94I8h0Vjf8pA7wHYUBv26GOd/dD+wsM79:gebH4RFq9zu0V10H5BFjUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781034576, "uuid": "f0fe097e-b452-4610-b9c8-086b085b58f2", "value": 270560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781034576, "uuid": "ae17912e-5573-4263-94b5-dd1e04011a1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034576, "uuid": "01f70c12-5153-465a-bfd4-4d559425daa2", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427c6e01-63ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781000180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000180, "uuid": "0b37b0aa-9d30-4735-b8de-27e4af1afdf7", "comment": "Malware payload", "value": "db8a54993dc50061c97960daab785584", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000180, "uuid": "286d0e3c-aef5-4dc4-8085-669d10af66db", "comment": "Malware payload", "value": "4679ac1b5a2767b37c2631ebdb6a9e2c54439029ec3464984ba452b06e1da49d", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000180, "uuid": "ea5f69f1-d174-40fe-a59b-d199c06b06a3", "comment": "Malware payload", "value": "77583fff7c646ce1f5886b01ad7540013fcc5878", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000180, "uuid": "98def298-c2a5-4ff5-8eb7-ac68cfe2d9c9", "comment": "Malware payload", "value": "376222e47f0b2d84e27cb3693975eda9b49500b62d016c8d06955dfb49019f0022a0ac9b20d1b01fab65faabf06ad6b0", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000180, "uuid": "ae86d90a-65aa-49a0-8fec-2ff95083c134", "value": "T17ED02B688105C067E363E8861204FC90541E74916EC18C9CD1C4C64985894C09B4DAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000180, "uuid": "f3a4b653-252f-4abd-a710-cae4f73130db", "value": "6:Js1Q/QUJtOFJb5if5oeTckmrACLUeJ0OW5BIa7o7:zntOFJQRzgy55BQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781000180, "uuid": "3871067f-c7d4-4edb-8beb-0c0dcfd9ad6a", "value": 255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781000180, "uuid": "dd3dd345-cffa-4ddb-a250-46e606fe6ac7", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000180, "uuid": "563a3930-e881-46a7-ae13-d556b11261a6", "value": "Terms_Conditions.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa18574f-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003065, "uuid": "ac681310-5d2d-4e51-b346-d9f41e655610", "comment": "Malware payload (Mirai)", "value": "6ad43f0280cfc60c95acee537791688f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003065, "uuid": "34ffe45b-6f45-406e-8519-c9ece1031b41", "comment": "Malware payload (Mirai)", "value": "46baf185ca4223f4e9bb3ad753f2a2a293fb26e751f2a67d6463fcefaa1b6af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003065, "uuid": "7e36c630-c191-4f31-b12b-8da8856f4b59", "comment": "Malware payload (Mirai)", "value": "426195bd1ac5fc0040eefec6afedf59a06c02030", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003065, "uuid": "1b21f0c5-583b-495a-8604-844c13dc3c4a", "comment": "Malware payload (Mirai)", "value": "b416a586a272e1e355e5c28ef33fdd8d86a7782be365f43df91b1e38943cb765ec28f89ac1bce699398f95c7a15e7a14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003065, "uuid": "40af80b2-5d2a-452a-ad2d-57a50d09cccb", "value": "T1E6057D42FB1C4523C9430EF0593F03D5F7257A4341F9A62A370EAB672662E3AD697389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003065, "uuid": "37a1cb06-54a8-4f38-bc3a-3896d2367cd6", "value": "24576:fgEHg9oe2WeaVB6cC1+3wGW9E0WkzV6rpXQYtpKc:4Gje2kVB6hw3w59dW4krpXQYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003065, "uuid": "e0139b0c-73d0-4dda-a59d-0a6209e03060", "value": 862684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003065, "uuid": "f2d68776-4d37-4e0d-8260-ab848a6aa382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003065, "uuid": "c2da3e6d-be25-49fc-9377-0490c71174a0", "value": "7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca014cf8-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985804, "uuid": "0171db23-8ae3-4417-8470-69e0bc686be5", "comment": "Malware payload (ConnectWise)", "value": "58b3e69d14d1402696c4536491749ee1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985804, "uuid": "f46973c1-be1c-4c81-8b22-c4a4b088f8ea", "comment": "Malware payload (ConnectWise)", "value": "48b2dd55a0984278039fa8fdce03921be20fe7d6b026a1fbccd02cb1253034af", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985804, "uuid": "dec2d5c0-2e43-4194-8ee5-bcd53b4e0595", "comment": "Malware payload (ConnectWise)", "value": "e7f05e9a4327317cfdf148e6a55d350b19795ffc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985804, "uuid": "2457e615-6eb6-4bcd-9198-be671219e7d6", "comment": "Malware payload (ConnectWise)", "value": "fe5cd1ed860780ed34640879c96f3cc814dd40a67bb1ea92d20677636bf84d3494a6a451cff1ba1313f02df7b5517872", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985804, "uuid": "410fac51-76b8-4a48-bc31-97f96ea7d7f2", "value": "T17D46E101B3D695B6D1BF0638D87A56656734BC049712CBBF5394BD392E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985804, "uuid": "d2fa2487-883f-48b1-a0e7-3c6c3e88fa03", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985804, "uuid": "b276d8cd-011e-4810-9832-c0ca6d28cdde", "value": "98304:Fz3us6efPcIdoaxcp8wy5c3trGflkQ5DUOgJ9zlCS:FCfefPlHxcp9ym3WltDUJVsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985804, "uuid": "9d4328b3-29e3-4031-a238-bee90430e561", "value": 5673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985804, "uuid": "c82595a3-d466-4dab-b18d-7c01276f5719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985804, "uuid": "81de7a70-e6f2-4e74-b456-e3c2f1199869", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e14d8e-640e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781015002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015002, "uuid": "c6ec71b5-0530-445b-b25c-8722d10ff4ef", "comment": "Malware payload (Prometei)", "value": "d63b3b9a783456559d6d9b21e628a02c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015002, "uuid": "e482002d-4db6-45c1-b062-7981f40092d5", "comment": "Malware payload (Prometei)", "value": "48e8ad0a9587c30feea0e800e250ffe96036ca0c201ee90494101012de8579d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015002, "uuid": "353f8e56-b4d2-4ab2-8d04-bb268b0cc63c", "comment": "Malware payload (Prometei)", "value": "d701b99abef16eb2a3776593332b5500c59f4211", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015002, "uuid": "65086b63-8bd4-4462-bbc3-d30f4bdff89a", "comment": "Malware payload (Prometei)", "value": "43e2a3ac985e467760dfec77264e17f0cb977674615b7b492b8b7e695b89fd43fdcd2bdd7e2b7b2eafd4b5f1652523a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015002, "uuid": "7156d48d-9447-4546-a2ee-77fafeba678e", "value": "T1FFF6AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015002, "uuid": "5e6b8e27-676b-4230-8e20-be586542c196", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ/:cqYUQuVDt0TZEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015002, "uuid": "30cc3100-0307-4ee4-81ed-d23c657f44c6", "value": 16089088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015002, "uuid": "f718b716-2d92-4db8-a637-180294946346", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015002, "uuid": "3706ae05-bdb2-481f-a3a8-8993f09f5156", "value": "48e8ad0a9587c30feea0e800e250ffe96036ca0c201ee90494101012de8579d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6664261-63ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781008642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781008642, "uuid": "ae6bd1a0-0af8-40e1-8515-8b3826561535", "comment": "Malware payload", "value": "6984d71547d00e9307c6247f24477c25", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781008642, "uuid": "ebbda611-1592-43e8-baf1-b183ea993df1", "comment": "Malware payload", "value": "48f2a3bfb7a70b97875e56d932ada0d975cd5ee154a99caf7d93550275a1548a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781008642, "uuid": "381f0849-f13e-4496-b02d-49093d253e9a", "comment": "Malware payload", "value": "08299a07eb3c988d2a7e3ec953fc0eb0733bc5af", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781008642, "uuid": "d29f23fc-8f25-47b4-906e-6486cef9e1b2", "comment": "Malware payload", "value": "06930c91ec52fa531abef425abf3e9fbffe7588c0dfa72377de69f9336656155f5ef9c2e2903d48ddbb442abe951afa8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781008642, "uuid": "20cfe023-4809-41d7-abe4-e00d3c40a9b9", "value": "T1FF661278D25DA99FF4CC087BF445022FB8E2E94112517F523E98B990ED4F9D01A73A2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781008642, "uuid": "4d4355e0-a5b1-498b-a99b-ece70cd75d17", "value": "196608:NzeWx9hXwMWOBckWg4qgv9Z/+I7qx6Mv7Nvs2lAxwDYR:Vx9h/QzFL/+h3Nvs2lAOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781008642, "uuid": "92525940-5808-40bd-8d1c-62112aa62e7e", "value": 6979323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781008642, "uuid": "a6f98fa1-919a-4a45-ba58-96430101ab08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781008642, "uuid": "2f2c7a01-4c99-40e2-a2e0-0136675b20ee", "value": "Fintech Demo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e57fdd-63af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780974146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974146, "uuid": "dcf2bc55-6c72-4d81-bd4c-6ab8296ab892", "comment": "Malware payload (Mirai)", "value": "de17870391f3185e29666bc58158b5e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974146, "uuid": "465995e0-1f66-4793-9818-5b9813e45e95", "comment": "Malware payload (Mirai)", "value": "4959eac53a51aea0e767c2db246732586f706b738a09b27e6b7a5f49fdb26525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974146, "uuid": "5ed4a64d-1b37-4741-aa19-49b35f36fd46", "comment": "Malware payload (Mirai)", "value": "76d73894a1fe801efaea5855a8f02b3adb24c8b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974146, "uuid": "1e8917c1-b423-4e62-a60b-d03fc8c321fc", "comment": "Malware payload (Mirai)", "value": "683ad1b535589c46f39ed88b3c9e6906eb2ac491e771d2a987909bbe89cfa5d20bc20841f5ea34c106df197a6afe73d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974146, "uuid": "64cfdc47-6434-4319-8ea4-199efc024444", "value": "T1CB83D605EA429B01D49731FAFB9F425973936FACE3F97101DA249F6123C6ADB0F62112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974146, "uuid": "1380f8d3-7299-4a54-97a2-8766e077904b", "value": "1536:/EnmAonJtsh9p/QHsUva/nFI83JmaA0lmUBIimtragrYFw3T:RjCTYHsUva/nFI2JJQragrWw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780974146, "uuid": "f838a452-5eaf-40c2-bd60-1b314f6618db", "value": 81316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780974146, "uuid": "06b90163-6320-4bd1-b8e5-abb62b4c53c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974146, "uuid": "7f507704-8911-4312-ae41-6e35521be655", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8474b21-63cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780986714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986714, "uuid": "b82f26cf-6014-44ba-b17a-e10066995f83", "comment": "Malware payload (Gafgyt)", "value": "d475aaf2ff755e7cb17fba9113b6565f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986714, "uuid": "6cfc7e45-5b63-4ff8-93cc-13910bf800b9", "comment": "Malware payload (Gafgyt)", "value": "497fe94d2c1998b5eb8197c9f2995f524c1067061e78a38f6792a0fc6467b2e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986714, "uuid": "1c97ea9a-b166-4814-9f1e-27409ba76bcd", "comment": "Malware payload (Gafgyt)", "value": "f04505a2e0eb0627f66fc8bd0e31d2e217ddfca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986714, "uuid": "1ec7ddbc-7841-472e-8135-83af0ab9843b", "comment": "Malware payload (Gafgyt)", "value": "6a1a6f4b48cfe0d1462a7ac4bd453fcded2a045c1d6f1fec5350d4e32e9e8d622b18f53d7db04fa94d745a24c196ddfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986714, "uuid": "e389d80e-8bac-4585-9f47-2294b330b84e", "value": "T186344424BC16D217C0E3FFF9FFE96A8AE718E6C64B8663036560106D1EF5A59241FC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986714, "uuid": "4e918a82-19dd-49a9-b306-12a59d5aca8b", "value": "3072:ZHjfEPl10XeZ66+SacNTA8UKzYLbPKcCjoTfVkMngm+KqQJb4s2Ej9:6NUKzu7lTfim+KqQJb4s2Ej9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986714, "uuid": "270fbdb2-ac8d-4b29-89ec-dc8762426be9", "value": 237955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986714, "uuid": "85471c92-ef08-4054-8b07-3db6c566aefa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986714, "uuid": "9c4fdb4e-3460-46dd-994d-44ce8af2826a", "value": "dissarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a22df3-63db-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780992917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992917, "uuid": "4298b4d1-32b5-46d0-a33e-9fe8ddd7e3c3", "comment": "Malware payload (WannaCry)", "value": "b09b2bf0172ecad25aea48671cd0698f", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992917, "uuid": "2a39cc68-35c4-44f7-8f97-5bb70c2a4dc8", "comment": "Malware payload (WannaCry)", "value": "4ae60a5d73696b50b3f38bc480eb6bbf47dc74d5339bd8d9678866a82985b297", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992917, "uuid": "a890292e-984e-4b39-85ac-1717eff06a80", "comment": "Malware payload (WannaCry)", "value": "2cbecea087adadbb4b7fbd414a1c2fe4aaaf2967", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992917, "uuid": "4e487177-731d-4755-a91e-62e6bc2f4469", "comment": "Malware payload (WannaCry)", "value": "8e81730e35471c53128884df639dc7a251eb39581f0d0cd15c837d7ba3f7098f08217ae3d8f897a87eb822933c8f4d55", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992917, "uuid": "b03ff3b7-636a-45ca-a8f5-faf263d77c84", "value": "T17636E115A2E82B64E7F35EB2217B8B1047767E45895B924E1760A04F0C33F5CDEB2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992917, "uuid": "8f352c36-8ffe-440b-a7aa-77f4870ed88a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992917, "uuid": "efd7b098-ba92-4302-beae-d3c441645438", "value": "49152:jnRnFQqMSPbcBVQej/hINRx+TSqTdX1HkQo6SAA:D1eqPoBhzhaRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992917, "uuid": "cbe98709-68b4-456e-9b3e-66c5c5e7a908", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992917, "uuid": "1787f1a8-db1e-49f2-98d4-e78af9164dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992917, "uuid": "18c581d4-244d-4c75-b286-d04e1af33eba", "value": "4ae60a5d73696b50b3f38bc480eb6bbf47dc74d5339bd8d9678866a82985b297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8188fae7-6428-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781026055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026055, "uuid": "5be53ba3-73e6-4f61-b525-c25f9307b939", "comment": "Malware payload (Mirai)", "value": "ec18a2f75fe6bcc62d1dfd78e18eb312", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026055, "uuid": "13e7516a-bd4b-4f2f-a0ef-1aced076aa5e", "comment": "Malware payload (Mirai)", "value": "4b9899e398e5c7ccef94f13fdd81550285cf2d4cb911800a9e31a00947a90671", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026055, "uuid": "1cbe70af-cca9-4a43-b5aa-8fd6888669cb", "comment": "Malware payload (Mirai)", "value": "27aab7468e0412cdb8654e96a0e0c57d5916bf6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026055, "uuid": "779799d1-10b1-4181-abe4-e47389b44a96", "comment": "Malware payload (Mirai)", "value": "eaa9bdd2b0d2fc1a55c61cf14c646ee3bdf0a18d9068e9ca99f5d0166777d96b22550b397d742ec6abe8ad7498ada415", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026055, "uuid": "9ab62248-6332-4ece-b89b-a74fe99ff06e", "value": "T1D9145C02B31C0847D1672EF42A3F27E193EF9AA124F4F645755FAB899272D321485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026055, "uuid": "83191f1e-cc22-4096-b3d9-17dbc13a7d60", "value": "3072:h8DELLpjv6Y3cKdd//XVUIWJRoqIxsILLR8lSJV+q/nB:JM7oqIxsILLR8IJVbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781026055, "uuid": "1199e6a2-e7b8-433c-9201-bd2a783deffa", "value": 204080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781026055, "uuid": "bcdd2f02-4ad7-446a-b149-80bc7f4bff23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026055, "uuid": "d9fc724d-eadb-411b-9db1-377a4b3461ce", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4d3dad-6430-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1781029535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029535, "uuid": "a72b2d4b-7e59-41df-a8c2-0562c9338a64", "comment": "Malware payload (QuasarRAT)", "value": "0959ee1e998eae665e502999937152cd", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029535, "uuid": "aa30918f-5cf4-4449-8b9f-3761d18a2853", "comment": "Malware payload (QuasarRAT)", "value": "4cd298a3197f1283ef907976ac01b387dc9a44c93432c3a900ba511f48c03523", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029535, "uuid": "5c3cb7da-b5fb-467d-a67e-95f3f8f64831", "comment": "Malware payload (QuasarRAT)", "value": "bc4a7f821e73fef5c1913b4c7b3ca5d246a2dfe6", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029535, "uuid": "3782ce82-d234-42e7-8a6a-ad3d9e9ad54b", "comment": "Malware payload (QuasarRAT)", "value": "dd645ee12f973cc8bc849e30b597d8d6166f259f3cedbbe84aa26ce7cb64efb31f5efb14af248de1882c6b61e5915677", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029535, "uuid": "28b157ca-b42e-4a94-ab2e-b6e8d608e7e9", "value": "T1C3E3128AD6179D61C8E2C4BC1C021AD4B64CCE043605EF65A8549F4F7B16FCB4A7BCAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029535, "uuid": "46d3b202-a608-4e6a-bbac-b362eb869ce9", "value": "3072:xI4WTu8YVbqfbPOesg0JhoJuhbxAZRsXCOGQw2c888888888888888881r8s:xItaqD4T6khbxwRshGNL888888888885", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029535, "uuid": "1c856491-abe5-4558-a570-93d98ba53068", "value": 146327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029535, "uuid": "7077704a-4057-4f90-8aec-d836d3ce0b1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029535, "uuid": "e6fd5dab-5e20-4239-a56e-fd7dc3d7657c", "value": "RFQ-JUNE07062026.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ff8da2-63e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780994980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994980, "uuid": "90d29255-d82c-4df8-a25b-f9c1ec13f631", "comment": "Malware payload (Mirai)", "value": "251ddcfb9daf962541ef972a4efdad84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994980, "uuid": "97d69405-38b9-41b1-abd1-afd731bf5dba", "comment": "Malware payload (Mirai)", "value": "4dc0d4f8cd5c85adfe1390a39c2e30e48b226d4bb2bc81f7f64c537ebaf40335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994980, "uuid": "0236fecd-cf77-4f71-bb2b-0ce5745438e9", "comment": "Malware payload (Mirai)", "value": "17b5cfbbed76aa4274789f5e2f6054c3c057c20b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994980, "uuid": "9e3673a7-12b3-4cb8-ab4c-c8f5730fe94d", "comment": "Malware payload (Mirai)", "value": "9c97e010d4e0d1175e985b85214c1849a3e922b4acefeab13514e5b60f95627e25242396e0909123d62946afcfc41010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994980, "uuid": "459741ac-886c-46b6-8c56-ee38c2c01573", "value": "T1A4F3C71AAF510FBBDCBFCD3702A90A0539CCA55722A43B763674D528F54A50F4AD3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994980, "uuid": "0ec9bacc-3cc0-41a0-8c76-ff79fc78e8ca", "value": "1536:WJjI6Et1Go6z5GDnVEC0rMz41px8amHZOhjRZYW2ZRM4HrP8YUhNgLlD9rYL0w+j:WlI6Et1GTt4FPZOht4JHr0thslD9Q+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780994980, "uuid": "446317c6-10be-40da-9bd5-4ba12f639b1e", "value": 161144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780994980, "uuid": "01e6adde-bf72-4ae3-bbd9-d425ad21da63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994980, "uuid": "c6ea424f-f2dd-4192-9c7f-36cad9959fa7", "value": "CRY.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9737e22a-63e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997316, "uuid": "a872c8b6-eba0-4b3b-a684-f32344fbcc1e", "comment": "Malware payload (Mirai)", "value": "a40cd0f46d411d6ad9b8deb485f2ba09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997316, "uuid": "cbe8e4ca-896b-4db0-8dd7-c2496e41d883", "comment": "Malware payload (Mirai)", "value": "4ee744704952c046ab51979d57a8477344c0a600dd0c7812c084846bf7584159", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997316, "uuid": "2d30b315-e891-402f-a406-6659a76b6197", "comment": "Malware payload (Mirai)", "value": "335256ceba52dc1094df54e07622793322e96322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997316, "uuid": "3dc1d2bf-6dad-4777-b547-67e2df27b8c4", "comment": "Malware payload (Mirai)", "value": "61b6901371ac0adc712359784306122e4142b38972d0371479b1390e53994771046929132d49849e07318e5f84b8e0c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997316, "uuid": "4e028b2c-a598-409d-b909-01c774366a30", "value": "T133A35A73DC262F78C565D4B4B0B88F792B5399A082831FAE59B7C2748053D8EF9057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997316, "uuid": "0762ebaa-853c-4f93-b13d-6ad2e3bc832f", "value": "1536:irAprWeW25Dd1gCZKKpnTRbsSoVLwW2tXCyFUL+yu:ir0rR5DdqxK3sSawWUXCDL+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997316, "uuid": "4f83a0a1-a9e0-4e68-9e05-43831f91834a", "value": 103652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997316, "uuid": "d7a50084-1a2e-4e3d-ac6d-0323ce0dec6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997316, "uuid": "ad34ce42-2c62-4d4d-bb43-94fe0dfa0cde", "value": "CRY.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97252f7d-6406-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781011489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011489, "uuid": "6343bc43-62ea-4836-8195-aca8a5dc04e0", "comment": "Malware payload (Prometei)", "value": "e402e5345acd9719f6f7503cc8c5cd38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011489, "uuid": "c851317e-488b-47f4-a0a4-d5c33c6f0a45", "comment": "Malware payload (Prometei)", "value": "4f0a7f55ae2a82142473fb18e1ac1093029fea5157c2c7d281794b3d476543e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011489, "uuid": "d340cfaf-e613-4d43-8ec8-88d67cd9ce59", "comment": "Malware payload (Prometei)", "value": "9cb4f1bb5d0b5c9cdd2391af5d9b477accc63ca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781011489, "uuid": "3f7ea1d2-343a-4ce6-ae36-3f535e7da98c", "comment": "Malware payload (Prometei)", "value": "7182e11b7d2e981f4a7d3ee09d490ea59c91af131cc667ab93423838eba523bf30c4e7142c3e213c65405b603b301b7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011489, "uuid": "4466a50b-f535-475f-854b-ceeaee8e482b", "value": "T119C423E62D8519E446ECA09A5B58FC5936DCF4348F339C4C8FD008C976A1E7AC59E2F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011489, "uuid": "faabe579-fca6-4258-96e0-0d487839673f", "value": "12288:j+ajEJnjwVvPZ9YqLbWq6258q1ilZT8pTUUa6qgOJuWByZ:yaOwVvvYm3CwpbTqfbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781011489, "uuid": "05977df7-8176-44d9-a6ba-deff44d7d86f", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781011489, "uuid": "8d929d95-f045-4086-9341-3594559788dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781011489, "uuid": "2ed8be65-e74b-463f-81dc-228c3487c65e", "value": "4f0a7f55ae2a82142473fb18e1ac1093029fea5157c2c7d281794b3d476543e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af67953-640d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781014475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014475, "uuid": "9b4d902f-0b5f-4d6c-9921-751e83939ab4", "comment": "Malware payload (Mirai)", "value": "7040e6624cf65c7b2c853f62e189fb86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014475, "uuid": "76c65463-2755-43ad-93d5-530c53be66a0", "comment": "Malware payload (Mirai)", "value": "4f4cf083f86f7f6e3172993b99b970e70aa36627e328c486a875b9e12b5a9502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014475, "uuid": "bea14013-cbeb-4ae6-be4a-994091ab5688", "comment": "Malware payload (Mirai)", "value": "9f56b75bd0acc16485423bc562a59c2c28ae113b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014475, "uuid": "ee16a1fa-2a07-4d2a-8269-02d31d5f1312", "comment": "Malware payload (Mirai)", "value": "80273a13d34a179115c974f1118db318a6a4f9e0269e61087186f3d95fd36d2f5075c748a620cba1abe879fd308973b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781014475, "uuid": "6508e6aa-77ee-46b1-a53f-fb432834956d", "value": "T1ABE32945BD92CA12C6D722BBFB6E438D332723A8D3EA7103CD255F51378692A0E7B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781014475, "uuid": "153fae7e-f1db-42c1-8466-ea77fa1b7bfa", "value": "3072:mnhor+7zBFJ/SR9fznDnYY094K9EPCKSrclF3F0CqkeJ/R31nR:KSBRZzDnYY094K9EKKSrcl5F0CqfP31R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781014475, "uuid": "347d16e5-ee66-4e45-aced-c22e685243f2", "value": 153112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781014475, "uuid": "5846b068-6fd5-4e40-a847-27a013690f71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781014475, "uuid": "0bd1dbf1-9e76-4eb0-8335-eb0705001acd", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077ce9b6-6444-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781037877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037877, "uuid": "8a90d084-9258-4b2b-a7da-29ff6c77ca98", "comment": "Malware payload", "value": "1df0827f454572fb972357da2a302027", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037877, "uuid": "46f36d88-3f95-4f21-a5b5-716bf38904dc", "comment": "Malware payload", "value": "505341cbb6e1bd79ea2a4816d42441bec8d7d0ab131d37232ea555cb80abeca9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037877, "uuid": "48653ac0-dcb6-46c3-bcb0-8f056b262b1f", "comment": "Malware payload", "value": "f5e1f9c0d03e26bec67dec8d73115871a111af73", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037877, "uuid": "5bb5343f-33d6-4632-b727-7c174b24db0f", "comment": "Malware payload", "value": "283a272714c9e71e57bcb82265c90d83c24249706a7b1044c9ad1e052a31bb7344a3bad996f7761b6bc648f4d558349b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037877, "uuid": "aeb6b23d-114f-4bd9-aa09-b48ee84e87c0", "value": "T18001ABCEC0129B6041C6E89E23D76180BC20C3CB56454FF87E9C803DDBBC6887069F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037877, "uuid": "dd0a40b8-dd12-4ff5-af7e-32e38f433f53", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkajIZbp7esGIuABalOsv3I2QYEFkIsusH1Z:kXCKysE2hi0ziQvZohajxLddxE+PDl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781037877, "uuid": "04a15954-b24d-431d-8111-6d8d43901110", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781037877, "uuid": "f7cb6cde-c34c-4a8a-b6cd-d847777f3d81", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037877, "uuid": "45fd7160-05c8-4f65-aa01-edad9f249555", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c38ee7f-63a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780970615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970615, "uuid": "ae3a4c24-b103-40d0-b48c-264e26d0273a", "comment": "Malware payload (Mirai)", "value": "4df492fdeea68a4fa2e63fe8c60289e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970615, "uuid": "d6f361e1-00ec-49ab-917c-ccd333ccac0e", "comment": "Malware payload (Mirai)", "value": "50cca5a76bc4ae53a2da14660506d79c373962d3b06a9a18989485db8c7042d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970615, "uuid": "ca303f59-586d-42bc-8eba-73d388dac42d", "comment": "Malware payload (Mirai)", "value": "321d4599ad650e05b332f856b0143ad0204e4f06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970615, "uuid": "6bf926b6-e4d0-4a55-9a50-2c2ab08bd469", "comment": "Malware payload (Mirai)", "value": "e6ffe9b504cd915045a43123b716a327ea1ba1062b4e7cba594002c31b03ce19a78614955e0158e929d09ab490d6ead8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970615, "uuid": "582ef2f6-ab6c-4f28-a9ce-08e53d269b70", "value": "T12073188578869A1AC6D0537BFA0E43CD372573D8E2CE3203CD619F6176CA92F1DAB191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970615, "uuid": "cac460cd-364a-441e-b741-2bea446933a7", "value": "768:O8XP/urX5fu5X8o27o3MoMPo+l5Zz70ba2cmGcwB7yxqLNIKmmIsqeknu1StVTHS:zXuZaGDFXUaxXlpywLWKggID/gP/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780970615, "uuid": "5ba9a32f-7ebc-4d5a-81c0-7bbdc45b03de", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780970615, "uuid": "258bb766-d80b-423d-9d58-f661f675c37a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970615, "uuid": "848fb1a5-b69c-4961-8ad9-153219a2ea32", "value": "azsxd.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018031a0-640f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781015103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015103, "uuid": "13de2a71-3e84-412b-b49b-0c44303d4bae", "comment": "Malware payload", "value": "5a41ad2a15dde6ffbb56a32ee24af31a", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015103, "uuid": "abd2058f-326e-4f43-8b71-f4fdc73eac52", "comment": "Malware payload", "value": "517923f3d11890f8229add96808c1f3b6c5eebeb80bbef7e6de9c732c17cb795", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015103, "uuid": "7eac12a0-bfed-458b-a262-a977d777f924", "comment": "Malware payload", "value": "b136db40dde9a022c4e5269e219bcf379253c3ec", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015103, "uuid": "d3cad566-e6fc-4de6-948a-347b239b713b", "comment": "Malware payload", "value": "e3ec9164bcbea2e35ae2506cd6cbadcf4f0179da499c1342818bd3621c5dd82d3b33dac413c4d6fc001bf7f697a0c313", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015103, "uuid": "21b2b203-02a6-416e-9e8b-d0b185e02189", "value": "T137F6133FA28BA53EE06E1A397973A218543B6EA164124C16D7F4D84CCF254B11E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015103, "uuid": "6c312469-27da-4c13-adbd-f5bf04bc4a87", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015103, "uuid": "4f7e9c99-c117-48d8-aaa4-62c4123c9049", "value": "196608:gn/ceVnwykQmGrzep3S/JUEOumzMcD7WAhRasJZ:g+HQtzepgJ2umzMVAhgsJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015103, "uuid": "fe8a6658-ae52-471c-bbe9-1ec716179a58", "value": 15272961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015103, "uuid": "95f1a790-6a40-4b7c-80d2-9fd5b5271f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015103, "uuid": "6a52b986-b587-43a2-9af9-091edd051e98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84494a72-642e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781028637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028637, "uuid": "4ed33182-ae65-44da-9826-3be854f89846", "comment": "Malware payload (Vidar)", "value": "2ba38d4f3cab152648b124f82161d499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028637, "uuid": "45fb6f33-2f6a-48fd-8abe-54a860aa126a", "comment": "Malware payload (Vidar)", "value": "54022207ade3848ce047191cd0f1da87e3edfc13fc59f3a0103bc5c6eb339cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028637, "uuid": "a7e16b14-80c6-49c7-8531-014887ad0da7", "comment": "Malware payload (Vidar)", "value": "caa99d485c577b68ff3eba13e7249bcd8924de2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028637, "uuid": "b868ac9e-f6e5-4cf2-b3f0-212941464f20", "comment": "Malware payload (Vidar)", "value": "2a525ea98ee7f79c693260fa975496d7947a0bd149ed17e5e00bcef494627393613f01970fd3d84cdeea35af95f4e222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028637, "uuid": "5303d3ba-884c-4306-ab9b-4e7e062a24ea", "value": "T10FC5BF477C80A07DD8A6B13049A5A1D2B7747C484F35ABC37F42AABC1E367D48EBA354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028637, "uuid": "3eee79de-2c97-4122-9973-fdf441cc583b", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028637, "uuid": "f57e3e9e-1ba2-431e-9cc5-ea970beff56b", "value": "49152:v8q3rrb/TYvO90dL3BmAFd4A64nsfJmo2SeJcK9AIsDCHQiU61i6njgLDrjGqwlE:d3Re4prCI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781028637, "uuid": "b5fbc503-7769-4f3b-b7f9-972ce140a8db", "value": 2708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781028637, "uuid": "484f6a90-dd1e-4e55-b632-0eb3e6309ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028637, "uuid": "995a27c0-2583-4c30-a0a5-8ddddb718fde", "value": "2ba38d4f3cab152648b124f82161d499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9273d10c-63f6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781004609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004609, "uuid": "39f17af6-e950-4db4-bb2d-17293e4ee4e4", "comment": "Malware payload (RemcosRAT)", "value": "9f78f69a37e20e6372bbd17fadbaa5f7", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004609, "uuid": "9f6f098a-2066-4cd0-88a0-d03a6fbd4795", "comment": "Malware payload (RemcosRAT)", "value": "54f31ce59673bcee805a240b73cddfa6b2966c034e17776697cab82106dd99cd", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004609, "uuid": "28e6d154-f03e-45c3-a9c0-3349edfb2d8f", "comment": "Malware payload (RemcosRAT)", "value": "8cc07b354f894428e89e30b70ccf62aced1949e8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004609, "uuid": "37883068-650e-47e7-95ba-2d73c8261f55", "comment": "Malware payload (RemcosRAT)", "value": "5d2faa00bbc469c0d678484aae931917103ea43edfd82e3b529660d9ad7d4d74cda45feb829a00db420fbdb4b97b0e54", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004609, "uuid": "05a41f94-6b44-4944-9e31-6cdf1b33e3dc", "value": "T1E8B312F3E70C7822D105A561477A701B74887034B66DAFE7352ADD00A97BC52A17BEE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004609, "uuid": "9313c1cd-d989-4f17-a273-3ef79ed34237", "value": "1536:e1RA120N5uaFsmKA6r1toHjXMr3zf60QDZWJ9ZKXnhRqFT53U/J6KdVbCvU+:gRehNVsZZtbHf6noTo3hRqF53YLsvU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781004609, "uuid": "5de25e4d-3b23-4c6a-b151-3ceda9dfd571", "value": 110001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781004609, "uuid": "9a258fad-5705-44a6-9d0d-c494a3614d03", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004609, "uuid": "5e8107be-dddc-4d22-8a3c-29150277230c", "value": "nHHA_ASSOCIATES.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77ba4a0-63cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780986713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986713, "uuid": "4b354e9a-b8ba-4fc3-bed5-00a83f1edf9e", "comment": "Malware payload (Gafgyt)", "value": "675f2a92fa404342ad25b8db33bba1cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986713, "uuid": "6a50db84-7b54-4666-b53e-8b3ba7591209", "comment": "Malware payload (Gafgyt)", "value": "56d87972b60f7a87d3362a4eaebf61930546b3fdd872c6fd9ff39eeb95eedfab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986713, "uuid": "346c13a8-a80c-4cef-983e-46494ca965af", "comment": "Malware payload (Gafgyt)", "value": "ce4b4f936291177b90ab28f358100d1f97559db9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986713, "uuid": "c82feb4e-0c09-416a-b7b1-639a0d3576c1", "comment": "Malware payload (Gafgyt)", "value": "3af4b44c2e319012a98a2d1dc2e6accedfb2da71c16ac8f7cf06ed3ae9f519772c1fc392194d728971ee214f77524488", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986713, "uuid": "ec48df2a-3de4-4fdc-aaca-4224ac17b3b6", "value": "T119446724AC26D217C0E3FFB9FFE97A8AE719E6C64B8563036560117D0EF1A59241FC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986713, "uuid": "33983930-5e8c-4b9b-a4fd-e4d039e74f96", "value": "3072:kusMsi6hllifto6jDySatgxrZpe8GUbZwiwqDcC6WiiaP4N/KmbQtlTpYVe:nNatgxG8rLwqXiifN/KmbQtltYVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986713, "uuid": "e037c6e4-ca04-46ad-9b99-0698b32c0a50", "value": 259975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986713, "uuid": "5201b9e3-907c-4c43-a980-ec9486836f64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986713, "uuid": "cd10479b-761b-4d78-a1be-57222fcfe2c0", "value": "dissarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0409363-63dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780993895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993895, "uuid": "b42bbe63-be80-4024-948d-bc8be82a79fe", "comment": "Malware payload (Mirai)", "value": "5a490e238c6534f08dfe119a852d1252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993895, "uuid": "88d61f91-bcb4-41f8-be10-36f6c25b2f27", "comment": "Malware payload (Mirai)", "value": "5758e0e5295fd2d12c7659f30d0144bee1bd8d019780e86c389bda3c02249f2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993895, "uuid": "50fa6b8d-0d4d-405e-9db7-9505eb678cd1", "comment": "Malware payload (Mirai)", "value": "0aa2f799642c249cb0ee90cfce2604515fd34f7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993895, "uuid": "e4acfffb-cb90-4607-89b7-7dd2f79ed4a5", "comment": "Malware payload (Mirai)", "value": "778a6905b9156cf90d09f432e7d912fba63b08cf50ceb3fe831166153defa7c9f1e22f63020860738a776b64452a212f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993895, "uuid": "62058019-a52a-4326-815f-ef7abd165a12", "value": "T1EC04A60E6E228F7DF6A8873447B79E24976823D627E1D644D1ACD2101F6039F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993895, "uuid": "0433d05f-c603-4561-813c-b2c2d1a26093", "value": "3072:A4QRYa9pGtWqv/RadGw3Z9oUmVaZuIRJm9l1mBnHKb9:ARY4pGtWccZBwkRKlABnHKb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780993895, "uuid": "0e0fbe9e-aa06-479d-ad54-7230c85f6944", "value": 186748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780993895, "uuid": "63d23221-27f4-4398-b454-93587fa2775a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993895, "uuid": "9b9e594b-58d8-4c29-ba29-fc2b47b9425d", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db377df2-63d2-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780989269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989269, "uuid": "72ca8ba9-3a0b-4aff-978a-70149ab316a5", "comment": "Malware payload (PureLogsStealer)", "value": "ecf6035f29ce754827106b2c91925043", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989269, "uuid": "2151aa00-7a43-4f67-85f4-0a5825126147", "comment": "Malware payload (PureLogsStealer)", "value": "580d4b2e65dee44be9ebb0eb5ad85346e807b44ccfd61468ece572cefca804ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989269, "uuid": "c60ac67b-5add-4a45-b56e-3204765199d6", "comment": "Malware payload (PureLogsStealer)", "value": "ab9998b1025205e75306cada9f46cdc43f3993de", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989269, "uuid": "d7efdfe1-d1a4-46b0-988a-cd208701c294", "comment": "Malware payload (PureLogsStealer)", "value": "f7ab5d5f750859a579616f8827cb16953e09b08057e34f677b8214e405b62adbf640a518408f1f1afbb5664c202516e1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989269, "uuid": "a3798087-cced-43a8-96ce-1f5d7a7e780e", "value": "T17005FA3DD824422EF032D528C599082FF8A6294B522CEE5761C3375F6EA284677D379F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989269, "uuid": "b58e5585-b8ef-4da9-92aa-e1c44a860a43", "value": "3072:qVJNA9cMDpDXUYMOeFrfrHhUMaghLbEVbEpnwUx1Z7o5wXr8o5p0TTv9UHS3zlE4:B9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780989269, "uuid": "5608b4b4-d80c-46db-842c-905f5982ba1f", "value": 828916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780989269, "uuid": "71e72668-2647-4cab-9968-f8970b644811", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989269, "uuid": "8299f245-25ea-414b-bdbe-d5d22660858e", "value": "Order Confirmation Request \u2013 Revision of Proforma Invoice (CIF Port Klang)_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4535ec76-63a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780970549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970549, "uuid": "f185a54e-faf5-4434-832a-1736dbff34fd", "comment": "Malware payload (Mirai)", "value": "01f64cac27788be2748a15ded358802c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970549, "uuid": "2637e799-8142-4593-8625-db304cffda0c", "comment": "Malware payload (Mirai)", "value": "5833e2344434022e18e22c4b93dc4a7710908fd03312499014d5cabf06bfc459", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970549, "uuid": "cb8f8f1e-f655-4240-a759-fd2a6167abbd", "comment": "Malware payload (Mirai)", "value": "58dd91769b45b67295727f7ed12a835ae90c6905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970549, "uuid": "5e60e215-2f99-44f3-9f88-b679d217aa37", "comment": "Malware payload (Mirai)", "value": "eba76c1f6f7c2453691166a0240836924d3c9dfffd75fee912a4e4896dfab07fbded20ff9eee0d9f6f46b8dcc45b9aa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970549, "uuid": "6b60f99f-a4da-4d33-af17-84680b66c6e2", "value": "T1BC631803689081FCC455D1715B3FA53BD623F07E2135A68E77AA7F267E0EE211E1B18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970549, "uuid": "9d6ae0e1-208b-43f0-b409-b2fe5f4487e1", "value": "1536:T2UgfuDqm6w+33oVgUYpNSk6dmPbGUjhCIN5p2:T2lfur4YqUYpYkCmPbDbN5p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780970549, "uuid": "5b807ded-54c8-4ad4-aec9-9a21a7502806", "value": 66976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780970549, "uuid": "4364300b-5308-44a1-97ee-c5f40969b5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970549, "uuid": "abcb201f-1e75-48c4-9ee3-a3593b90996a", "value": "azsxd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bb5461-641c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781020695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781020695, "uuid": "2a9ff991-c785-4ad9-ab50-a66b055771f3", "comment": "Malware payload (Vidar)", "value": "48a362c15a39cb2e71407ef972bad116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781020695, "uuid": "1754b608-0814-4615-ab61-e4445f468057", "comment": "Malware payload (Vidar)", "value": "5848983e56a91ec19daa15fb8267f97d6be9fb4b34e1fd1c87de2ed205f01c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781020695, "uuid": "771a6583-21e3-45fb-8a76-656c5dab9487", "comment": "Malware payload (Vidar)", "value": "997f4690cde39d5efd5e741d0eaac99423a73023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781020695, "uuid": "e29aa20e-6fa1-4735-81fa-9d63d448a687", "comment": "Malware payload (Vidar)", "value": "2cd33e9f11f5f7955c320ca81c5fa43425da74e79085804b970f49b208811802254c401c6169c3be15b45a9090c6a723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781020695, "uuid": "c8edfd7e-a045-4fb6-9400-2a7ba12389c8", "value": "T19AF55B427CE409ECC0A5723068A27112FF22BD455B6D17D71FE2AE242E76BE12C7AF45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781020695, "uuid": "cd41030a-6940-48b3-8a41-e57abb421c39", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781020695, "uuid": "f4a32ae7-83cd-4757-a70f-3fedc8a92539", "value": "49152:C0Ue3jYJgNpnTS8kUjq79Od6J7Q2VhnA5BK9mun/kkHiGrm7Wo3Bmnj:C6pp1q79Od6JU2HyBKnnMkHiGrm7zIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781020695, "uuid": "b5377676-99dc-432c-8088-27d4e0879c7d", "value": 3494536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781020695, "uuid": "19c3d67e-af36-4381-827e-bc50857585df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781020695, "uuid": "ff734f1c-3477-4188-a699-673f9d8a6fd9", "value": "ToolsUnlock_v6.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134ecd2f-6415-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781017710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017710, "uuid": "a35170c7-ddf8-4d0b-9410-423071b7ce66", "comment": "Malware payload", "value": "aa33789d36bc445749e7c332122479ba", "object_relation": "md5", "Tag": [ { "name": "earnify", "colour": "#DB125E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "maskify", "colour": "#B34B52", "exportable": true, "hide_tag": false }, { "name": "proxy-sdk", "colour": "#6AC10B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017710, "uuid": "c020ebda-7e77-463d-b120-6d5b4c7fb1c0", "comment": "Malware payload", "value": "585cf4b1af749ef7110f5e32da167dfe0dc974f3105733c040edc04549869e78", "object_relation": "sha256", "Tag": [ { "name": "earnify", "colour": "#DB125E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "maskify", "colour": "#B34B52", "exportable": true, "hide_tag": false }, { "name": "proxy-sdk", "colour": "#6AC10B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017710, "uuid": "f0bb017c-58a5-49dc-961d-29841599f582", "comment": "Malware payload", "value": "cef178b314b96c79c972cd9bc0edb4af9f7bc4c8", "object_relation": "sha1", "Tag": [ { "name": "earnify", "colour": "#DB125E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "maskify", "colour": "#B34B52", "exportable": true, "hide_tag": false }, { "name": "proxy-sdk", "colour": "#6AC10B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017710, "uuid": "569be602-c0c7-4e36-aca3-04f86ee79b19", "comment": "Malware payload", "value": "e944cf108446ded1f8d0ca2d791bc42e4e70813ed8ec704130c25cf5ea64fcfb1ba668b39aa0e39758c345f1659281d4", "object_relation": "sha3-384", "Tag": [ { "name": "earnify", "colour": "#DB125E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "maskify", "colour": "#B34B52", "exportable": true, "hide_tag": false }, { "name": "proxy-sdk", "colour": "#6AC10B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017710, "uuid": "0f0e66b3-3c27-4b7e-82bb-3cef7e4ec544", "value": "T163D57D079C1A1AB1C7FAAA7B69BD009CD9F6231536698061A83D5D65FBC2BC4C73F700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017710, "uuid": "d299b734-15b3-4b1c-ad08-071b8445e053", "value": "49152:NAV1IU6i/W6hnDeZt3r1U5gdSCevK7KPVqKUHz/6ar1+LB:NAVS+dhkGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017710, "uuid": "dfacef86-e3a4-43eb-91aa-4cb4ed0aad32", "value": 2755016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017710, "uuid": "98a53e74-9aef-4d27-8be4-84a0f53ff681", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017710, "uuid": "1ea984ac-dc57-4c82-8e1c-f164e9340c5a", "value": "libearnify_sdk.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b370d67-640f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781015334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015334, "uuid": "1535d4ba-f6c3-4431-b541-1d4572f4087c", "comment": "Malware payload (ACRStealer)", "value": "d0195e81de812e55fb8d44599de128b0", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "imap-scriptnexus-cc", "colour": "#0FEE20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015334, "uuid": "9758ec51-5775-44fa-8794-5eab990d57e2", "comment": "Malware payload (ACRStealer)", "value": "58c264abe9e9196d61fdbf8c5e3fd33b86e581c8ffe5562afbcbde52873d0c9e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "imap-scriptnexus-cc", "colour": "#0FEE20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015334, "uuid": "5216f874-bbff-4135-a7af-7833f4a7f461", "comment": "Malware payload (ACRStealer)", "value": "9c7c313df3c4e8d6157a0b121399153b14bb28c5", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "imap-scriptnexus-cc", "colour": "#0FEE20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015334, "uuid": "74d6ce36-21dd-4223-9865-a5c0256d91c1", "comment": "Malware payload (ACRStealer)", "value": "d3078edd503e8d94ea04c61968a42a439c5475c76355fa30fcffa3d3bf8cb0d29c82ff6a6075c4dd02815e4613f12b83", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "imap-scriptnexus-cc", "colour": "#0FEE20", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015334, "uuid": "0fa058f3-0f55-46bd-831a-47295fbbb263", "value": "T141673325F81A37A2F84EC6B005F01D5443E0BD76122B66E1227DB64F9667F2C8F70A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015334, "uuid": "81064687-7e2e-4516-8ea3-319cdad3a4db", "value": "786432:mDtGlO43KixCfTCGLzJT1LC46gBwcniR6PULwbkkbsGo:ctGg0cVhC466wGw6PB4gsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015334, "uuid": "7536fcc4-4304-432f-8d3d-765ce1d57faf", "value": 31159293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015334, "uuid": "7f2ca99e-4f93-455c-8154-f9a794283ea2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015334, "uuid": "df152467-8696-4c09-b10d-fa61641c0ed4", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac16126-643d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035010, "uuid": "8f96347f-8e3b-499b-b4bd-9e892bcd9b0a", "comment": "Malware payload (Mirai)", "value": "0c2c6789f51d4c69d10bb7877473e307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035010, "uuid": "22b5e803-8c81-4738-a258-d50b50609d51", "comment": "Malware payload (Mirai)", "value": "59b585f0007ec0ae52913763f5cd9812a530d89a7835b6f64e93e5fa33d2b301", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035010, "uuid": "00af8984-b98d-4d00-8be8-ca2e6518e826", "comment": "Malware payload (Mirai)", "value": "e87b4f0e7970b0aeaa71da0143be34a45e742cee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035010, "uuid": "6e4fb70a-b139-4c8d-88f1-0638d19f3404", "comment": "Malware payload (Mirai)", "value": "10b42d10e0848a9ce90f939fa61677aa36f1c372177df3ac56651b1e52d3ca4d7bcc6c5293a46f5341fe166d86dc9128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035010, "uuid": "b0d7b3e3-ce2c-474e-b5c4-22bbce20a89c", "value": "T116330994B8819A13CAC516B7FF0E438D7B166398E2DE7343DD16AF24378B92B0D6B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035010, "uuid": "d628cffb-2db6-4f8b-ab1a-06558844ade0", "value": "768:P+Zymx+aUBsI2bd+Wb8MBuk0Aq0cMvCAXTQ2f2d1psVvmuw9bvBKI:GZvs7BRSbRMkr/vCAjSd12ZsbvBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035010, "uuid": "67dc1f4c-9400-4bad-aac8-088a7aa97caa", "value": 54620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035010, "uuid": "0fd1e342-bf07-4ee9-92ed-f15f1e974753", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035010, "uuid": "8e383c01-c900-4b9d-a08e-a015bf669e23", "value": "godisdead.4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7a3e41-63cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780986082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986082, "uuid": "2d1c52ce-11a8-459d-9310-edfae6ef146c", "comment": "Malware payload (Mirai)", "value": "c33386b6ac182c980c27789a976b2506", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986082, "uuid": "241f5038-33b4-4074-9789-4ea871100f2a", "comment": "Malware payload (Mirai)", "value": "5a4d7866af1f44324b74645abf15de8ecb6f0d756b7f7fd3764a8ed3497d3e14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986082, "uuid": "4e8cbb57-a58a-48ba-920a-1ccee6a626e2", "comment": "Malware payload (Mirai)", "value": "b010d1da0a8373e101514344547a9f8a06d4a305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986082, "uuid": "816b9a24-e595-421e-b0ea-23c1a8b12b9b", "comment": "Malware payload (Mirai)", "value": "9f359e15c3353c74f2a198bb342505667c0a1b5240dc6793a27e5af5ec30443ecb0075b00afe8644fe4c768136aa5d5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986082, "uuid": "25086cec-1041-4bc2-9cb2-30f28c027931", "value": "T127E31956F9819F12D1C151BEFE0E128E73131B7CE2DE72129D246B747B8A8BB0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986082, "uuid": "612155de-ff6b-4e58-be29-fddc7f748e9d", "value": "3072:O2JfVx3jQ3R9Aht5anFPmbLNaEdjuBpVLmsrK1ckJB1Dq:OQnUR0t5anFPsLNoB7LmsAcklq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986082, "uuid": "b38a499b-fb5a-431f-8ae9-e0718771e825", "value": 146516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986082, "uuid": "da45f1ff-80f9-4b69-a894-bc836654bdd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986082, "uuid": "38d49396-7e59-41e5-b4b6-ac4cff0d9364", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089b6222-6444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781037879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037879, "uuid": "24e2ad4c-78c1-4eab-93b3-2f305252c219", "comment": "Malware payload (Mirai)", "value": "5f6e9f3a72bbaeaf11b351156e0de809", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037879, "uuid": "a229c3b7-b674-4a5b-a08a-32338e7ea412", "comment": "Malware payload (Mirai)", "value": "5a8042b3167d3f225beed63233bd2efcf5699af02666b9673b4bd7e8b5566ef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037879, "uuid": "31618378-d775-455f-b3c8-9f4bab46fa0d", "comment": "Malware payload (Mirai)", "value": "34a5381987e036c8d205e12743d270e5e3bcee30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037879, "uuid": "ad49db21-075e-420a-84b7-61bd20bdc786", "comment": "Malware payload (Mirai)", "value": "bc65c5fc2c6072f45255db3cb2bbf2bafdb9cf39cd0dfe63872af2f4680675e07942c0a52e0b9f15f88c09fe8bc99db1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037879, "uuid": "5c81581b-033a-4727-9d1d-d197a2a3de20", "value": "T193C3188ABC818B11D5D625BAFE1F118D33534BBCE3FA7113CE145B2A678A85B0E37641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037879, "uuid": "cd06c85e-af48-4adf-8f9a-bbdfd1be6018", "value": "3072:s6DRA7/7E2wQDBERny7I35Zu5eMgDbwTwaUSdW1pRFsYPeeT903ga57:QTDay7ILXMgD4waUSdW1pXsfeJ0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781037879, "uuid": "738c6734-bffd-407f-8f75-aca266219689", "value": 128804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781037879, "uuid": "44adeef3-7aa1-42c2-854d-f69bd6500279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037879, "uuid": "3be07fec-fd9a-4613-9bf8-6c598f9c8137", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138bf723-63d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991082, "uuid": "3345c0e7-2be6-4d3a-ab22-cc380adbc430", "comment": "Malware payload (Mirai)", "value": "df3cd9f3c5720aeb68ebcc03b1c58b8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991082, "uuid": "7b4c8b07-7c75-4522-907f-5b31c82973cd", "comment": "Malware payload (Mirai)", "value": "5ab9b592fa3dbc80fe03167cf63b5c3a7a2a6049433bf3480863f2dbf84f1f32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991082, "uuid": "6fa17417-24a2-4598-b41b-adde1e9b56f9", "comment": "Malware payload (Mirai)", "value": "a13efbb95bda58726e44643f983a8170ae50eda2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991082, "uuid": "b0d2a918-7c0a-4045-a73c-0f37b4d818fb", "comment": "Malware payload (Mirai)", "value": "fc2520927160ff3fc28cb5825b092a94e003a3ffc2742e1a0b53e89b64cc8511e39daeb22d35d5d65705b81b3ccb31a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991082, "uuid": "9e445918-f926-46f3-86a6-f1be760ecdcc", "value": "T1C5F3964A7F228F7EF269877047B38E34975977E616E1D690E1ACE5001F202CE641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991082, "uuid": "9f159d85-08fc-4b60-aee3-9a119ca37b4c", "value": "3072:O8qEZaFjFTYsTnY5DOmntLNqA9SnR5K67wnUM8hg:zqEZM5csbY56mnjq5R5RCU/hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991082, "uuid": "96cdf260-962f-44dc-8ec6-7eb8b11ebd63", "value": 159696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991082, "uuid": "bbdd3cf3-6d64-44a4-aad0-d60ad7c8f708", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991082, "uuid": "57a4d8ae-7d6b-4480-9e46-557e6ef38318", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09209120-63f3-11f1-a769-42010a9c0008", "comment": "Malware payload (TruenixcideWorm)", "timestamp": 1781003090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003090, "uuid": "0a44d119-1a19-4579-8c8e-3f2d228421e3", "comment": "Malware payload (TruenixcideWorm)", "value": "83209325e9632bdcb9e8ba11dfc1fd99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TruenixcideWorm", "colour": "#7BEBB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003090, "uuid": "86c8f777-ac7a-4a83-b70a-434c582965fb", "comment": "Malware payload (TruenixcideWorm)", "value": "5b03b2c09616a0e3784dda11ab3f61077e2f7d854d99106976c3e6ec8ee2b97b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TruenixcideWorm", "colour": "#7BEBB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003090, "uuid": "986de5fe-2efa-4324-ad61-204382b99bb9", "comment": "Malware payload (TruenixcideWorm)", "value": "a43236382b6016eb4d027fec3d61d21971fb8c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TruenixcideWorm", "colour": "#7BEBB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003090, "uuid": "cb4bb351-152d-4e86-b2cf-b1d352a34bf3", "comment": "Malware payload (TruenixcideWorm)", "value": "b19e2e9903f70c643e48fda9d637a2e5bb318d5eea8c31ea8e7cae62f62500905a6e1f01f99b2c92c26d0711ab9fe084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TruenixcideWorm", "colour": "#7BEBB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003090, "uuid": "d29af5cc-bd6b-4ca6-b022-e17b15b25ba4", "value": "T1E3530ED47AE85CC6FA14623C51E6D2322A3DF6D0CA434B47A530B6321A13FD17DDA62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003090, "uuid": "92e8502a-d4f4-48a5-ab70-c809599aaebc", "value": "a49985f433a2c42fe1b226d014f9f9cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003090, "uuid": "d33b223d-bc44-45d9-973c-8b81427c08b9", "value": "1536:8W5SVoFZG940UG4IZOkX+EWuFy/sHZlynY0CIeISlAEGz72OjXkAPMAm4BfT4kOE:8fVoFZ04iYD0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003090, "uuid": "6c122867-cb47-4060-8066-4eab56529ed3", "value": 65958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003090, "uuid": "a4a1ee15-dae1-49b4-9ef6-e02f4fd120a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003090, "uuid": "ab19031f-c06d-4a7c-9b2c-0b7baa5f289a", "value": "5b03b2c09616a0e3784dda11ab3f61077e2f7d854d99106976c3e6ec8ee2b97b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e294ff-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "86e98cd4-ecd5-4bc2-b0fd-e332dab52c64", "comment": "Malware payload (Mirai)", "value": "de5b61d5ea652482c07d9f3649f8eb88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "3cdead61-e729-4f41-8c64-995df6942f3f", "comment": "Malware payload (Mirai)", "value": "5cea07e0da148c609bd5e69d85a7106aa32aaa1fbc495d3127dc740e92773916", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "1e5abe1f-732b-4dba-80a2-574841d813fa", "comment": "Malware payload (Mirai)", "value": "6bb088c31b420365ed08629d1dfab3391eb2b061", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "d9ead5a6-9f00-4238-97a1-ec1260829efe", "comment": "Malware payload (Mirai)", "value": "76e7edbe1cb9dfd8632a575b84063502e7296f32f4c4a7e9693b1348757fc19a61ddf37886e2890977ea5564199e309c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985578, "uuid": "34775b70-f0a7-4e19-b584-77abbbc11253", "value": "T1F504861E2E128F6EF269877007F74D245B6877DA26E1D680E1ACD5501F602CE641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985578, "uuid": "92c60cad-63ba-4c2c-a345-4bc21d6f2bfd", "value": "3072:ESXcJiSOfC+14ctJ71ASL6RK+wCgWmCchART:ESMJiSm4eJ71AC6wkm/hAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985578, "uuid": "b5b3c4a9-f84a-4710-a403-03bcae8af56b", "value": 179128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985578, "uuid": "013edb2f-ca07-4111-b235-b85f6934e155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985578, "uuid": "b6a2a46b-b93e-47e7-8d41-f5d1d0027f92", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989fb215-6430-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781029530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029530, "uuid": "ac3b69bb-57e3-401b-8cf2-c2bd4a25b179", "comment": "Malware payload (PureLogsStealer)", "value": "08f9ec5e97bc23852080823cbb853042", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029530, "uuid": "8fda9f86-ff62-42d6-994e-4116597b4213", "comment": "Malware payload (PureLogsStealer)", "value": "5d3d0d9bf83719b07af3b3e16e385636e175f4219d8cd77adc39a43da0056dd8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029530, "uuid": "2a1a88c8-d44e-4386-9ca2-52b2ad6f3eaf", "comment": "Malware payload (PureLogsStealer)", "value": "b52e20fffa0a4ccbc60af6c844cbdf3d06db2d3a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029530, "uuid": "10bdaa36-f8f0-4a7c-8509-c598e746356a", "comment": "Malware payload (PureLogsStealer)", "value": "bc79bfed99cf8354b98a9e0563cd4d0d7dfc83e51320641795e8c9a14672fef786e2963dce265984b1033127b5a361fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029530, "uuid": "7a02e57b-8bf9-4392-899d-9464177aa1ee", "value": "T1E396623403949631F3549B9A2AB5B428640D5DCA98F9E7013A5EC7B4127EC33E3BB7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029530, "uuid": "7417a0c4-2bdf-4f1b-85b8-f7e2cfeaf924", "value": "196608:Af5uTUp/XRU5flELe+9pDi1ovMljXxdtJYBgDlGMFiU0h7iJqfxnrLoMFXxmxq8A:Af52UefyespDiuaXxd15IxM/3T0VPH8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029530, "uuid": "5afb0f1e-37de-4008-8c24-1118d1e6a10d", "value": 9196687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029530, "uuid": "fbf688cb-6b6f-4776-a476-196c7c198733", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029530, "uuid": "9ccd8476-520d-4a7b-a58e-8c2e12db89ef", "value": "nicetechneedmebesttechforme.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c0d5b0-63e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997399, "uuid": "0b282916-48ef-483a-983e-330286d6311a", "comment": "Malware payload (Mirai)", "value": "c88fe153ac61a7a3207810f6a7d8b39b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997399, "uuid": "3987a15a-b48e-449a-b9ac-401cd1977002", "comment": "Malware payload (Mirai)", "value": "5d6709fc2343bba69383fadc5ab39318179f16e56623af6f1cbf69146dce2e56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997399, "uuid": "f09c6629-ced0-408d-871e-b11d72939f30", "comment": "Malware payload (Mirai)", "value": "6a2efca35a62b1b4a1f04906e5d3a6939cf82d18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997399, "uuid": "63bf0a69-fa0e-49ae-81e3-0f07fb2a08a4", "comment": "Malware payload (Mirai)", "value": "6846cc443b0d31609f372aaee658c7d40efd10de13bd239338323d03d88cdae67fb7efb3aaa8342de1d4ee6a85143d20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997399, "uuid": "ede30115-ceeb-4f40-a268-98208ccbffa5", "value": "T16DE3F946F8819F12D5D2127AFE1D128E37131BB8E3DE72129D246F60778A8BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997399, "uuid": "048b8f11-6c6a-4976-a727-1e8bfb24c16a", "value": "3072:ohZ+5z5XcG0UL8cR8XC9xgBQamyxVTGalU4iPrJ:MZMzVcG00r8X2xgKa5i4iPrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997399, "uuid": "d18ff09c-9389-4e91-88d1-4e11a614fb6d", "value": 155516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997399, "uuid": "e72a9dd1-664a-4043-891c-42d365f0f9b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997399, "uuid": "ff366833-0e0a-4d3d-b92a-8b1d9551c184", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7122a47e-63ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780972341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972341, "uuid": "c910b3bc-5b26-40bb-b7df-8dcedefba42e", "comment": "Malware payload (Mirai)", "value": "fd92c382c9f36f740f258b280b6d2c1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972341, "uuid": "02e93947-6c0f-40c3-ac34-df4b5f37aecf", "comment": "Malware payload (Mirai)", "value": "5d91349723270cc024e60265467a1392ca4da5d34b12b5588b1e298e2da3410a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972341, "uuid": "fec1a102-4806-42f4-9fe7-7ebb96fe5b40", "comment": "Malware payload (Mirai)", "value": "de5e5e611c6adaede29576913d24184e51e6068e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972341, "uuid": "7ba33c09-8ea4-4d11-93fa-74d18713fd3f", "comment": "Malware payload (Mirai)", "value": "4e60e2ccab9afd41461ae4670b8177728b6e4134b9cb286e1f70b3e25e1f317c19aa67b1b92d4dab9a4fab91bb8c9924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972341, "uuid": "2cb56be0-7107-44f1-b79b-272f7a5e08c0", "value": "T117A3F885F9504B17C6C752BBFF4E428D7B2A1758E3EE320399156F20379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972341, "uuid": "32d9b2e7-649e-4c80-9829-f4c0ece4c137", "value": "3072:5i4mFfy4qVKj2KwTf4ADUpSSSSSS+I0s:CFy4qEj2Kcf4NpSSSSSS+I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780972341, "uuid": "2358e23e-425d-43b1-aa82-68e6be67f942", "value": 101196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780972341, "uuid": "675707df-aa2a-4c33-8ba6-f3b59ba3c067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972341, "uuid": "338474ba-62e4-494c-a161-0db53525ebb3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5d451c-63a2-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780968305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968305, "uuid": "eb73e26c-4808-4d22-a141-d65f721f98de", "comment": "Malware payload (NanoCore)", "value": "4dd6cef01b0802e1410ae277928a2d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968305, "uuid": "38d64ce3-cdcf-4189-8b95-f070716faacd", "comment": "Malware payload (NanoCore)", "value": "5e3fd59a5159950b9937ec591ded56b5b76ce9d6c4be220d75f93f53f6547fab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968305, "uuid": "63a001dc-3d85-4d5f-9358-88c1fbedfa06", "comment": "Malware payload (NanoCore)", "value": "b89562382453116b968433257a935cf2cca47a80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968305, "uuid": "21f38903-ee10-4a8d-883f-39c455f7cf9f", "comment": "Malware payload (NanoCore)", "value": "b10f04d9cc83c9aeed81a115ce56edde5c13d677819d2eb359b172461af7a07faadc980aa4b99ecce3f26f5f2bdbe403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968305, "uuid": "ac499f92-d3a6-4bf4-a894-0f303d6e07a4", "value": "T1E514BF2677B94A2FE2DE8579701206539378C2E398C3F3DE28D855B68F167E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968305, "uuid": "d1eb1737-bcc5-4816-9001-7f023a1e47ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968305, "uuid": "9c7f195e-c1df-45ca-856e-8c222860b8cd", "value": "6144:MLV6Bta6dtJmakIM5hBGmPDZ1ZgJB6QUWo:MLV6BtpmkEBGmPDZ1gB65Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780968305, "uuid": "a7298cf0-ab5b-4026-949e-ced58ca545a3", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780968305, "uuid": "a7c788b0-5d35-4a24-832b-158e49bec9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968305, "uuid": "e8933f8f-e612-4197-8f0c-a96d2d9d7580", "value": "yuzuapp.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3b5663-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781016572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016572, "uuid": "9c3ccf5e-8479-40b7-a18b-49ef95fd116a", "comment": "Malware payload (Mirai)", "value": "ee9205e973ba92aa507f557ea358f2fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016572, "uuid": "cfb97951-27bd-45ae-a6da-b2cc76474116", "comment": "Malware payload (Mirai)", "value": "5ec82dd810fa7afc3cb50bf2f33c0dabca46c72f0123c4696b55271f064bf332", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016572, "uuid": "1f4850a0-c6d8-4054-8e5d-9a51991a436f", "comment": "Malware payload (Mirai)", "value": "1b665a5e894407f57034936113ef05f4c41e29b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016572, "uuid": "85c1b745-2e3b-4d2f-8630-c7cd4bc203ad", "comment": "Malware payload (Mirai)", "value": "3e516a947161883cf2185e712e38ec64ef2834c1d61a6e5a925a618cbee37e05c1fc1bfa87169fc8a9c2afba165091ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016572, "uuid": "70f8f15b-b7bf-4404-b4b5-f0fa433d3e89", "value": "T131F33A45BC928B21D6C613BAFE1D528D331327B8D3EE7213CD146F247B8A56B0E7A611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016572, "uuid": "8e0a7ffd-cbe9-4519-ada7-0fd02fd93b73", "value": "3072:gD1+Od/OM6JT9jLy+jmFPlHUIemYidNjwO73CX70aAj9krxxT3BOYn2nqf:ghj/OdXy+jmFPlHRefGjwK3CXoaoWxT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016572, "uuid": "b7533b23-19e5-4b02-ad67-f3b7a27cd269", "value": 161300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016572, "uuid": "289e4471-bfc5-481f-944d-f199ab051ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016572, "uuid": "5860e906-c60a-4d3e-a4d0-8989f6742a4c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d082328e-63c6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780984097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984097, "uuid": "95387fb7-201f-4dd9-8ae9-4e2638a04e0d", "comment": "Malware payload (RemusStealer)", "value": "5652047f64a9d994210198130535ec4d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984097, "uuid": "8483794f-245e-4cff-85dd-c4b42d5228eb", "comment": "Malware payload (RemusStealer)", "value": "6021c912bc8f172028992497798b0a64b577aacb46674f793d21907d9015e5c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984097, "uuid": "8a8abd75-6931-45e1-8eb5-3b757f095755", "comment": "Malware payload (RemusStealer)", "value": "f6f7c6e64db78570823781dbfc7ff500e552737f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984097, "uuid": "fb88bc91-10ed-4d81-8849-b7cea299204d", "comment": "Malware payload (RemusStealer)", "value": "01118465bfa54b8d2a8ab6455003a5f1763a3c2e4af2c33a2d27775939bf9f0fe452bb93198ff93b8f9b4718300dc6f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984097, "uuid": "f59f39ba-8ce2-4e35-b84c-7961feda5c23", "value": "T1F4C56D47BDE048A9C09A623189A76652BB3CBC440B3627C32FE07A3B2E777D16D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984097, "uuid": "46abc708-1015-4b60-a946-a44058141e8c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984097, "uuid": "813fba23-d066-4b0e-8108-a348896022db", "value": "49152:AQ84bhNgLKee+SbHAuCihwdKl5xmDkW4zl:Apsy47Cihwo5xWkVzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780984097, "uuid": "5adc76da-7a84-4022-8c98-c9800c200d16", "value": 2613920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780984097, "uuid": "a96f1f73-ef6a-4784-a22b-dfbfb7fd14af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984097, "uuid": "c45ec644-cc84-4177-b863-3fc90d4118ed", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f01d0d-6414-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781017307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017307, "uuid": "cf169ba4-4eda-4046-b260-5f4df1d6b014", "comment": "Malware payload (ACRStealer)", "value": "5425ab4e4dbc296572b0f1925bf2f85a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017307, "uuid": "d7342960-54df-44ca-b160-f27bdb343bc8", "comment": "Malware payload (ACRStealer)", "value": "609914f1fcde5f07140dadd9dba2cc64515fbbe2eddabe2840ae99bd4932ea41", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017307, "uuid": "10360dcd-9131-4716-86ee-f0c14b75f820", "comment": "Malware payload (ACRStealer)", "value": "302f1ec7cf5653365eb35ae236d1d3147f5e3f8c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017307, "uuid": "6b8c2ba8-0cbe-4ad9-8eaa-85e4280b0393", "comment": "Malware payload (ACRStealer)", "value": "703aa3f7ea4676e21828a08498dd473f76e3b2143753271f2f1686897afe2d9e38a172a38613b7382f0ceed45511811e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017307, "uuid": "eb652d4c-d09a-4d34-88fa-1a1a0ce858a3", "value": "T13EC55B47BCE109EDC59A633288E22695BB20BC454F3627D72F91BB782E72BD01C76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017307, "uuid": "b18fb885-f926-459b-999d-15feef3156d0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017307, "uuid": "0aeb95ff-9e32-4a1e-a33e-8d92ace66ed6", "value": "24576:Ldtlc7nihyDiuzCUjHVwB5D3DQ/NqrUwp2cECiFd9w+WokP/nBele7tKDyi4Vhm:LdLc7ihczHj1wTzDQ3w8cLiFd9MBnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017307, "uuid": "cf9d24ef-74da-47ce-a72a-e7621a1289cc", "value": 2729096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017307, "uuid": "b8131118-d070-4e25-904c-c41bd163b767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017307, "uuid": "3237acc5-42bc-4784-8d09-c769251dd07b", "value": "ojujn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927ee373-63ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780987429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987429, "uuid": "196980b7-2dd6-46a8-992d-dd0e13441395", "comment": "Malware payload", "value": "360d92e26742a1349828a757cbbed585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987429, "uuid": "be2f481e-ae84-4246-9c40-9a672f9949df", "comment": "Malware payload", "value": "6165a9aaf83988d204058dbb2852b39cb94d68fce92e206778a9910a3b63cf10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987429, "uuid": "7807369a-2511-4d1a-8e22-f3cc7a8bd8eb", "comment": "Malware payload", "value": "dc8126804037311e2036e64913b042e4ed4b3edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987429, "uuid": "ab75bf30-24cd-4d8f-b85f-42ff9de29e32", "comment": "Malware payload", "value": "b22cfb97026c13f23eeb61c9380c248e3ec8253646781071894aec657dfa359ded5efa7b127ed9befc194257dba127a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987429, "uuid": "3808ae0c-a648-45dd-8746-0b4684bbb7dc", "value": "T121741207EBCBA633DC6F0E7A2C60603556F0A0B15507E79A64F4052ACBA7EE40DC83E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987429, "uuid": "2c0da028-e566-4e3b-8756-13c7b5cc1c15", "value": "1536:KmUzSa2zXL/KBavh5FV2uXHYJ0Y+O/Wm7t04ennq2W/I0Y3Er2sOMYEBO+Sk8gLM:K3LIvh5vXO+m2jq1I0NBA+V22GKr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780987429, "uuid": "30d6458f-20da-4c9c-8bb2-264925c6ca96", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780987429, "uuid": "cdfb5e2f-c55f-4607-b73a-3e36c1e37313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987429, "uuid": "09870421-cbce-4ca4-b103-a22c236e6df9", "value": "6165a9aaf83988d204058dbb2852b39cb94d68fce92e206778a9910a3b63cf10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5929505c-643d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035007, "uuid": "d6762f2d-97f7-4006-80fe-1703b27f4541", "comment": "Malware payload (Mirai)", "value": "d79fe3181294a5d21058d92273ae010e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035007, "uuid": "b1fb1888-8805-4b27-937a-255e50c32c07", "comment": "Malware payload (Mirai)", "value": "61bcc915fbd3ba5d94079c7ed06a8d45915f2591faeebc936fa6495256e49e7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035007, "uuid": "62b8e063-3dbb-4f88-a040-1272aeff31a7", "comment": "Malware payload (Mirai)", "value": "2c0e4cbcedab2e75cfb10f2485c60f1b6656c9b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035007, "uuid": "f42c6f53-24dc-4744-bda5-621cfefccd4b", "comment": "Malware payload (Mirai)", "value": "ec8f227c93da09bdf8be38ab6c95e3ff1bcde3054c93a7d50571a41e34926490c128634f3b3aa06492563b2c6e1036c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035007, "uuid": "84676507-a120-4856-a53a-bd8db5db7831", "value": "T124330994BD819A17C9C456B7FF0E43897B26639CE2DE33039E25AF24378B92B0D67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035007, "uuid": "24c74b54-d775-42cb-af5c-024f59e56311", "value": "768:CaZyLx+249sY2pt+GrMsG+Lk8qMYMTKAHcgm4e32deJa71/vbwpMKI:rZasr9hUrh9L3bTKA8MQ2de47xOMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035007, "uuid": "643b7a36-dec0-4ff8-9f1f-75ed1470be44", "value": 50524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035007, "uuid": "a4b71e43-7781-4189-96dc-e0252571927b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035007, "uuid": "9ea04224-221b-4671-9ae5-3032fcf0af6b", "value": "godisdead.5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d48a2ec-6413-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781017029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017029, "uuid": "86f6a7be-7ab3-44ad-96af-84906553ddd6", "comment": "Malware payload", "value": "51d7ba0f8c8e049fbad441eaf3f6ed1f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017029, "uuid": "45a94b9a-b92b-4a18-a3d4-6538a3d39120", "comment": "Malware payload", "value": "6214b011c1b08262dba70f2a67592fbb720518dc5723d3bc59965517e320d826", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017029, "uuid": "846a5e15-b3f8-4a93-b77d-d77d7431eaf7", "comment": "Malware payload", "value": "2094ad52a0c244aaba990cc1885f4029e17d293f", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017029, "uuid": "81688a8e-48bd-47e9-b8a4-e004671d7508", "comment": "Malware payload", "value": "540edb517f5ea300c7ee7d797b945fddfae1580d5a83e3676eea3816cd68318965f03dec3a5547e09e652b101f337621", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017029, "uuid": "12b2d27b-c0e8-472d-8bc4-7226ebd1315b", "value": "T19DC7CFC96282C8DFC6C80F74894F9BF4D86DAC0B003556D76AA83D2F1E77AF84D16952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017029, "uuid": "cca0157e-b7d5-49de-8125-5395b833fa4d", "value": "154e283e694e5fc75c2bd54e533abe38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017029, "uuid": "8d674d1b-aabb-4a90-851e-d11930ab622a", "value": "1572864:ysJJs/zu0KsJJs/2u0KXwyRiT2bQEnTRS/ulKKLeCe2YET+BDVpPc+I:nC/zu0PC/2u0KXwoyZ+R6ulKKaCe27T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017029, "uuid": "65a59d02-b051-4af1-b73b-eddb0e6a46fc", "value": 55162368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017029, "uuid": "5b269dae-65b8-441f-8e2e-af6b54936e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017029, "uuid": "91d0f4ab-3e83-42f6-8f69-b2bd163df302", "value": "borlndmm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99ccf9b-63ef-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781001695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001695, "uuid": "f9a67893-0641-409c-949c-bb33a163f8e0", "comment": "Malware payload (ACRStealer)", "value": "7189ccdee3c4cd9aad861d82a3c70eab", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001695, "uuid": "ae87ea94-3708-429c-b03b-30670c99a2f8", "comment": "Malware payload (ACRStealer)", "value": "623ad10e2a36110c932cc12d14872b28284f1a05e05ce45d98d1c3ed1de31af0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001695, "uuid": "d3e6a291-97d6-4ad8-8e43-41f44ea3aec3", "comment": "Malware payload (ACRStealer)", "value": "1cb3d43ab9c66e94a42835f8eab37fa3e186004e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001695, "uuid": "91bc2672-0d0d-4f70-9e04-a3a6b62a81de", "comment": "Malware payload (ACRStealer)", "value": "10e9fe3c5db4efbc6b21d978c62340f6bcf0cad36905c1f5223907be192c4a7d2dc66238282d9a62c7cb0236452ac45a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001695, "uuid": "9ec76a99-3ea3-4d39-bcec-288ef14e39d4", "value": "T1D3B58C8BBCE008B9C0AA9735896691627A61BC450F3267C73E90F3783F77BD09A75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001695, "uuid": "8b99da23-b78e-4700-af90-b2732079535f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001695, "uuid": "daa99386-9865-4b37-81d3-1765ef61ccf4", "value": "49152:++UlFUV5fOXaZjTUvO5CmFxWjyjQHggc+:+cSWdTFxWNA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001695, "uuid": "48e5fcd2-dfb4-4f76-8ca1-ddd3e1743f2f", "value": 2399680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001695, "uuid": "1a4a4c27-44f4-4c34-b098-35eafc8eeb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001695, "uuid": "302a7015-5568-48cb-9abe-cdc56928af5a", "value": "Voltrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e85e2a-63a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780971626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971626, "uuid": "014fe904-5a47-4501-bbe5-6b15bddc7cf3", "comment": "Malware payload", "value": "b08fc102614559bbde50eb7bf4a137ba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971626, "uuid": "24783c47-e6ff-440b-a79f-eff50762f0e8", "comment": "Malware payload", "value": "623c3907d597ae6161a1c33c826ef3fe4eb6849de852e261ce755cdd2d9d33f7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971626, "uuid": "ee1a989a-cd0f-4105-b405-b8629a1390a7", "comment": "Malware payload", "value": "a63122aedaa82c740f14edb1f2f2baf434479c62", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971626, "uuid": "ea072d8a-ed9c-43a1-8a4e-d2b27fbf5fc0", "comment": "Malware payload", "value": "3a64b22aa4804ac52bdb2fc389577ead38d32b31c69471380fb20f18fa3cc8dc0579328a0b813b2bb485b1ba406d4173", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971626, "uuid": "e7c0b6c2-77a4-4353-85e5-9432439d1143", "value": "T1A70188CFC0158A6014C6E49D32E77148F821C3CB25998FB8BF6C243E8FA8A187095F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971626, "uuid": "2ba09280-87da-49a3-ba34-bcc6051844ab", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka5IjFaFMvTXIGp7U9I9nIFIuJuMFI2I4X:kXCKysE2hi0ziQvZoha5fFe7kk49RI4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971626, "uuid": "713fe963-b106-4fe8-819b-4a16ddac737e", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971626, "uuid": "050bb1b8-d41d-4fad-9126-6661956cdd4a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971626, "uuid": "ab7c0dba-fecb-40c6-8921-f84a4ee2a224", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4d492a-6447-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781039312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039312, "uuid": "7b5d7083-831a-478b-87d1-87ca656a393e", "comment": "Malware payload (Mirai)", "value": "25e392a4fadfd9a6f912fa0a6e4df00e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039312, "uuid": "6266d68b-4099-4ca4-8069-1e7e0edeb79a", "comment": "Malware payload (Mirai)", "value": "62d43b5aa8288c3d6b94f2f6cb93ca47179aa190d32e6af4289306e5fef9b08f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039312, "uuid": "e6a88b05-aece-48ce-9368-67823597b084", "comment": "Malware payload (Mirai)", "value": "5a9b6237eb4ee7b8add7c466d17a546183253d2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039312, "uuid": "e283cdf6-bb3c-4a22-a36a-2e2abaa7984c", "comment": "Malware payload (Mirai)", "value": "5df60eabe04cb54b776ad5a400df833b3d0967384cd28bab3fe6ec541578b06d1ba8327d28cd012e70f9886f99503dee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039312, "uuid": "1fdb2dd9-4f96-4bdc-9b43-a7e23dae9501", "value": "T110543A45EB414E13C4D6277ABAAF0245333397A4D3EBB306D9246FB43B8779E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039312, "uuid": "5740a54a-91d0-436a-9fe5-004cbe872f39", "value": "6144:nqARl4HHbCj3lrB1waLx+OI/kCIiALz4jbylV/GEmu2qdds:d4nIrB1waLx+OI/kJhnX/fmuBdds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781039312, "uuid": "f12b5e9b-7b80-4d35-95bd-aeec8a997231", "value": 278743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781039312, "uuid": "a8e305f8-787d-46da-b2a8-a95d47956245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039312, "uuid": "edca263c-4d58-4d68-b8f9-db7dbbb337e5", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c2252d-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003011, "uuid": "2737b718-bafe-48f1-b439-b11e5f459ab3", "comment": "Malware payload (Mirai)", "value": "f9893f815748acb8be105c42bf787af4", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003011, "uuid": "d7ec4f48-954f-47d7-a381-6218f09c04ba", "comment": "Malware payload (Mirai)", "value": "634e332a94447a80f224b27673524cff4b3aeffc3863ad5c0beafc6b280d21e6", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003011, "uuid": "581010d2-3ff5-4e7e-a154-3e1b03d8dd08", "comment": "Malware payload (Mirai)", "value": "7d09ff920503c7a0b4ca4e6f1f224a41dfe5def0", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003011, "uuid": "d3e68b51-ed92-4c51-b62c-7c841dcf7ab1", "comment": "Malware payload (Mirai)", "value": "5332b470da515e00f454bcfc3daeee6e2d4f61d51d8e0629d23ae2a7598dced923a196e292ffdf3916fbb7d5b8c5a41b", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003011, "uuid": "e07f34c5-e152-461d-bfd4-cec3a79e9b75", "value": "T1A15423252ED97B90E1A88C3C5BFC62770252E6FA333BDE1ECE56CC65590523EB04B194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003011, "uuid": "916e459f-0c92-41a1-9810-44f0f927576a", "value": "6144:vos9JJb1oJOcgyLAEK4zPEOFRwO0p0LeOX+MzOXJbguSNTAQpTFc:Q8JJb1o9gWeOpoO02eOOMyXOPNTAOTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003011, "uuid": "40388e0d-e05b-49ee-a066-f400c3f8ac83", "value": 295228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003011, "uuid": "da3d28c5-8ce7-451e-bc6f-6d9640867f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003011, "uuid": "0d8f844e-a8db-4497-9370-1e6dd2e8db03", "value": "6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e2b0af-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "16564a3e-85e1-41af-a786-603258d46f1d", "comment": "Malware payload (ConnectWise)", "value": "cf4eb723d60ca79a07739d006cfabef1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "6cabe602-e15e-405d-88de-6a4a19245884", "comment": "Malware payload (ConnectWise)", "value": "64894644ec11f3243050139112181ce79154de393d5e5d4f4596420ee3db1645", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "f7d82d2b-8ab6-482c-86ca-aa8fe3863ff1", "comment": "Malware payload (ConnectWise)", "value": "288fe51bf0ce4ac1735b9cb464f000cc8929524e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "8fa07a62-2344-473a-a9bc-f5bd77d7745c", "comment": "Malware payload (ConnectWise)", "value": "37bdf355f54ca015e2f8dc72d9b8f004331aabe68740367599f6a11c91b430a8d9955c01b9ae1ebccc8b6db00ef2b904", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "29683033-0912-4da4-a54f-922e112b951a", "value": "T142836C43B5D18875E9720E3118B1D9B45A3F7E210E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "19721a5b-a398-4989-b9e4-4b28ccf01d07", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "5c14b21c-77a2-4f43-90ac-72244a5449f0", "value": "1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYj70Jl:genkyfPAwiMq0RqRfbaWZJYYjwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985829, "uuid": "05fe106d-251e-4ae3-b625-d30d41d7ec62", "value": 83160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985829, "uuid": "de3311d5-4fd1-4795-a54a-1fca8f2e83fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "67a70ed3-f79a-4bb0-955b-17b1e3a19cea", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70be03b3-63f0-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1781001975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001975, "uuid": "21eee42f-0562-453c-a862-63b668f75288", "comment": "Malware payload (WallStealer)", "value": "5e75433069d1c680ad1e80f9c1da8339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001975, "uuid": "331e1035-4feb-427c-8631-1b8bac229ead", "comment": "Malware payload (WallStealer)", "value": "65900750c4bcf44855e5ebf9548aaaa29f9a6abd5141769f617b35fd096bb95e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001975, "uuid": "c743c77d-6703-447d-98a0-1ba9dc3bb3c3", "comment": "Malware payload (WallStealer)", "value": "1e628851400b104c07fb68c4c6807f0d1f1c29a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001975, "uuid": "055edb8c-f6d2-468f-a889-abb684513911", "comment": "Malware payload (WallStealer)", "value": "dc93d09f5135a435649cea0bfdd781a7c92991291acb4ef47326eb0f4f29c2c55a59503afb79158e526130b5fe7c8994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001975, "uuid": "d73e2e43-4dd0-4e0d-b50e-6294705c3fc8", "value": "T11395E07860CEAEBBC87270F1578A5395C3A3F54BE8B88AD542AF6F543443A1D4B11378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001975, "uuid": "38b8b893-fb72-4c80-af9a-aca11c993ef3", "value": "314d410bef1e80ee695ecc184f2190cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001975, "uuid": "ef6b72b7-d57b-48e9-9a22-14693ab6e0de", "value": "24576:BzqeJ1VcffzQBBRK1PEJzLK0hroxzD0v7sNjcDn2YGgCSmdA3y5xLtS0uE7foVwz:soBPKqYQP5VsXxLtH0LQsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001975, "uuid": "e608b1c9-1b88-4b82-94b3-fbe43f3204e9", "value": 1967104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001975, "uuid": "74478cfb-ff09-489a-b643-44935cfea567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001975, "uuid": "414ff365-fc9e-4c5d-b678-add09274867f", "value": "cmutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef943c5-643d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781035124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035124, "uuid": "542d9e47-e976-477f-8ebe-0c47db384ddb", "comment": "Malware payload", "value": "bfe77aff9fb946d5d78c4e8ca4050df6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035124, "uuid": "c5c11beb-a8f5-421f-a277-24bf354f5559", "comment": "Malware payload", "value": "65f1fe5ac63f4662fb332e4023efc00252bd885fee1d0786d6d1b3f6f9b31ca9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035124, "uuid": "c6d91b15-3ace-4423-bf76-0a252c020768", "comment": "Malware payload", "value": "16ce20aa2b374eaef4397f7078229800a32f6fc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035124, "uuid": "af1584eb-4f54-48a6-8b12-6a9dd5155510", "comment": "Malware payload", "value": "01a9ad52020efe28eacfe96078f2898d599f27ae156817e8e5a164fef680102f23578f8a5bb55a9495961a89d30a71bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035124, "uuid": "63f12cfe-3ec0-497c-8458-23086cb0c287", "value": "T12F431ADAF800EC7DFC1ED73B8453090AB171E39905821B362367B967AC7A2A44977F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035124, "uuid": "ab23e200-d846-4fd2-8d6e-dadd6bbeda2a", "value": "1536:+nSV8s6iUL3m8u+C8R6b+8kk7y+7PO920zNgU:wkUL32+C28D7xKpgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035124, "uuid": "88601503-d6a4-45bf-962d-ee2fb72802aa", "value": 57264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035124, "uuid": "02148e91-c4a7-45de-9c3c-dedaf39ddac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035124, "uuid": "72f6ba5b-47c6-45a8-9825-0cda84c6c347", "value": "godisdead.10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14eccead-63f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781004398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004398, "uuid": "ed18e8f3-80c2-4399-92de-2f0b3e4f4195", "comment": "Malware payload (Prometei)", "value": "e773f23778dc4b6fcdb04d8e37c8f53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004398, "uuid": "6934963e-d21c-4f1c-a5d4-e532453fa90c", "comment": "Malware payload (Prometei)", "value": "6737cac070e8819b06a83e3fbe9ccaa9912f24c322ac087ff9dff022a63f03e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004398, "uuid": "7a7379d8-440e-4f9f-a6af-c8e720c9ce57", "comment": "Malware payload (Prometei)", "value": "825052eb534cdc1e54b332874083cdfb91477cd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004398, "uuid": "a6c2f0e3-af30-4bb5-b670-5cbb61e0d8b1", "comment": "Malware payload (Prometei)", "value": "a2f76b617171525d8bbe973262bf42a5d3210a0234814633eca5a6859d77c9f53ac145dd1fae1f51bc3da0c1f7c3cf65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004398, "uuid": "303d79df-3fd5-4c15-b9c6-21dd55a1dc44", "value": "T1B647DF77814338E9E5B98DB4D01025416DAC388B5778A3C7BAC871E667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004398, "uuid": "86a0f32a-39d2-4f4d-8692-384b75047d35", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQK:cqYUQuVDt0TZEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781004398, "uuid": "0d38d0b5-1809-49b4-886c-96022f75da82", "value": 26968064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781004398, "uuid": "bca7f117-60d7-4504-b61f-edb52fa2d672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004398, "uuid": "bca84bf2-4f8a-4dd8-8946-55ec5a55f811", "value": "6737cac070e8819b06a83e3fbe9ccaa9912f24c322ac087ff9dff022a63f03e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd10bc5-63a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780968871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968871, "uuid": "bbf477f0-f7b7-4a08-b99b-a324f38c6e58", "comment": "Malware payload (Prometei)", "value": "56698ca33644cb90ae580ddbeeb4b373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968871, "uuid": "d95b1dfb-6c73-4a6c-99b9-ddcb5c34a880", "comment": "Malware payload (Prometei)", "value": "6865192b889c78b6d691d45252f0bef19f271079905b88aa32c2e0cc8c99843e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968871, "uuid": "6b2105b5-e5f3-492d-907e-9a4fec308f0a", "comment": "Malware payload (Prometei)", "value": "45cbafda8e767184b92ec7916029ce9fefdd4336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780968871, "uuid": "967447af-5e91-4e2e-b362-80391c33fd80", "comment": "Malware payload (Prometei)", "value": "67d30e8d9b75107a730bbd81f66dcc0274de72af60051c7f9bd47e9d50f7c93d52e46aa686b795fe5161be37e5ce421b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968871, "uuid": "bd4eea5c-1ca9-4d86-99ff-9673239e27a5", "value": "T17FA423B4F9229E9F6DD769B91B24831DE182C172589D4C1313AE94E34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968871, "uuid": "79a8a10d-a45e-4f8e-925e-eddfba0bf68d", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd2:Fs6pyCC/Ya2hpi6T6N44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780968871, "uuid": "d4905d0f-334b-4672-8722-61ae08e6b0fa", "value": 449081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780968871, "uuid": "dd93f5cc-5add-42f1-a29f-ad2572a47a9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780968871, "uuid": "2f2d8e7f-9208-44a3-821a-65c8001d3932", "value": "6865192b889c78b6d691d45252f0bef19f271079905b88aa32c2e0cc8c99843e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f743ddd8-6428-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781026253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026253, "uuid": "de3c4f35-4e17-44be-912a-7cc394c5c004", "comment": "Malware payload", "value": "d3ba87335672587b1da6dc9ccb3e1c11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026253, "uuid": "b8e777eb-b1ed-4954-9680-8b8d869b85eb", "comment": "Malware payload", "value": "686c462256f31ef7eb2fe154e75e0d6d876db0b4a155cf7571e9bd47e8f6a3bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026253, "uuid": "ec91a8c4-3718-4781-8b71-ec2815806329", "comment": "Malware payload", "value": "d08c9d4e4092a05a63951fc6c867552171bfcd58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026253, "uuid": "d506d981-7a30-4396-a2c8-eaa695136a22", "comment": "Malware payload", "value": "c9d804dbe1ca3caff9b6fd894ed4965d3790b99eaa701c13653e7cb3d03d2e6a0e9067387104a7f73e7888ad901cec31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026253, "uuid": "23f6d81b-2d0c-4f82-b2f4-8101be056d09", "value": "T15717BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026253, "uuid": "d6f41002-0b35-4993-8013-16a82b3b670b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQE:cqYUQuVDt0TZEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781026253, "uuid": "9bebbe98-8995-4e48-8e07-857f30d1abed", "value": 18644992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781026253, "uuid": "85e82d5b-8e20-4bda-8259-a7a1688b9f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026253, "uuid": "2010b0b5-04ea-460d-8e13-019bd7f0a60b", "value": "686c462256f31ef7eb2fe154e75e0d6d876db0b4a155cf7571e9bd47e8f6a3bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74d2bfb-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985854, "uuid": "36047dd9-39bf-4a03-86de-618b97f6a00a", "comment": "Malware payload (ConnectWise)", "value": "26107ed2c2d3939f8ffbe32f14b7e0f8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985854, "uuid": "b2427d51-b25b-42e7-b8aa-7c49c2d57f76", "comment": "Malware payload (ConnectWise)", "value": "6946e12a553e4b7ced897e16760ef96cd0e7a51f88b8b410071103c3e5642167", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985854, "uuid": "421c882c-256a-4dc8-ac90-fcf1e31fdd99", "comment": "Malware payload (ConnectWise)", "value": "8d0b5f5a4a2cfb5201a870073a020f9c9569430d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985854, "uuid": "a05bca9a-7706-4ead-956c-17ca4125853a", "comment": "Malware payload (ConnectWise)", "value": "b0d570757b5946dcfd9dc06cd6a79f4c95050f5da3cdd6871d4f59bbad7aa9038cdb1836369c5dd57a0ca927a7793e04", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985854, "uuid": "774ba909-bd1f-4c99-9716-4edd6bae7eaf", "value": "T13D836C43B5D18476E9720E3118B1D9B4593FBE110E648EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985854, "uuid": "2fa80352-bbaa-42b6-810f-c80866dc76f7", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985854, "uuid": "3a6476a9-22fe-4ab8-94b3-661d84e848f9", "value": "1536:SxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYD7DJv:wenkyfPAwiMq0RqRfbaWZJYYDJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985854, "uuid": "26c21838-7599-4347-81c4-fb2f27f9d111", "value": 83176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985854, "uuid": "62b6e771-c104-4e9a-b24f-c83eb15592f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985854, "uuid": "2b71c873-c362-45ba-9721-442c3a07ce6f", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42ce60d-63d2-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780989231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989231, "uuid": "a322ff7e-baf7-47bf-99a7-8f871710b371", "comment": "Malware payload (PureLogsStealer)", "value": "f8a5c6bf01ac3298856070b3b114a9ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989231, "uuid": "eb5a451e-e761-4828-b1a7-19bba430a7ab", "comment": "Malware payload (PureLogsStealer)", "value": "6a640d2dfdef8984777bd2de97349349b4336b65183d35fbd83093fd930ced94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989231, "uuid": "afc141c5-f753-4232-bf63-b4ede2e77696", "comment": "Malware payload (PureLogsStealer)", "value": "b7a09317ce02c7412f85fd3decfded0b38d74f14", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989231, "uuid": "01d08f38-0725-4394-accc-ea03b36cb81c", "comment": "Malware payload (PureLogsStealer)", "value": "b53f9c88b5050cfe5dc9593c03e1ba009e37892d4d6c77a0214c9c34ce8a62100ebd15c8ca8aefeb280cb8d9e299c1c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989231, "uuid": "1806e9ea-1d02-40ab-bf17-571fb991b445", "value": "T1AB05F53ECE18012FE872C518C499895FF8D1659B522CD947D0CA2F9FAE7388677C225E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989231, "uuid": "0a2cfbe1-e121-4eb6-864f-7fdf6bfb6d84", "value": "3072:2cMnv2ax2K2/cKyaPGDxrxqPse+l+TOiTMhDwB6qJDi34UBXYKFHj1LxXKg6d6Mi:i2advx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780989231, "uuid": "e4a9dbef-db52-41f6-8123-6a68bdde3e70", "value": 795826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780989231, "uuid": "966f8fad-19c1-4922-a573-5318e8231b6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989231, "uuid": "7ad46550-5bd2-46e1-b149-7c0c4e843467", "value": "Quotation Request for Listed Items with Technical Specifications_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772fdda9-63a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780969345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969345, "uuid": "c735bba7-5aee-456a-a582-4a63bf857d0c", "comment": "Malware payload", "value": "2872b4b546b1f5632e0836438d90bb92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969345, "uuid": "c255b1e5-6a76-426b-9e5b-9a96259b8097", "comment": "Malware payload", "value": "6bb57ac26f59918eaa1d2d3565d6efbd79c40a905c9a31a95a5aa2f8012f95a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969345, "uuid": "8870acae-d1d8-4a78-80f1-dcddd9ea9754", "comment": "Malware payload", "value": "5884b0d15c4d30b9e514fc719660ea721330d3f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780969345, "uuid": "bd177090-8721-451f-88f8-aa49e1db808a", "comment": "Malware payload", "value": "05523ce8533cf6588f275351f3de1c379c4d0b8bc48de5db4d8ba5ea35b780b1905cac2d5c0afa56ddcbfb2afa692e3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780969345, "uuid": "127909db-46e0-4c7d-a495-2b32ee2e0f1b", "value": "T109D3AEA7B24F2450C82507F41BC75BAD2E2325015E6B96E63C6E373F6A335EE58063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780969345, "uuid": "aeafb15b-423a-43e1-8a45-57d94ab6a880", "value": "3072:VPM+Eh0zXGpJHulU4tBG3JxW+L941gJC1TSRaYeJcq:hM+yqeHt4tUu+54iC1TbYrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780969345, "uuid": "dd7912cd-a548-4e95-b6a6-3426910339c0", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780969345, "uuid": "7e908171-b368-467a-9e20-3180aa39c0a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780969345, "uuid": "2f81191a-0df3-44b5-b8be-5a7a06a0a956", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29be56c-63a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780971135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971135, "uuid": "185fa16a-6427-45f8-bcdd-170afa91aa64", "comment": "Malware payload (Mirai)", "value": "2c0d30ed4d2c11b8c876cbd3112e53bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971135, "uuid": "300e7a5d-0a32-450c-8d83-976c66e07e41", "comment": "Malware payload (Mirai)", "value": "6d88c963fd7dc15816fedac1bc974c739b41535eec0db1c6d5c3b762b05e7fb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971135, "uuid": "7917ab42-3fe7-4247-947f-520b350aaddc", "comment": "Malware payload (Mirai)", "value": "f16391a88bc9680dc82cbfe87e4c334fab90e670", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971135, "uuid": "31ee7669-405e-40d2-a5f2-ac01244c5714", "comment": "Malware payload (Mirai)", "value": "a2d2cb1ec722640a86193fc693169c5f664b0a6ad8aa8a748728077211dc5b36439bf9e2265df8580eba1d98801f915f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971135, "uuid": "48d5e31b-f996-44b8-9f35-271cc5943b4b", "value": "T19A5339C5C243CAF5DC0125B12477AB319E76E8376A35F50BE3E92B36A813B409A0736C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971135, "uuid": "ff472dae-23a6-4dc7-8061-279a5747356f", "value": "1536:w1et6tk8JV4hFCpbfmDMAg+ZP3OlvNALfUuyzb:w1et6tk8JV4hFCpbeDMA1534FALcbzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971135, "uuid": "2f2ad904-8569-4b52-abc1-1e81c41cf5c1", "value": 62416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971135, "uuid": "b1bd8432-a240-4e87-b4f6-148a542fcac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971135, "uuid": "ef9f39af-29ab-4de1-b77c-b07f971fb23d", "value": "azsxd.i6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9111e254-639e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780966811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780966811, "uuid": "40faee69-2840-4391-8c95-8d40dd518c39", "comment": "Malware payload", "value": "38b776288330ff8abb19ccd6a5f842c6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780966811, "uuid": "fd7fd16e-7181-475d-9199-3329e061f625", "comment": "Malware payload", "value": "6df218a5efe3aafc25210e07cc376237ec8224bad9ed4488cc4ec33dc0c07751", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780966811, "uuid": "85384439-d236-490b-b9f8-a0efe9a340b7", "comment": "Malware payload", "value": "ad3a4b497fe169824224ee3c37135168cb6406e6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780966811, "uuid": "f8847259-bd90-4b36-929e-4831036b3543", "comment": "Malware payload", "value": "3e6c2a6a8ae382eadecb3a9522bb6ec64c5c31f79dfff1b0a2bc7f239e1251428affccdd5ad844eb911fe7655e58c5a4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780966811, "uuid": "2e5d95df-176e-42d4-9a8b-fd59108e8809", "value": "T12AF65C720697BDFD3B6D3D85A0056E445C5C3B4B1269824ABBC830BA63ED5B48F2CD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780966811, "uuid": "ddf6ff61-52b6-4f13-a0bf-858158abe247", "value": "49152:Cvbc26AnsmMixOttc/Luu8lxW4LQmSzrrVFK3SYtoUwi24FUixgdf34pvxkM7vaw:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780966811, "uuid": "0b64abcc-d489-4004-8026-284ef4c7ffb4", "value": 15375848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780966811, "uuid": "c408e4ed-191b-4dbe-97a6-2fb0ea74e674", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780966811, "uuid": "5162b887-1f3b-4140-af02-5c2a036d5e0c", "value": "z1CCL26046-LABEL.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b05c34-643d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035131, "uuid": "c6f87d08-9339-4b30-b67c-1cf370ff2359", "comment": "Malware payload (Mirai)", "value": "9d2cf1eb1a55f504a15e4278d4c42ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035131, "uuid": "4da6020d-15d9-4347-81f8-ec96c8ca5725", "comment": "Malware payload (Mirai)", "value": "6e01ba49305190e74d9a52e8eea550f13ad59f1c861e02dd78a2ef9fe52aa8d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035131, "uuid": "c0a00956-8062-4a6a-a6b0-5c544a6db19d", "comment": "Malware payload (Mirai)", "value": "65804ddbd66ab3594d3978ff3cfb35794501052c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035131, "uuid": "81bf21ee-a5a1-4247-9fb4-3285e546a53e", "comment": "Malware payload (Mirai)", "value": "88d89258f0935d14ba497731cf5f0d4679ccdff886051ded7dae9057833080b6b0ca95928c49b95f85b4c84b8bea6fd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035131, "uuid": "5bdf3abc-15f9-4224-a406-7438efb244bf", "value": "T1B353095AB8819B15D9C112BAFE0E128E731317ACE3DE73139D24AF20778B56B0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035131, "uuid": "90a4e099-d489-467e-b4de-742008ccdd90", "value": "1536:Z8n9+eyFO2xU9CaQwX1+shMGibF2Xc4/cd5yYDj:lFOPQah4F2Xc4/cdwkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035131, "uuid": "7c4dfcb7-b1b4-4a29-8410-e8f78303d5d8", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035131, "uuid": "03380dc6-68da-4998-9c2a-5fb41566856a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035131, "uuid": "a0b44244-154a-40bd-9851-11c007f9211e", "value": "godisdead.6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f280296d-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985872, "uuid": "558560d6-e117-4da6-bbf4-a3c05897dd6f", "comment": "Malware payload (ConnectWise)", "value": "40c3ee733b6467715b38c20746e9abfe", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985872, "uuid": "e8214ec2-bb91-4d20-9eb1-dfbd0da0ef65", "comment": "Malware payload (ConnectWise)", "value": "6fe557fc1471bd795fe0bdb4789a73aedb36135c10d3b9f8ff07053108fe4700", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985872, "uuid": "4ca1321b-6dbf-4326-a289-0387ae4ef693", "comment": "Malware payload (ConnectWise)", "value": "8ecca8d443d144e5bfc81823188031f94b0ce175", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985872, "uuid": "7dd4dc70-9efd-428c-bc60-10451ee5f478", "comment": "Malware payload (ConnectWise)", "value": "7b0394db317c2d11b3204100a56f1f93799b10bf0a698bf353ab5a226e07358559d289fe3d41bd9eb30394613ecef937", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985872, "uuid": "8725bd02-b82d-4e7b-b72f-cdcec792aec7", "value": "T128646C11B9C48432C673383107B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985872, "uuid": "206e63e6-bbd3-4ef8-b84f-41424f820018", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985872, "uuid": "093dd2a5-de88-4d2d-9249-0659ee4e341c", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9Ua:o1iw7gryNkSV1hy1Z1u2JLI9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985872, "uuid": "2ea56d96-bcc8-4b3a-94c3-15839cdab102", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985872, "uuid": "064b016f-070e-4d54-8f39-8130aa583768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985872, "uuid": "0b710c04-d7d7-4a0a-bdfd-1c981769038c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6835d2e2-63db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780992942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992942, "uuid": "e9573c81-b44f-4635-ba1b-f1e19891ad2c", "comment": "Malware payload", "value": "f523a3a875b85f4041264f3d13fd4bb3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992942, "uuid": "2062bab1-3853-4db9-af87-ce51c00712b9", "comment": "Malware payload", "value": "6fe9ecfd106dae476b08b05cae0f73d9c30bd6468cfefed7461fd1d77ccb6fbb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992942, "uuid": "743ee7d6-0f3c-47ea-9f4f-d5ed9395d1f5", "comment": "Malware payload", "value": "b2faab6078afb141ef14e89e150071b30c387410", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992942, "uuid": "563c7959-3697-4d42-87f8-056e9fd3e84b", "comment": "Malware payload", "value": "42f1bf5e2373690b031ecdfa4f01ece14b2e901df45eaeefd5057b8d7fb17cfb1afd13b82309b56162dbc503ed319928", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992942, "uuid": "caf36dcc-704a-42bb-8a09-0cca8a9a7b18", "value": "T18B01ABDEC05696A0419AE89E239759C07411C3CB6A424FE87EDC543DEBA9308B099F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992942, "uuid": "cd322c13-cc10-4b9b-8e7d-146c0b87d2eb", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkar91INHhQIQPz3lxOIHrsZFIhjBICauD:kXCKysE2hi0ziQvZoharjfnTSaQFGVB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992942, "uuid": "24887d02-944b-44f2-9fb1-259570a0061a", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992942, "uuid": "93a66590-03b2-4cca-88b2-a2978bba906b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992942, "uuid": "47127f62-397c-42a9-b111-5087eb623aae", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0487a113-63f3-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781003082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003082, "uuid": "ba32edd5-d6f7-4a1c-99f1-f4b1d04c6c80", "comment": "Malware payload (RustyStealer)", "value": "9b02d4d303f3dd2467c26dc60fb8fc9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OvinRAT", "colour": "#DD6211", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003082, "uuid": "1fd36096-5738-416d-abda-420e34c62a3a", "comment": "Malware payload (RustyStealer)", "value": "716476cc78390e35b6644f61f7a38fd3cbb23588eb1c48858ab42dc495968eae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OvinRAT", "colour": "#DD6211", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003082, "uuid": "af3ad29b-b529-4255-8111-0745fd2c8c08", "comment": "Malware payload (RustyStealer)", "value": "8c41d6f7060e285ae6e76cff3f58ce550f836878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OvinRAT", "colour": "#DD6211", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003082, "uuid": "fc2d72a0-e5c5-4e77-83ff-7b2f2bd7bb9f", "comment": "Malware payload (RustyStealer)", "value": "f75c9192051fae4e627c7bd88681b67dcd606a8738f28da4916026dce3d62eb901adc3860aacb8d71d4de9f4e1b78fd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OvinRAT", "colour": "#DD6211", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003082, "uuid": "72011e7d-23ce-4a5b-b489-6081a158734d", "value": "T178A67C43E2A581E8C4AEC474D35BAB37FA327C8D4424726B5BE08B212F66F509F0D759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003082, "uuid": "947b9841-3cbd-4950-a946-72cda256f61e", "value": "22d5bf317df0dce057881a862d7a962f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003082, "uuid": "a0066e2b-43ed-4f75-a14a-7ea205950a6c", "value": "98304:RHv9Pfp/TJWI7drzrup6iCnpqqhQjcL5jmLLj+KmghdkF+eY:bvEglpWmghdkFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003082, "uuid": "8cf56fcb-1827-4657-a109-8a18bc953886", "value": 9584640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003082, "uuid": "317b412f-bf18-4469-b391-5374eaa88860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003082, "uuid": "4a11b147-6964-4fa2-9d06-9ddb527f8daa", "value": "716476cc78390e35b6644f61f7a38fd3cbb23588eb1c48858ab42dc495968eae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c556d5b-63f3-11f1-a769-42010a9c0008", "comment": "Malware payload (EdenXander)", "timestamp": 1781003096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003096, "uuid": "89b932fd-a677-4d29-a737-d918653bd601", "comment": "Malware payload (EdenXander)", "value": "969c3f5479e64ef3182ed8c765a5d53a", "object_relation": "md5", "Tag": [ { "name": "EdenXander", "colour": "#1D97BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003096, "uuid": "bade86ee-3f0d-475f-ab11-f504ee7c341a", "comment": "Malware payload (EdenXander)", "value": "71c00fa8aaae931a771694a34aa72fe0fe0e324f0606266408b4cd6a1ba54842", "object_relation": "sha256", "Tag": [ { "name": "EdenXander", "colour": "#1D97BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003096, "uuid": "7f629994-a0f6-4d4c-bd08-569bee30db41", "comment": "Malware payload (EdenXander)", "value": "4d678bf0aaf6585f1fbf1d631688f6479763a0fa", "object_relation": "sha1", "Tag": [ { "name": "EdenXander", "colour": "#1D97BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003096, "uuid": "6b5e167d-26c9-4dbd-a033-e56fa180e7c5", "comment": "Malware payload (EdenXander)", "value": "f9b601c25bf156f1b3450f6ff751f9d793ce272e2e8f288854b65b7bea0962230ab686b1f42d012cc565d7ee5aa58077", "object_relation": "sha3-384", "Tag": [ { "name": "EdenXander", "colour": "#1D97BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003096, "uuid": "16802d98-0e4e-4b8d-824f-56bc0f6252f4", "value": "T11C733A16D92940AFC35DD9B8C9838905DF72BC8647A2B7CF67501DE60E26AD89F3F201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003096, "uuid": "cafd7341-9dd3-427a-839f-db10f4a865f6", "value": "f3137dc464b526d1e04ee7b0126fe82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003096, "uuid": "a23d947f-094a-42ea-9f12-0a1e58742afa", "value": "1536:ZKhN2ILKQWmOzX61Ww8wBR2Ko9sgew76BmWGoH5wnVdH:ZKhlGQWVX61Ww8wz7yoH5wnVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003096, "uuid": "a639f79f-e8b2-4a54-a56a-6a627d421a42", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003096, "uuid": "e3472e85-c6b2-49a9-a35b-497bc7e0baab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003096, "uuid": "f99de7f1-ef41-474b-8862-abdfdc77eadb", "value": "71c00fa8aaae931a771694a34aa72fe0fe0e324f0606266408b4cd6a1ba54842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f35aa41-6426-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781025139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025139, "uuid": "212b7314-6f1b-43e1-ba84-a51e6c8f714b", "comment": "Malware payload (CoinMiner)", "value": "9541f44d6d1292fe2b883c9fd9436086", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025139, "uuid": "fb10cfb7-4598-4e9d-940f-152f59ebdcaf", "comment": "Malware payload (CoinMiner)", "value": "73c732a1f0b74ff0f77d3590037370f79d50972b2ff51524fc450cc09e7ca360", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025139, "uuid": "12424e2e-d0ed-4db7-9d8f-49da59bb0574", "comment": "Malware payload (CoinMiner)", "value": "45517dd2474057d83cfb1a7c4b96a5b307039818", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025139, "uuid": "d382f573-9953-44fd-a376-0f7d1de2e77d", "comment": "Malware payload (CoinMiner)", "value": "3c86487cc62948bb1d460921761c66b10967ff6f69ee350f589860bff965c4a189eb2f4b5e18c6de926d113d9a8c1c72", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025139, "uuid": "298cf74b-7419-42fb-a24a-6ed4ea821fd7", "value": "T170322B2A7E450332D3A049F85479438F653C5633E783A3EFF773965E0A962448840EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025139, "uuid": "b3a3bde9-a192-46a8-8932-c74160ef04b8", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025139, "uuid": "8a3f61de-5ce2-48a9-81fb-f0cdf774aca8", "value": "192:S3ouWyyTBa9x+emleasOPFJxTEZmFhSacV:S3oQyQ9wNcasOPFwZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781025139, "uuid": "4e9047ad-a8b0-4a01-9e94-93008aefeb72", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781025139, "uuid": "2fb1c2b0-df78-4795-950c-d0efe6882113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025139, "uuid": "5e056cac-7e7b-446f-ba27-d45528398610", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d977c5-6430-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781029635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029635, "uuid": "1e4212db-0530-40b0-a278-52cb7fa75795", "comment": "Malware payload", "value": "69a770c1f80af5a6fa29164dc7454a0a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029635, "uuid": "8c5d91bd-242b-4f9d-991a-181d48991da0", "comment": "Malware payload", "value": "744b96e9e712d9cd1867c55f643c7ff90aa317ccbaa332e2dcbf6f72c22fe1af", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029635, "uuid": "c3eebf11-4d27-47aa-8c95-e7a63c7d2785", "comment": "Malware payload", "value": "84a9bc633bb25f809c13977f9a06ceaedf0b9d46", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029635, "uuid": "7229c830-d7fd-4750-8a3f-7026b4b47480", "comment": "Malware payload", "value": "385c60e1d48700373f4f0936f98e8ffac4f8fdd747a1c044bbef2a9e384d7eb6d6644eee6afcabfc7fbaf8f1cae53a21", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029635, "uuid": "28bbb940-03e0-4b26-91b5-6a11beef7d45", "value": "T1C772945179E3146BB283A0E57FAF862F39485113400FCD193F5CA2A45FE1F44A9EBA98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029635, "uuid": "cc22088f-8e2c-40f4-ac43-ba81806aadcd", "value": "192:BcnX7cblIeovKB3MbPzyeuifR6s5j1Hu8BcQs/yo3SPIN6RQDIeheaHaZu/pSpH+:BqX7cWiB3MlRN5j1/BIjCj8qut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029635, "uuid": "f6d93e2b-5378-48ce-95a7-a6675b4b72a0", "value": 17240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029635, "uuid": "80a1587f-8877-4f6c-8f49-36fdd0186af2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029635, "uuid": "a2b99572-1844-4172-81e0-38f799a33bd9", "value": "minecraft_license_manager2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87b429b-63d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780992298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992298, "uuid": "4d50f188-8486-48c8-9f15-b57c2a93d64e", "comment": "Malware payload", "value": "63c21a9172b084c04348507a723a7df5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992298, "uuid": "fcaf8fa9-9536-4285-a9b9-14c0a153316b", "comment": "Malware payload", "value": "75d6499dda26a923985a6e6dbda7194522219506f0425de64be285d2fb6a0f9c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992298, "uuid": "735bb505-9633-4455-bc23-6f4d74cae16b", "comment": "Malware payload", "value": "4795b1290da22b061f00c449a1b10af38c35d9e1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992298, "uuid": "8cbd42c0-b19c-41ff-bda7-c5d50afb1b58", "comment": "Malware payload", "value": "71dfe662d545051fae190a7e24c2f8163f99a1895f194616d56f2cb4e789b48e00a1a5218ff6908e3991b2c53b07d938", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992298, "uuid": "a7ca3c36-6e0b-4b24-b84b-bd2d1ae19686", "value": "T114136D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992298, "uuid": "0a3fdd9c-428e-4296-9e92-6397c32709d2", "value": "768:CXRWNGxV19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:ulxsco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992298, "uuid": "e8cf95cd-3a52-4514-b13d-92ec45fd078c", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992298, "uuid": "17eb8540-5122-4c7e-9704-ec2925128d40", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992298, "uuid": "408acff0-b5b5-45e1-a0a3-09531195ddb4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428de1c4-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985577, "uuid": "c26a5b15-6f91-4563-be9a-41ad4e5e6233", "comment": "Malware payload (Mirai)", "value": "817f51942d35fa4842f40a55e452d65b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985577, "uuid": "4dac615a-657e-4e02-89e4-9919049ae059", "comment": "Malware payload (Mirai)", "value": "75d9deb82cc1433bc5047e6712f91935b7893ca5c4b193fe9dc467d8c6de18fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985577, "uuid": "ce47bca7-0a6e-4975-9d11-f2413f93feef", "comment": "Malware payload (Mirai)", "value": "bf9157043ef59297ddddd2467eb1ac87360e0e53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985577, "uuid": "27722f91-a9c5-42d0-9648-59b0653dddb4", "comment": "Malware payload (Mirai)", "value": "45e90175e6eb97d7d83810284183934e5de17c38ba721fa6cf63f675f4159bc44b01b4182209c560003634ca62d3e86b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985577, "uuid": "8f2bb1ca-2321-415b-b26c-64ac8c370a87", "value": "T1E6D3E746BD418F13C5C321F6FBEE469C3B256BA9D6EB7103E9217FA037864DA0D26601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985577, "uuid": "ee7a4457-715d-4c02-b827-a7aa8ad19336", "value": "1536:7KmftG5Rxi1ZhyxtjEByWMA4qAD4VVNCTrH/Xx4pArEIZKwWI/glQzwywg80c12R:7KmS4ZhydEwWM54ZCXH/XylYKuN5PjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985577, "uuid": "ebee7297-9a60-43cc-b9f0-09d710e6c62c", "value": 134612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985577, "uuid": "43247b51-343b-4b0f-96ca-21ae1a9637b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985577, "uuid": "df486e8b-e6d9-43f3-9bc7-e5d7a836ef8b", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc93659e-63df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780994855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994855, "uuid": "c5e90d8f-3b2e-40a5-aa9f-d10e79fd7866", "comment": "Malware payload (Mirai)", "value": "06160078cdd1d3d8b3b69df1aa302ae2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994855, "uuid": "5ea5b9fb-fe59-4539-b1c5-a89383c90903", "comment": "Malware payload (Mirai)", "value": "7606480d81226e0f201a19ae2af183c7b5bc32e5591aedc029c000d0af17d751", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994855, "uuid": "efe884fb-e318-4649-bc98-696cb49fdecf", "comment": "Malware payload (Mirai)", "value": "3703d545f31759b590abd0dfab027c2ea561fabe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994855, "uuid": "a5a83cc0-e43f-4648-8b37-6b2d9b437f37", "comment": "Malware payload (Mirai)", "value": "cdc9d38f00a5c600ad6157c42f4311891625699f69992b4d10a20ec8f95764e1b1daf149ff53064a149dece2fee91859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994855, "uuid": "45904fa7-eb40-4799-bc17-3c67907711bd", "value": "T185C30845FC414B27C6C252BBFB4E438D7B2A27D8E3EE320399256B20379B55B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994855, "uuid": "ce45b145-4619-4656-9764-882515ed0d88", "value": "1536:hZEPFj/MUjpFq2fYw4VdAZhTqQsOaH8KsSkla/wyw/N/mXy2wH6rmYWpdOsjvw+X:hZQvFq24gPmPR8rYChDw+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780994855, "uuid": "01b725ce-63af-4b46-9a5a-bed38ac586ed", "value": 118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780994855, "uuid": "06fc9335-b181-43d4-a794-6d1f2d1098e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994855, "uuid": "7bebf32c-dcca-458f-a1f4-a589c365d77c", "value": "CRY.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3e3f7b-63e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997433, "uuid": "1724e7b7-a70c-4bc5-b862-5b589d982785", "comment": "Malware payload (Mirai)", "value": "5060245bdf91a8db2ac4165b2ed704e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997433, "uuid": "6e71c24b-2ea7-4db2-8e29-94e2e9930372", "comment": "Malware payload (Mirai)", "value": "76e0fe3c9ca985c8de8505bbd6a8d0626147f71fe769a4e5f0715f8e509f9503", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997433, "uuid": "edf56836-a012-4b2c-9016-08d6f0445d58", "comment": "Malware payload (Mirai)", "value": "c7d1e65faafbfffa53d00600a60d16cda8f5d890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997433, "uuid": "6ad80305-1b34-4907-bdce-2fbee294138a", "comment": "Malware payload (Mirai)", "value": "2bc8e799c66ed3fadd32d13f45d939f5c9a30cf0347c92f928d6734730f3d9ab0873f95be9a9a478148304896857512d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997433, "uuid": "f2b3d9ea-ebed-428c-88eb-e90b810e2b11", "value": "T170E31846B9919F12D5C321FAFB9E418933136FB8E3F97102DD206F50278A99B0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997433, "uuid": "c6ea66dc-803e-4756-b183-715e82c4d749", "value": "3072:SrNhDWllGguQMUzDEJX3GEafe2jKHEPNV/AwRNCmIIPvEP:SDaXvuGEJmEafe2jKHE1V/pNvICvEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997433, "uuid": "80450cf9-d405-49f8-8752-e578b05fac39", "value": 149684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997433, "uuid": "9aa855e8-b524-4c68-b9b2-6c74395e4482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997433, "uuid": "7bc89cce-c55a-425a-9858-f9f752a68490", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0890360-6416-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1781018403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018403, "uuid": "33c671ca-dd87-4508-a920-76192536ff03", "comment": "Malware payload (CountLoader)", "value": "cb364083c1dbe2d7715477e3cb61977e", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vdsina-vg", "colour": "#3B65A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018403, "uuid": "ec3443c9-672a-4b1d-bfe7-8a47aad25fb5", "comment": "Malware payload (CountLoader)", "value": "7710b253ee5fd1ceea3ab780a5d757b7f5beac224359c09e8a1b8a69b689fe2c", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vdsina-vg", "colour": "#3B65A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018403, "uuid": "6bbc692d-9287-4d24-86d2-075258afae6a", "comment": "Malware payload (CountLoader)", "value": "331d23f5eb6e8be04331fa75ac8b9152b3077af7", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vdsina-vg", "colour": "#3B65A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018403, "uuid": "794ee32e-14cc-4884-9800-850aca9928ef", "comment": "Malware payload (CountLoader)", "value": "6a5d41763c2ae3bcd9eb1b4d29e7f3595a24960432b592b030bb967aa63b7ab15b0b9028de1e7e1e86e0a67fc5a4e296", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vdsina-vg", "colour": "#3B65A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018403, "uuid": "c7decfb1-a5b3-4b68-95d5-d3f6a4bc29aa", "value": "T1C361402AECC39CA35213D6D3C2F2D62CBF7994DC002BAE85F9ACC45603A19195359F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018403, "uuid": "61359fdf-836e-4c38-86a8-e954003a7390", "value": "48:HDNv35j6MuPwiAIdf35wX5Rz5yCT2iAdK53f9Qll2Rk0dBYRgvKf:H2Hw2f3kLzTT24dleJDR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781018403, "uuid": "0fd50ad6-75e8-4d17-8e8b-02311c294ab2", "value": 3300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781018403, "uuid": "b511940d-6f53-48d0-8253-e409f18c35e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018403, "uuid": "c9c34f8b-7348-43bc-85bb-e9e66281ca54", "value": "image.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90ae1b7-63f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003868, "uuid": "61cb9ccb-afc0-4876-8a18-156d1c3e3b22", "comment": "Malware payload (Mirai)", "value": "b1b6a2abdab5601fb08de5541b93d284", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003868, "uuid": "f674ba4c-84bd-4f2b-85ad-8ebcbb94ecbe", "comment": "Malware payload (Mirai)", "value": "771b53080bd868d2b006aeb4077ff6503d60115db6c94624bc6b0bbc1cf698a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003868, "uuid": "c6d0dc7e-3f70-45f4-8602-3153d527c6ed", "comment": "Malware payload (Mirai)", "value": "9d0b9ddbe579259b98ebfc9734461f9f738efed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003868, "uuid": "36c95644-fda6-4cb1-b1bc-6b2fc035b313", "comment": "Malware payload (Mirai)", "value": "b4b79d9cd2dbb78c9684f186f6995322c4278898ba66784bfd835586ee47c9c7dbaba03dd64d4122d043dd236f90fa08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003868, "uuid": "8083b489-9b00-46b9-a877-29201bc2ae85", "value": "T1A123F1CB5123B4BBCFF029329476EFC2A269D275C2F950924A74CBEC523384E66ED151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003868, "uuid": "eb3e7484-ccab-44a2-9a83-8cdd0385b732", "value": "768:j/zDzm4dVX2HbsvVSw+bhKwjcsukAqSlOueXy/vdH90V2opX2yMWYKEs03W/BGO1:j/nCQ1kYveb4b8ATuEvJONZ2zWbEsn/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003868, "uuid": "09d88440-680d-472c-a2cb-9c18633746a8", "value": 49092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003868, "uuid": "e3e54630-7482-4a0d-8c6c-330a7566bf7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003868, "uuid": "aa5207c7-5243-4c57-9d13-b44203704acb", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08cefe6-63de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780994378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994378, "uuid": "1a173f3b-a9a9-4c75-9ddd-b3504b6c2e9a", "comment": "Malware payload", "value": "2a088fb984df3592c6ebdefc135a731b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994378, "uuid": "81c0e33b-bc43-4d49-b270-8fca2eb8d8f1", "comment": "Malware payload", "value": "79925092648a676b0c78790d3568d64bc7065ecc603438de96a6753ea689cf5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994378, "uuid": "b3924c2d-ba57-4e3f-8a77-af4cb95a1cd9", "comment": "Malware payload", "value": "f2fc777607c783fa033f415734bedef66a1ef828", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994378, "uuid": "c9099400-5422-443c-9169-dbbc00ef5510", "comment": "Malware payload", "value": "4e3bb8d4b302e4d686f66b0542954675f01225abe3d31050fed17f11eb37d8d82120841c3ffff49e4e97d7ecda005f89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994378, "uuid": "af178057-2fca-4959-b6fa-9e3822bfa1ae", "value": "T1AAD34C06B70C0947E1633EF43B3B27E193DFDA8124E4EB44651FAA8A9272D324589DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994378, "uuid": "d082f0bc-268e-4fef-ae8c-08e339276a9f", "value": "1536:+GJIcIHgGrxN69Oe5EiyksEup7CqC9Ubgy50oxzIHEvAvZo20N3/7092wxSpdbtU:+cIHg0xQq/gy+ogZvq3lbbyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780994378, "uuid": "94428fe7-7d64-4ab1-b1e4-e26eb9f14fae", "value": 137916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780994378, "uuid": "ff9a39c3-3661-4005-ac2f-f5f93e3b7872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994378, "uuid": "3fa17837-21dc-4493-9b57-62496ec48026", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5813da68-6430-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781029422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029422, "uuid": "6bdd4c95-0306-45d9-9693-666dcde0f046", "comment": "Malware payload", "value": "97543bc6d177da56d2d8fac52672a69a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029422, "uuid": "e8126b79-9465-4195-855d-bca31358acfe", "comment": "Malware payload", "value": "79d0f126ae3bb29ebd92a7c2b58fddb54783ef6f9abfd7d0b9283121dd9a521d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029422, "uuid": "3d0af9ac-6298-41d4-893c-53f996d0655c", "comment": "Malware payload", "value": "da8f810ff72267773c27bff749208d5b81b30e5e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029422, "uuid": "dd8ec253-91cd-481d-a5df-f8b366bfe619", "comment": "Malware payload", "value": "bd713f5efc0c8b60f6c5b2479e740de8bc4417f789be84e47b517a3a91e1c6094c9a986f4aaaa48f809288af47c7b053", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029422, "uuid": "feb35273-9e02-4819-8fd5-13c7d76a7daf", "value": "T1F1F0E1132C0ECC2D82F236B898A1E64CC54755440709B936C0D0E94F3AD07ACDFE399E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029422, "uuid": "21ce2dc3-f149-410c-9b9b-94527acff759", "value": "12:TJMxkBivpx6fmZ63jJ9nBHNjffjcGiGBDz0SoNvFrvWLMCLJOMWPGu:9Mxgivpx6f869lBH2GPBDuvJvWLMC9Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029422, "uuid": "ef964a7b-9e74-4f43-8b92-541f99e90ee0", "value": 600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029422, "uuid": "dcd641f8-1498-4c1e-bab8-7ea06549b644", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029422, "uuid": "447a60cd-9438-489c-97de-79f991a3d8d7", "value": "delta.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba522e0-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985834, "uuid": "5901541e-3ae6-4a33-ad4f-d96b9b55dd6f", "comment": "Malware payload (ConnectWise)", "value": "e523045efc1b0e31eab6485cad3564ca", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985834, "uuid": "6ca9530f-0ef0-4bb0-a7f0-d8c02528c4cf", "comment": "Malware payload (ConnectWise)", "value": "7a7ed30ff8ba87b35419cd0689ee91480f044a56826ffdd6f4e546538035732d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985834, "uuid": "03276310-1c14-4a69-b922-6cc5b18dc9cf", "comment": "Malware payload (ConnectWise)", "value": "e5dce0fbabe2a5fe4187f045ebb01a08a005636b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985834, "uuid": "5c808561-64a0-4bcd-ac89-bb34910b8a3d", "comment": "Malware payload (ConnectWise)", "value": "b92eec1a6ccf7e42d19ad2b9c48796d3f2eb615c0a1595bcc033e305231ffc75fa592bb762feb62f56eb4c7c2b07ef35", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985834, "uuid": "17d65fd5-fdae-4860-9bf9-0fcf1865255b", "value": "T1F346E101B3D695B6D1BF1638D87A52A96734BC049316CBBF5394BD392E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985834, "uuid": "fe54f90f-1a13-4474-9cfa-a6fc70299599", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985834, "uuid": "2d3e1083-7bbd-420b-863b-12c7eb285735", "value": "98304:szIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlX:shfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985834, "uuid": "630093f0-4ef5-4c5d-b816-106bdc35c0d7", "value": 5786088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985834, "uuid": "a5c32160-0de5-4405-945c-7f7bcf99379d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985834, "uuid": "6bae4fbd-bb18-4e49-8639-2845c5465b2b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303f2dfe-640c-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781013893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013893, "uuid": "a12e48f5-0ed5-4eb2-bb7d-f1930a096614", "comment": "Malware payload (MassLogger)", "value": "3d2c9ed904ff7ed6b8a698d528020a7b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013893, "uuid": "b181f206-cdd9-449b-8baa-ecce4a77c8fc", "comment": "Malware payload (MassLogger)", "value": "7b13d7f29b1baf4deb469eb9b8ba3ed64061dc8614de31e5b04e272fdc4de900", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013893, "uuid": "5e416a18-191e-4468-b2e8-c999c125ec77", "comment": "Malware payload (MassLogger)", "value": "d2892aa0b11adf698427468321e49e59813e0189", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013893, "uuid": "51a1b1ea-37e0-4450-b060-e8ca13c66380", "comment": "Malware payload (MassLogger)", "value": "24456ceaee39787e7aa3ecaa9998b8b19ca9eb746ae9088674f3188391eee140853ee67b9848ccb15e670fe1b019c938", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781013893, "uuid": "6b5ffa28-58e8-4157-8bc0-b67ce5cdeeda", "value": "T15405E73DC964412ED1B2D729C59A085FF8822E0B523CE84B64CB274F6F639467BD236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781013893, "uuid": "10c1e215-c259-45f7-98f4-973127b4671c", "value": "3072:z5jx9e92YjEoT3MtsgZwxnPc7ZbFNb67dowopfEoD0iCQVdW0qBdjPbkqU+7nwM/:p7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781013893, "uuid": "df3bb63a-4d6b-40e8-8226-5ea36607ef77", "value": 808430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781013893, "uuid": "da1761b6-3edc-4181-aa4c-8a75a1bc5e31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781013893, "uuid": "78a3a366-c96d-4ed0-94f1-ab22751a62ca", "value": "Angebot 15492026 & 15602026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ae0b38-643d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035127, "uuid": "e64a262b-2e4c-4a8c-8755-f5acaf2c5b10", "comment": "Malware payload (Mirai)", "value": "ce174ca0d9c168d25de95eb5f867b605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035127, "uuid": "42b746f4-f149-4d24-a410-966fd6022d3b", "comment": "Malware payload (Mirai)", "value": "7b7ddb77537c7b57a8553d7b4bb08f003c2c72b2bfb8b37dc464ebd85f5c672b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035127, "uuid": "245746e1-fdd3-4a96-acb0-77b89e37d684", "comment": "Malware payload (Mirai)", "value": "4ac8f77d288defd49936ec4d57bde75307d6b90f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035127, "uuid": "8ace3ba2-e3a5-45bc-b73d-dfdc245d469c", "comment": "Malware payload (Mirai)", "value": "c63b3999d6fb29ba08f94826032eedf3f2f66b80f68d0e1098dcab1771a219b79d8e8406e2546187b9ecd930aa659f4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035127, "uuid": "1288a7fc-b9c8-4ce1-8818-9e9a47f30cfb", "value": "T14A233C076481C0FDC9A6C2F45B7FA61BDA33F07F1235B65923E8BD26AE4DD211E1A148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035127, "uuid": "d23dc3da-9693-4b97-87cc-72f8aa770990", "value": "768:t+ujdo18qax9QKfFv/CtVD/7vt9rsnKVHbx1pKVgrOUXU23qkpl8It:0ujdW8qC9rftCtVD/DtoKVHhKVAOwjD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035127, "uuid": "bb838b23-d74b-484d-b9df-8cf730c3c5c4", "value": 47408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035127, "uuid": "a9515ceb-1e7a-4aa3-a2c4-970aa2f5070e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035127, "uuid": "2cb24ae2-bea7-40ff-84da-e649a9471551", "value": "godisdead.13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71b03c1-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781016804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016804, "uuid": "a025c9cc-a162-4512-aaca-cbf68d54c90b", "comment": "Malware payload (RemusStealer)", "value": "111edffa0604ec84c71001ac5f064e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016804, "uuid": "547f9549-fbde-47c6-9a4c-50c35a6530d6", "comment": "Malware payload (RemusStealer)", "value": "7bb3db1f52ff88a510e95f144b2988226be225edcd391e4eef93c22e36f560d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016804, "uuid": "aa60be45-c6c3-4262-88aa-8548de91deb1", "comment": "Malware payload (RemusStealer)", "value": "e1bf9e5fa4df4e74035e120eae2841c66a134a5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016804, "uuid": "275fcf11-53ec-4765-a82b-e802ea983024", "comment": "Malware payload (RemusStealer)", "value": "71a0b69adce62f3931ecda5b010acd4688975769a5803bfeb3a46c3aca2c06d3aa789c2da8f646f33f3fab5f5391d822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016804, "uuid": "bf0186d2-f5b1-4248-843d-2535638e72a5", "value": "T18BE55C0B7CE808FAC1AAA33189B351527B75BC540F3227C72A52B7782F726E06D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016804, "uuid": "4b0c648f-5cb5-4f8c-a80b-e6bfc68db70e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016804, "uuid": "a44ebc48-7d1b-4ce2-8fca-1fbbe26a0a0c", "value": "24576:q+2i7fUScHiJbMbr0k0MsNCoq90dwmhDY9/nBele7tKDyiZfz2VQfMDph:q+D7flccMckdscf90dwCDanJLDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016804, "uuid": "88f6c8b5-e503-4c5d-a851-a5de7e284cfd", "value": 3196040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016804, "uuid": "51ca8773-0245-4d0c-aad3-004770fb2dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016804, "uuid": "dc723df9-c2f7-4684-b0c4-ad0cf9e7950b", "value": "cry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90d612e-63cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780986715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986715, "uuid": "2ecfd2c1-8655-477f-b859-e66b873979a3", "comment": "Malware payload (Gafgyt)", "value": "c9516dc830e95e44a06098c1872a9faf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986715, "uuid": "24ec4095-c1c1-49b8-98bf-15df987e154a", "comment": "Malware payload (Gafgyt)", "value": "7d6b9e1e5532d54ddefe810eb23c48770b852b86d309c540f95b0bae995627b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986715, "uuid": "7edd931b-0d57-426a-b324-1ef94a073863", "comment": "Malware payload (Gafgyt)", "value": "cb6ce8732afb38fab8b55bd4787dd76b0fddd7dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986715, "uuid": "9eb5e05b-368d-48c7-925b-47f27ff486a5", "comment": "Malware payload (Gafgyt)", "value": "a5a349297d7d7e938f563e1d9e22d7298c4cd5ae3a741199d042b82e739a06294e455c7ab49348046c938bcd39ccf3d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986715, "uuid": "93177475-4fb3-4603-86c5-c584eba29135", "value": "T1C7442F397C27E32BC0A6EF759BF5BEA1C759A2C31B819203E1A8815C0DF155D285FD88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986715, "uuid": "f765ecef-8108-4f92-b5ed-6352cac5bc16", "value": "3072:SgwiDHlD3Txp2Qg+LiFniDr5XeRLYKSIXFdb3uwjfbemlMkbyLUcCn4q0GkmKZkl:SyDBsKYMWO/BTmKZkFMsKfyZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986715, "uuid": "2bf4e707-1065-4df7-8325-2a9b3f257bee", "value": 276142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986715, "uuid": "b88113d8-4319-408d-9a33-d720ab992753", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986715, "uuid": "2f978422-dbd5-427e-b438-1fbad75d286d", "value": "dissmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd80d20-63f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781003554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003554, "uuid": "0f151499-da92-401b-b14d-b55b511fb0be", "comment": "Malware payload", "value": "a7b3cf691789a0317d71806df20a4674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003554, "uuid": "3af9cfc1-e0dd-4de6-85b0-2a5243c47aab", "comment": "Malware payload", "value": "7e50063146793a723b18bd5e926ac6fc80884f1cf18945caa5b483f8bddf8ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003554, "uuid": "c65ff5a3-8c1b-4f05-b792-4c4fbd9d38f9", "comment": "Malware payload", "value": "de075b8599c393953694b12a45e68efceb5de689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003554, "uuid": "ad28200a-9352-4647-8833-fe3f4c08f3df", "comment": "Malware payload", "value": "c067c742400cc086e9e9fdb091afc210cf872ff78b9eed6f11b1fcd198964244c465fb8e0e1daefc1d001f81338ba37a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003554, "uuid": "f979504f-5662-4fc0-b6ab-9828474c3a5e", "value": "T1A0357A46A7A5D0A4C975B03B8570563AABED7C6D032082BB33907D7EDE336D46B39E10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003554, "uuid": "d37ec1a8-c576-4496-9b11-a687d90198b8", "value": "cb64251eda7e0921091591f34bd833f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003554, "uuid": "d358ecb3-93fb-436c-9d15-a48db9de53cd", "value": "12288:83KWNKfS+obx25KdbfukM34I3LA5BKS63VRL7YkW8NHbalMTqZ6y9t+uaThK:MNKfS+O0obG53xEBKS63VdYkvWMN8sTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003554, "uuid": "fc7991bb-c764-4b87-8f31-7e19210c2cf5", "value": 1159616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003554, "uuid": "26f6f901-75a9-4952-a87a-f3ce04c1af9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003554, "uuid": "afcb6631-78bc-47e9-94c7-2a94ca411af6", "value": "SugarCRMWebApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac919461-6441-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781036865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036865, "uuid": "0472449c-24c9-44cc-938c-73c54634b6ee", "comment": "Malware payload (Mirai)", "value": "e3d9bd0fbe8d035374452120f8ad47d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036865, "uuid": "4f24fe6a-6589-4c19-999f-65d6f3c028a3", "comment": "Malware payload (Mirai)", "value": "7f46d40cebdac6476437dedadc2f80a031c6abfbca41f3017c93fe8c856d63bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036865, "uuid": "0ddd7a02-e41e-4a13-9888-d3498cd5c9af", "comment": "Malware payload (Mirai)", "value": "2ec55ce2299ca4467f80c3dc759684724d95e3e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036865, "uuid": "a4239219-b2fb-48ff-bc73-cd979c221703", "comment": "Malware payload (Mirai)", "value": "fe539b53bdcd9451b5c9c9cd202e06b01d0b51054fe1fe2d67fcd0686a470d2462f06fbb203daf4b3797c42292de79e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036865, "uuid": "11a5def8-edc9-449b-a42b-9e2f8ba69ce3", "value": "T1C9B32886BC81C712C5E160B6FB1F92CD372643ACD3E67153DD18AB29674B8AB0E37641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036865, "uuid": "8f421f39-8969-4e7b-a7b8-8d8470035600", "value": "1536:LH65yaZZRBrKw3rxqXYd5cQPJyOyPd4fbX/Agsn0kN9:LH6vHRZKY8YduQBvy1ObPin0Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781036865, "uuid": "b77ee39a-fca5-4548-a0c0-82f21085d187", "value": 108160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781036865, "uuid": "315cd7a7-315f-477e-a78d-fd8085e1ad38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036865, "uuid": "f416f5bd-b543-4ac6-9081-93ef490c1eb6", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bb6345-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985576, "uuid": "3f8fcd4c-3cde-4ddd-b69f-983cbed7aa52", "comment": "Malware payload (Mirai)", "value": "5a0f02838108807ec7090888cda46324", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985576, "uuid": "28394504-36b0-4382-b2a1-921dc38e687b", "comment": "Malware payload (Mirai)", "value": "800d1b62c2686469c29538efcb884baad04915ffb24669d19da87d5a78d2bfa4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985576, "uuid": "54d341d0-fab8-40d0-b4a2-51ae67c55f5e", "comment": "Malware payload (Mirai)", "value": "62da92aaff014a0638ce4a4c782ab56c5c5c46e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985576, "uuid": "092c068d-3a04-47e4-b959-34cbbf77be67", "comment": "Malware payload (Mirai)", "value": "b409a335a5e0d138aa575d1e9fa53e927006d55efe68c1c76a4f44145a6ef6e84863a4a320264ac98b7d0679f37f33a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985576, "uuid": "a3d4d689-811c-4f03-a048-f20653389776", "value": "T169E3FA06B9418F12C5C211B9FA9E455E37137FB8D3DE72029D30AFA077868EB0E76616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985576, "uuid": "beb23046-291a-4ba6-84de-5bddde33c8e8", "value": "3072:hJe7ToCUe81nxXFMVkorGaXob9cj0TzgCLes3:Xe7ToCxsxXqVkoyaWcgzgCLes3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985576, "uuid": "f344e9cb-167d-46c1-8cc1-ebd6f77d8864", "value": 149044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985576, "uuid": "1733a690-e229-46af-9854-dc21df2cd3c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985576, "uuid": "e0c4942c-430c-4674-9ea0-11c62fc87204", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ddf836-643d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781035104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035104, "uuid": "c64f2ea8-360d-4376-9fed-b49e896148cb", "comment": "Malware payload", "value": "03ace0bb6bb996cc6ad6b0b53ac04714", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035104, "uuid": "242eefbc-4221-4b44-8bbf-7989323cc9d7", "comment": "Malware payload", "value": "81448c97aae2455ced9cfc30883f7d67890d1faa03309344f521345dd79064d2", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035104, "uuid": "e7cce022-6e55-4234-b9fd-374fb8bcca4c", "comment": "Malware payload", "value": "fb6d321f3fb1802f2122fefaca46e781163a3237", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035104, "uuid": "1a9bf33d-89e2-4a03-9d58-e867458b0d07", "comment": "Malware payload", "value": "761258308ec51937f828cddbe380a3103f00ae9d0bd68620dc12b143263b34e47681a69238895d2de3bfb667fb4a57d5", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035104, "uuid": "db232fdc-d15f-4117-b9bb-102402f03488", "value": "T1A5C24B05E3B300BCC49DC7B4C26F9612AEBE3C062760B9DF67A126197C707947529EB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035104, "uuid": "9b20dcfa-f929-4c66-8473-34d222a4cd93", "value": "a2706f6f638154d2b431abe5e1551efb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035104, "uuid": "84955b0b-9db7-4ac4-bccf-dae6ede99589", "value": "768:1pmljpNfUDnCy8Dbmk5lwOK3ANWp+AAAAAAnk:1pm9pRUDnCyGbmk5OOK3ANWsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035104, "uuid": "88d863a6-5c2a-4d82-8a4c-a504f20d10fe", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035104, "uuid": "cd6de18c-a7da-4d36-a9fa-6f3412c4bfc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035104, "uuid": "46eb5ac5-51f3-44d3-b0ab-8c43481832d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3068574-63c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780984102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984102, "uuid": "1094f47a-0b86-49db-9efd-c1a4d2ce417f", "comment": "Malware payload (Vidar)", "value": "83590efb7743629213e65ee31aa6ede6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984102, "uuid": "c085644c-9c13-471c-acf1-c4a2614c9bd7", "comment": "Malware payload (Vidar)", "value": "81cabde5b56606962252d9c70793c98d97cd781d41929f5953266545468fabed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984102, "uuid": "edd48f31-76d6-41cf-ada6-50f5750e2700", "comment": "Malware payload (Vidar)", "value": "12b22c8b2b5477d71cbb2b8c200f9a2ab8b54722", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984102, "uuid": "5400fe57-651a-40d5-aac4-524744be307d", "comment": "Malware payload (Vidar)", "value": "3ec65419249ecb2b7e145937a3a227703e61a5e2f30e2b18bea072fa3e4c886d9ca23485321ea9bdac7da19008a3a191", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984102, "uuid": "92b60b44-ca2d-4fac-95bf-e6c3a3a63651", "value": "T147F59E43EDD108B9D09A623189A26692BF3CFC154B3567C32FA0AB3B3E767D16875344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984102, "uuid": "9d8faa20-b64e-4d67-99b1-cacdcc88cfc0", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984102, "uuid": "77bc21d0-cb35-40f3-b31f-b98c154e6d8a", "value": "49152:YG3ocRtmIqo/yUdWpN4Z2wOj8mCemV+zp:YDABsMOjBBE+zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780984102, "uuid": "b8387a29-8207-4f4c-9033-9b0ba09f7395", "value": 3480208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780984102, "uuid": "bd1e26d8-6b14-481f-aeaa-2c8770d878d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984102, "uuid": "d50f20eb-83a8-4c29-8451-873e26d7de42", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a51522-63f3-11f1-a769-42010a9c0008", "comment": "Malware payload (MotionEyeRAT)", "timestamp": 1781003108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003108, "uuid": "f01fc8de-36c7-4dc4-9140-608ded49d105", "comment": "Malware payload (MotionEyeRAT)", "value": "654f1ad640c756aa204b70296d34e50a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MotionEyeRAT", "colour": "#7A9B5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003108, "uuid": "5f80ac75-067b-4dc6-81f5-a3d22f2d5d00", "comment": "Malware payload (MotionEyeRAT)", "value": "820c6644374b2b0b71d2c594736b2c5c0e2f03dc9b4655b642c25653d9d1900b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MotionEyeRAT", "colour": "#7A9B5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003108, "uuid": "7939fdc6-172f-4388-9583-c5bf827417b9", "comment": "Malware payload (MotionEyeRAT)", "value": "3077c7d3bfe7053a96596f7d1c3cdbae77341f42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MotionEyeRAT", "colour": "#7A9B5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003108, "uuid": "62075629-161a-4c64-8a45-39cf3f8de8a3", "comment": "Malware payload (MotionEyeRAT)", "value": "55708b6ed41c520db993769ee078c14a47d58e72968ded3d9d624ecfac9240d3f926e84df0f903761480c627a2b3693b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MotionEyeRAT", "colour": "#7A9B5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003108, "uuid": "4df9c838-52d1-40ad-8b5f-45ac242f7583", "value": "T1D3056E2AE7990078E0B6D1B5CE574543E772B80A1360BECB07D09D6A6F3B7E0563E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003108, "uuid": "6f3ffdb0-24ca-4888-9616-611253c2e6ef", "value": "ba95a74003b82085786f8e70607ff257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003108, "uuid": "de5fc1cd-65c8-40be-83ff-f85916e04dcf", "value": "12288:n2Wpv5jMLFwfZTi8zAzBGgkohnCJpwP0ZgyuDgsMOmXT:nTjWAT5zAzBGgkohypRZ5aRyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003108, "uuid": "2cbc0953-0faa-4098-b185-7f4e2ec787c2", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003108, "uuid": "c53879e7-0190-4663-a0a4-5746ebfa6ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003108, "uuid": "63a263e1-f90f-4324-8429-95801028c8fe", "value": "820c6644374b2b0b71d2c594736b2c5c0e2f03dc9b4655b642c25653d9d1900b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867baa88-6440-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1781036372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036372, "uuid": "1bb22086-3a21-4dee-8a59-7be6c66ba615", "comment": "Malware payload (QuasarRAT)", "value": "908ac3ca4f6d2f7c4fd39d6f11052092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036372, "uuid": "5ae9a6a7-748f-463f-a159-3bb4871724f1", "comment": "Malware payload (QuasarRAT)", "value": "822d5678d27c0da20502968808cfa63ac4e3fdb58620fadfd0c9f4ccfe3a6625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036372, "uuid": "7be10b31-c1f1-4e71-8d32-a37ebee9ca40", "comment": "Malware payload (QuasarRAT)", "value": "c877249669510eb8b0cb422b419dfb503d1c98ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036372, "uuid": "b085683f-d822-4f40-b7f9-bf2c800ebc80", "comment": "Malware payload (QuasarRAT)", "value": "bcf28cbf843b1eeaf5850aa1bc15d25fc8afc4a9c82a8907f583a940ba3982369e5458b97388512456322df7577b7ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036372, "uuid": "cb331e5b-0b06-4de3-9056-674f3e666629", "value": "T16005F0F9AAD0FD32C2656931F8109146C33FB80840BFCE5EA5406E6CF7AB6C05596E9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036372, "uuid": "58980e55-4e45-4d3f-b697-cc35cc8135e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036372, "uuid": "eb5a253b-9a7e-4d82-bc82-920abd849c8b", "value": "24576:G01DULKUOAexikg4NqeNVdYQ8gbHYYNnDQotRN:GU1gkgk3dN8gTNnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781036372, "uuid": "d839967d-0426-4819-9068-98ab80f38bac", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781036372, "uuid": "48a31bdb-b7d9-442a-85a3-b2d21c7412a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036372, "uuid": "bd22e9f6-953d-4bb8-8a98-370464ec64b5", "value": "SecuriteInfo.com.BackDoor.Quasar.277.4963.10672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7108b46f-63b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780977924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780977924, "uuid": "1cd51afe-7805-4fcd-b5cd-4a1cc9f89ca2", "comment": "Malware payload (Prometei)", "value": "4ebcb1e06ddcd81a4c8c8e8f88ed37f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780977924, "uuid": "6a832acc-8037-49eb-a0a1-f7e4fc15b7b1", "comment": "Malware payload (Prometei)", "value": "82317107f5be9f7f6c73c3bda834a69461f7e94cef83587e72ff6749f7b94498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780977924, "uuid": "4b4b9c6e-2f8c-4c4b-b36f-7883204066d6", "comment": "Malware payload (Prometei)", "value": "60155b7cf7764842b15376b7d8015c1ba242ea20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780977924, "uuid": "723dfb10-9f2a-4685-84ee-909543c82e9b", "comment": "Malware payload (Prometei)", "value": "836ca6680f748a03384933c1f0c73c68be0cbbd8334bc5bb50e3dd6534d10d9b970ef52ac37a58cf78d3a4b4a89332ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780977924, "uuid": "fa161812-346c-4915-92e4-f0fb6339a04b", "value": "T10F3533446775ACA4E7B4D8484BCCB8AF53398420167F1F8BE4325CF7269C927368B638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780977924, "uuid": "f3a1c6f9-bbb7-4e06-bb21-745e08e9d257", "value": "24576:hzfEtBkjj8t0D/p5fAZ6LNnw3sXQyXQ9enZM/CTC2c/O:hzKB8j8y/fvNn005geS/AXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780977924, "uuid": "d3b9d4e3-68a3-4b33-bd84-9ae09e71c064", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780977924, "uuid": "a8e17122-9372-428d-b0ce-49237fec642c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780977924, "uuid": "c316aafd-2050-48e4-9957-64e1f899c36e", "value": "82317107f5be9f7f6c73c3bda834a69461f7e94cef83587e72ff6749f7b94498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046821b9-640c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781013820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013820, "uuid": "f39cb635-1298-4418-914b-efe3af52d9d5", "comment": "Malware payload (AgentTesla)", "value": "7a8f745ea692ae9d73fc319c2920f694", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013820, "uuid": "501f945e-adfe-44ed-acea-75fd2b0fe34d", "comment": "Malware payload (AgentTesla)", "value": "8459ced0c6d3ac445339ef8146a4267bcba853c5b0c4acf1dfd9b198f8b1ffb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013820, "uuid": "102e52e2-6401-410f-88e5-0cd9dce805e0", "comment": "Malware payload (AgentTesla)", "value": "dd74d58fdd63a2fd4e0cf9b13eb2990b1378f4d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013820, "uuid": "ad20c2a8-5de4-438b-b621-2ed12157a807", "comment": "Malware payload (AgentTesla)", "value": "5fa614d95115be494afec9a7b620ae8fbb39e7fac35ccbc0a676151de41e35027671501e6d3fb2a157709c53bc271b70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781013820, "uuid": "cb06c41c-8aa6-4bb7-a973-3ccb0282679b", "value": "T1767621310354C672E2589B9E26B57128540E5DCE98FAEB013A5E87B1127E83393BF7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781013820, "uuid": "7520e211-f2c0-44b0-ae3e-a7b1a59d84ec", "value": "98304:S/3qytn9SNkgUz+/b7OtOIjp/NP46AL8iL4tIjUNclAriYL6uR9hQ:GJsNoqUNP46AL8EjUNcKriYL6uHhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781013820, "uuid": "947a1a74-f75b-43a3-83aa-64d49bccf1f1", "value": 7198846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781013820, "uuid": "5df4d2ca-bd80-40ee-810b-23e86d85c8c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781013820, "uuid": "96f3c679-ab1c-4663-ae2d-a8c2d0e98b59", "value": "Transferencia.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa759c4-63ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780987443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987443, "uuid": "7f4e142d-cdbb-4347-a226-51954d56fa32", "comment": "Malware payload", "value": "e5ba0ff868d83631045444cbdfa90d9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987443, "uuid": "4a3b9d26-9e3e-4f97-b1a9-dc9abcae8a0d", "comment": "Malware payload", "value": "8552ccaa4190d76675df2563bf5d588b6ed2903eac0fc7889f22ae95c887a05f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987443, "uuid": "4bb5c8f5-022e-4cec-a211-29c4e99b1cd0", "comment": "Malware payload", "value": "247288afd759bef93aeede517703f4b6f1296c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987443, "uuid": "7c41f2ab-913c-4703-8f4d-96f44383876f", "comment": "Malware payload", "value": "4f564f5bf8a2790f2d4b8ea3402b87c61372acc85eb12fc85a840c76af80e2562ab0f1ec512fa93e1c52bbf50021a842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987443, "uuid": "92dd8971-1844-4d1c-a101-ac2e0289ce92", "value": "T103636C5EBBC59321E3DF877AA83246060271A4076E13DB9E0CD9115A0F72BD48B5CBE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987443, "uuid": "42e245ec-3e4b-40ca-a7f4-d4083bdb5177", "value": "768:3ZDPKwRxBEioJ8eeIYKXSH1CzD2FrgcfKLHNVdSFiLhodRmiTIvl:5KOxBfoReIYfCzDrc2MFaIRmKI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780987443, "uuid": "ee697571-2a4c-4423-ac53-33d441aa4d35", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780987443, "uuid": "43b3ceb3-cfc1-44e9-8ba5-1282c6cbe065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987443, "uuid": "484718dd-0623-4612-9f38-c6eda10e2570", "value": "8552ccaa4190d76675df2563bf5d588b6ed2903eac0fc7889f22ae95c887a05f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c86dff0-6443-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781037643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037643, "uuid": "9d73f860-3e3d-49da-835f-7d89c00439d1", "comment": "Malware payload (Mirai)", "value": "0432263ad407e4ba4b816834e8fe27c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037643, "uuid": "c6abe86d-c34f-4f70-85eb-ae27afd09125", "comment": "Malware payload (Mirai)", "value": "85a4b1ae3ad71c491ad162e6ca992667c0656357d4806a240d4e2b3bb4b4163a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037643, "uuid": "185c6968-a870-44c6-b2bd-4387c9a84dd5", "comment": "Malware payload (Mirai)", "value": "636d71123fffe3a0a60b97b0bc8fe0b4a459a935", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037643, "uuid": "38967761-9d89-472c-94bc-5b8d463c0f05", "comment": "Malware payload (Mirai)", "value": "077bab96c512f32952e2d38bed309aa6be247b2a3f074ee44d721bfd931c43ffc26c8f662035fc0acefeabe58a0b5df4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037643, "uuid": "0a9b1c51-b053-4d59-b6af-1ffbacb39dff", "value": "T182730259F59618B8C750567DE1FD5B77BDAB6FA923BB389203104D0AE18E2005C32BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037643, "uuid": "3c803669-a590-4516-9a67-fd8a95831411", "value": "1536:1ctjD1xBoNVEiuBhZGMeb9xcUQ7pjkqgKtvrTqdyhR5MzY:1ctP1xB3ich+bmpM+WIbMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781037643, "uuid": "c5b2c2f0-23e0-4646-a357-986939b69d89", "value": 76412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781037643, "uuid": "37aa3dc9-a4d1-414f-8eb4-f2ea72b59717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037643, "uuid": "3cfa44eb-b7c6-4b6c-b815-2e795c82f63f", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac86125-63a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780971069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971069, "uuid": "78f9b415-bf71-4cc0-b7b5-ce05b38f6d4b", "comment": "Malware payload", "value": "3f3269748e33732c97cbb2bb9fff067d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971069, "uuid": "ddd6c1e5-f6de-4770-ba81-404c6c96ce6e", "comment": "Malware payload", "value": "86840d002c5d05fb3a10dae51ef9d615f89aebce666b52e230171c1923dae17d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971069, "uuid": "9d5109d8-e76e-42ec-a83d-517ac516224a", "comment": "Malware payload", "value": "9810a5800177eaaaa22e8f236ac3960e335e4043", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971069, "uuid": "2b752225-2cda-48f0-b106-60c4a22e555a", "comment": "Malware payload", "value": "abbfea3a9c764bf81d652a2fefd76c08ce24a3e7f4d53f4e16e5a19ceb0ab0b26c23b76c4b128051d04c42e6d3e0ca94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971069, "uuid": "499e70c3-8fb2-4527-af93-b926cee9c040", "value": "T1E373393576751A2BC8C8A97D12FB4BA4B2F6224E14E8C60E7D730F4EBF312501A522F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971069, "uuid": "6568e6c4-b785-4d9f-9b60-a98c053ed42f", "value": "1536:P6bQ14X0U88vfXSQokQ7sanIif+4evnyeweu:PjhP/lns09eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971069, "uuid": "6b799f2c-77e6-4218-8cbc-95ae6ad179da", "value": 74904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971069, "uuid": "8e38aa9c-5a2c-4518-b9c6-3c664376c1ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971069, "uuid": "a349bffb-b411-4032-8ea8-be3e61677465", "value": "azsxd.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a91315-6410-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781015780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015780, "uuid": "4053d003-1402-4887-8c6f-bf54bcf02aac", "comment": "Malware payload (ACRStealer)", "value": "121e063ac9bc642e4c3f491770084473", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015780, "uuid": "0a2fe0e6-9c61-402c-9b22-7f652e18aeae", "comment": "Malware payload (ACRStealer)", "value": "87053c64d489ffa6a3754cf44641980e13a5acd515e9c2b5c269c8018016495f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015780, "uuid": "6c100805-3d88-4e86-b577-68b2f6e159ed", "comment": "Malware payload (ACRStealer)", "value": "2ac811450084f21fc9346b740f721b37f2d0089c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015780, "uuid": "3b8b38c4-5521-4b37-90a1-afd42b21effd", "comment": "Malware payload (ACRStealer)", "value": "920ff40059e91407b676d177e0e233be6623d6f73aec69f57be561b967e93e9b8f4e5eeedeac4dec0f7303f92fba77e9", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015780, "uuid": "5da5b7ca-f71d-4f6c-8b48-7641b48aef4a", "value": "T1FDC56B46BCE109E9C49A633288F12695BB25BC440F3217D72FA1BB782E73BD46C76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015780, "uuid": "16ed2c8f-6ad6-4ac0-80cc-dc59f53b9d8d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015780, "uuid": "ac7b55aa-85f8-46b8-8b06-1ca325952e41", "value": "24576:sMMtls/7SxqW3ThLM6rfQ7ffUUs4a77cuZjoNkS/EUdNC7Ub5Q7f/nBele7tKDyR:sMMLs/WxThA67QjMUsPcuZ0px/snR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015780, "uuid": "c6606d47-9465-4408-9787-1421eee13270", "value": 2729608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015780, "uuid": "44327336-5e1a-4742-9e3c-68fdd49fde72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015780, "uuid": "0fc73b6c-72ea-4e07-8bd2-87bf92281054", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e7ef9c-63d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991431, "uuid": "97c9e758-4dc3-45d8-956a-b913ff2bb3e3", "comment": "Malware payload (Mirai)", "value": "04911ce03df9af6be8427b4c64d2d76b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991431, "uuid": "651d51d5-9454-43f2-ba68-a1052bc07b52", "comment": "Malware payload (Mirai)", "value": "8750e17bb0626115cc8234665d8d694ce1a80fc6ddbda99ff1f91400e5b94e44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991431, "uuid": "6a857286-97be-4186-bfed-ad51c716e102", "comment": "Malware payload (Mirai)", "value": "464aa5c3e0af40199f9f7e256c5944d489c0c175", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991431, "uuid": "a74ca0da-5978-4f9e-b7e0-f87dad1901af", "comment": "Malware payload (Mirai)", "value": "2bcf487825cd80c459bf1da9a9f0a542dead49c15615fac52244682dcd1e5c280a8b91c4bb6f1ca9db010f200066892b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991431, "uuid": "e12e2e19-4304-4879-91cc-1c884e7d9c19", "value": "T11F3302C2E1D0FA92E5119571CABDCE410BAF00F871E27FC59A51060ED246A175B3CFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991431, "uuid": "6e2876c3-58dc-4db7-86dc-df5cf1d6274b", "value": "768:RbOEtQjkeFSwTBddIopHxe3aGOazvoChIT1DPB1HrO0CEWVQyJRaxZawos3Uoz0:RbOEtudMKdLxeq0TB2PB1SCWVrJ0Tz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991431, "uuid": "3c940fb0-7eb0-47e7-a36e-e072226f5971", "value": 50376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991431, "uuid": "33ea1ce0-9ae9-4bcb-920e-d7e704725309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991431, "uuid": "b08964a1-f421-4b1e-a64d-02c289ec8a15", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265aa38d-642d-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781028050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028050, "uuid": "38a8c8e1-b9a7-4074-8911-b6956ca6d432", "comment": "Malware payload (Amadey)", "value": "55917203db6ac7ee08c16fa9979c929a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028050, "uuid": "3ec35ed7-dcaf-4618-be72-7ef7d5c6974e", "comment": "Malware payload (Amadey)", "value": "87a65052c58c9bfc1b5bcf28248d5af381069c926b7d2ccfea1d7239278885d3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028050, "uuid": "bb106daa-22b5-43f1-8970-624bc59621f3", "comment": "Malware payload (Amadey)", "value": "4b70ff661ca0ac13fbc279a0836fde1a417150ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028050, "uuid": "552d7890-6241-44a0-a151-046d3368bc98", "comment": "Malware payload (Amadey)", "value": "285bfa6ba6321d5e5267fd7379575677e8511375787ab31b8067754d45894bf89e565867d28073a459d9c01955b288a2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028050, "uuid": "97c7e7c3-67c9-48fc-a327-2bc9f7acaf93", "value": "T1F7557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028050, "uuid": "73f44d41-4124-49ff-8d1d-5484b1f5018b", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028050, "uuid": "afb69f5a-9f56-44f2-ba52-53598559a54c", "value": "24576:3rR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRWzOnW:3kHmiyCkhh2Bamituw+Uox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781028050, "uuid": "2a430526-9b54-45d6-8dcb-85d708290c92", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781028050, "uuid": "e2cc03d7-277a-4b17-91c6-c7d841294a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028050, "uuid": "05d25122-b13e-445b-8956-7d1656cfe0c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5571ab0d-63fd-11f1-a769-42010a9c0008", "comment": "Malware payload (NWHStealer)", "timestamp": 1781007513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781007513, "uuid": "38569bc1-4ab0-465e-9671-6dc9e8e4e0de", "comment": "Malware payload (NWHStealer)", "value": "a52883d6dd685c52ec8d2f27ee0f89f1", "object_relation": "md5", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781007513, "uuid": "1ac83dcb-3253-4f5b-a023-1e9a525decc6", "comment": "Malware payload (NWHStealer)", "value": "87acbf20df04543b13f16c96ecb3fc535199de6b8bc0309ed45859cb72410099", "object_relation": "sha256", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781007513, "uuid": "1d69ad4f-0baa-42c2-8cb4-95530919c5a6", "comment": "Malware payload (NWHStealer)", "value": "b569880a4b6ee0e37ba68f81b8adf88b08ae1709", "object_relation": "sha1", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781007513, "uuid": "8782daba-422c-40f3-aae6-6e67dc144bb0", "comment": "Malware payload (NWHStealer)", "value": "1cf58d0a515e40aa15a33e63d2e800792fab80ea2b869d5b490824cb6cdd6799720e24d80d98660de5ec271d0530d208", "object_relation": "sha3-384", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781007513, "uuid": "e6c7a0fc-ecd6-45d8-a1f2-df0c44645131", "value": "T1DC9733E9C8662B5EE1AFD8364370D8B4C65F55F28B83C92AB85625CE04C33D5F9AC443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781007513, "uuid": "8a92b1cd-69f6-40d3-88e4-0ce8a9ca48b3", "value": "786432:l5D0FRcReTgC5Yh9MVd7nOPBZyOSL3vZrYzZ8qOq3Wa56mN1jwJFy0I:lx0k0ni9Kd7oElbCzZ8qOq3Wat1WJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781007513, "uuid": "8dbc3c9e-b1c2-4308-84d6-a6a01a357660", "value": 41694700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781007513, "uuid": "a5560a68-f448-481e-96ed-78643ac9b478", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781007513, "uuid": "1e48d5cb-a8a7-4c05-bdf1-d54063f878b6", "value": "Spectra_Menu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8548ae8c-6457-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781046248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781046248, "uuid": "857ad8ee-6fe1-434b-b530-1d219c4e0f3a", "comment": "Malware payload", "value": "9c39fd67f9dc856e25c3601c9c0fef2f", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781046248, "uuid": "b51e79b0-c33f-4f76-81fd-08809cf8cd53", "comment": "Malware payload", "value": "884e827275f347e3b550347f84735f57fa8007d6f37ef2de79cda5db16258f4b", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781046248, "uuid": "f1bea1d9-6df1-418a-8b88-f2cf4a48e3f3", "comment": "Malware payload", "value": "852da6a169776a229f15d2bbada191548e61d692", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781046248, "uuid": "2c48c196-c867-44b6-b06f-005a164d7b40", "comment": "Malware payload", "value": "0f864b5ecfe4815b6fae0870cc1d483ab9df279278abd5db08e1ee5d1ca61b2d5c6fe23cb4b950afbb87e317a8cc721a", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781046248, "uuid": "cd26b09e-fa42-4fb2-ab5d-56f704f26326", "value": "T1A674E062FBE558E8D127D23888214606EA7DBC5E1B24DFEF676806056F236D45E3CF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781046248, "uuid": "34db1e19-71c2-4954-9ccc-0f537b03f9cf", "value": "fa74c109873d4bc89329ceb6b33d9774", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781046248, "uuid": "ed58627c-78c2-4731-9cca-8b50fb217528", "value": "6144:RPcH/Pulp7PeouOO/q4jQUDEd9i993q2q3yIEcUwwEoKi7kY0oQWmb:9cH3ulp6xuhnmc2qincUll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781046248, "uuid": "2a968b90-6223-4862-a6fe-74a5bb440b5b", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781046248, "uuid": "67ce7a38-5ce7-40d3-8915-a53b7a5881ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781046248, "uuid": "25b9fbf3-8e94-4db6-a6cc-e893e0ff3250", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1ccddd-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780985892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985892, "uuid": "4b949c52-075a-4108-8394-5c1d0320db8a", "comment": "Malware payload", "value": "f0b4214443e5a8529f02640d6b782f3e", "object_relation": "md5", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985892, "uuid": "fac2885d-053b-4c3c-93b7-9fbb07b7d78a", "comment": "Malware payload", "value": "88cb9407030b88c1bd44a03d37e3078fbdf01b5bf4bf1549fefe4071054f482d", "object_relation": "sha256", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985892, "uuid": "91d8b4cb-0b19-4c0a-8a12-96c1cee582d4", "comment": "Malware payload", "value": "e35e0b8dc440e72590cc07547e75243e406b858f", "object_relation": "sha1", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985892, "uuid": "3b9f11b3-cfe7-4486-b39a-1d14dd74564e", "comment": "Malware payload", "value": "788056f320d158a6b4192c41d38ff3bde110e3d9279badb0dc3b874454f5a74a33f2fce967b61cf40d856c5aa0256a8d", "object_relation": "sha3-384", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985892, "uuid": "bdab91c1-948a-4805-bf8d-1a9d388d4f23", "value": "T13774129B77D92B33EC7F1532B42209750434F9A39956FA47B4F5908A483DAD9E0E03E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985892, "uuid": "261d3e20-6858-4382-b130-62e001806ab5", "value": "1536:6eS0T2WaLgtCeN4gKg92Av9dG/JzNBWRgWUe0imUjY3H2FiY7wsYWVa:6eS0JaLQZvcpWiPGJX7wsJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985892, "uuid": "35948ba9-b2f1-4a1d-ae73-3f2c9a9ce0af", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985892, "uuid": "252c68ea-0fdd-446c-be50-176f8ee8261b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985892, "uuid": "98a43bb9-5966-47b6-a1c5-d5d75af11f7e", "value": "88cb9407030b88c1bd44a03d37e3078fbdf01b5bf4bf1549fefe4071054f482d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cb5a9b-63f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781003439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003439, "uuid": "f2613857-49bf-468f-abca-8f15d740947d", "comment": "Malware payload", "value": "2a1d2fc4130903a80f597830ee860a0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003439, "uuid": "94af27bb-c70f-428f-8883-fcf33a5ad703", "comment": "Malware payload", "value": "88db3172dddde208d9dd58c9c7d6e067f31b90c288953acf36c751d6b0eaa784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003439, "uuid": "83a82600-9cf2-4688-a9e9-ab6d93643ae8", "comment": "Malware payload", "value": "6ae06f8c219e997c42282f771f96be7590c7fdcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003439, "uuid": "aa95de4d-bf5a-40c6-bcad-08a18a1e1a6d", "comment": "Malware payload", "value": "c02dc53d73b04d2c233bedafdf039f087761c44812de8a44bc35f91f3f465a572c5487bcbb43a0b9d8b15910921588b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003439, "uuid": "bb37f5b7-0717-491e-a2a6-2c5e5006c707", "value": "T1C908336D874C8233F2BD1CFD2A302AE2E28D76AF067F4B1BB39440547498556AD9C74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003439, "uuid": "ae1c3114-217f-40dc-bee9-320dc02accaa", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003439, "uuid": "d2c56376-4507-4df0-9305-3134ed5cfbd0", "value": "1572864:Kt9IKPDFSTYdv2/BCmLkZf11m6GBYt0y/mFxBfMREeHRm6xKJA57:KUKpSTYdv2ZHwZf1dGBYmh5fkXRm6xMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003439, "uuid": "b006d78f-d504-4086-8fe4-2c10d859a390", "value": 77578119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003439, "uuid": "6d1af2bd-49df-4a9c-935e-ff6863fd7aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003439, "uuid": "eb802b48-8098-48c0-99cd-b11f7da73b52", "value": "coraline_4.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48593ff-63d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991862, "uuid": "f4c119e2-62ff-479a-b61d-01e2e411c4ef", "comment": "Malware payload (Mirai)", "value": "a7278f657a2ae72154ee8a0d76c13004", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991862, "uuid": "1c776bf3-e394-4284-a3ba-d07a0079d3f3", "comment": "Malware payload (Mirai)", "value": "89127adadb017fb6191c9093e8955662c5a63184d261f5182fc914b42370381e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991862, "uuid": "08c862d1-727e-4705-ae5e-a50d37499a3d", "comment": "Malware payload (Mirai)", "value": "f07536bac20ec9ac8fc4b1b18fd276a2248ad318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991862, "uuid": "df54d414-82fd-4bcf-904b-16d0466e8679", "comment": "Malware payload (Mirai)", "value": "d26eb236ab8b74c20d543d334fed1160b53e9b2f014846909fca62917c88d51f3b54321731b974dfd4ea3a1c9f4ce73d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991862, "uuid": "83c0cda0-5d00-476d-b2db-8d15e222066b", "value": "T1EC14C60AAF550FFBDCABDD3746E90B0139CCA44622A43B363674D528F54B90B59E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991862, "uuid": "c8d74ef9-c7f5-40aa-ac55-5df480d2fb5c", "value": "3072:1hdpFxtllQdX8jV2WuWp4Bo+ytiBeLazXuqf1h/ZcdcfYXoYUtE2:1hdpFxtllQdX8FrGBdytgIarzf1hRrfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991862, "uuid": "d12517c2-bfe7-430f-a27a-2358c60a832b", "value": 190844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991862, "uuid": "8baa2923-3832-4ab4-aa87-30b699408d20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991862, "uuid": "73d71606-44aa-4a93-80e2-cae232564303", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5b686c-63ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780987362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987362, "uuid": "7c7afa4a-7154-4e42-bb04-e4014cfcfb74", "comment": "Malware payload", "value": "82ffe1125fc789db214382b12ec7adec", "object_relation": "md5", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987362, "uuid": "8de25830-c637-41e5-98ef-a62b9a183f35", "comment": "Malware payload", "value": "895e4da14e9561888cdc89100b42fca603906701f1472ab37a23591591491997", "object_relation": "sha256", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987362, "uuid": "cf0a9527-fa91-4099-b0d8-291483340cfb", "comment": "Malware payload", "value": "ddc82d0ca5292b0185d7015b2b6e92ac8c854e26", "object_relation": "sha1", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987362, "uuid": "6c204913-a0a7-4c00-8557-d22182b7cd68", "comment": "Malware payload", "value": "bab3ab6ddf8268466652ed0c097d69f1c7d524410e39851734527fef6cfe935aa6c2d6673fea131de29fe74d8a6a9b8a", "object_relation": "sha3-384", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987362, "uuid": "ca6b2859-2b79-4669-905d-1fb4e607237b", "value": "T1C9F4BE1B72628E12C2885233C1C71D0293E4D6867973EB1E768623D65E473EBDE4A3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987362, "uuid": "308937c3-aba8-4c6f-9864-5d0532a61113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987362, "uuid": "e0bfb4ca-0f0b-42e2-ade6-c937066611f9", "value": "12288:mue7P2Lpa/AIq+HsRo2AG47LVpZaZ8iKBTU5T6oRGuyiNRB:m32Lpa/AIq+HsRovPVZiKBA96oRXymf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780987362, "uuid": "12e196e7-f6bf-4a15-a0fe-b2e03f4b9047", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780987362, "uuid": "a75a8405-6ccd-40f1-896c-11cd962a79f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987362, "uuid": "9382e8d9-2e04-46b2-a37e-0c6c0860b786", "value": "895e4da14e9561888cdc89100b42fca603906701f1472ab37a23591591491997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcef6dc-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780979855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979855, "uuid": "0b51b09c-6a40-44cd-b8d8-d3c7511c60f9", "comment": "Malware payload (Mirai)", "value": "4792c0f276c3436da4d4ad228522b2ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979855, "uuid": "78d2e5d7-7103-4bc2-9fe7-af0c494cf6d0", "comment": "Malware payload (Mirai)", "value": "8a142bea9141ad0a830f9500ac16c374eb08544936172e709b47332bf32490e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979855, "uuid": "21ed52a1-0631-470c-81d5-0aaf841bdb86", "comment": "Malware payload (Mirai)", "value": "437c86dc09b9dd0377d37411db741a0da4f9b37a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979855, "uuid": "3cb411e3-4685-437a-a836-e68e293a1d40", "comment": "Malware payload (Mirai)", "value": "cd01f333f794f392d6837abc72f76d4927861764b9c770ccc0fcd1ad93e52c3b893d83cf0a7f1db68a1aa032caa78af7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979855, "uuid": "0997b46b-2866-4010-aaf9-faa92b638194", "value": "T180233C076481C0FDC9A6C2F45B7FA61BDA33F07F1235B65923E8BD26AE4DD211E1A148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979855, "uuid": "44ef0dc3-78ed-47b6-b834-4cc78adb7008", "value": "768:t+ujdo18qax9QKfFv/CtVD/7vt9rsnKVHbx1pKVgrOUXU23qkpK8It:0ujdW8qC9rftCtVD/DtoKVHhKVAOwjc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979855, "uuid": "58e214f9-e03e-474e-a34e-4693236cb98e", "value": 47408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979855, "uuid": "3bb52f7a-9240-4f28-86e7-afec15f16dd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979855, "uuid": "931ffebe-f899-497c-8d74-10f5ea7f6eec", "value": "13.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9679ddab-63e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997314, "uuid": "5423ce58-48f9-4e04-85d8-7efdb15208a2", "comment": "Malware payload (Mirai)", "value": "7a960f77a550d4a726dd2f99c4fc9c6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997314, "uuid": "d0b034cb-d013-4744-8553-c6bea7a3f324", "comment": "Malware payload (Mirai)", "value": "8a4b241ecf5ad5cf6331842bc568c9ab48a0e90f1c3d4605e510c9c82dddb475", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997314, "uuid": "312f6873-2552-4680-bac7-740c8f24da7c", "comment": "Malware payload (Mirai)", "value": "ef9e403d62164c76605a1644d95baab428ad7066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997314, "uuid": "25276fb1-e05c-4545-b739-9921686bd9b4", "comment": "Malware payload (Mirai)", "value": "a2a33df28ac11253a762ba6155e764409fe3af2c20f5de719a1113319f307fdae3655cea0c73c22f2e13d980ca680d6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997314, "uuid": "123dad35-dd41-45ec-99bb-a5e30ed32708", "value": "T172F35BC7F800CEBDF80AE73748530905B130B7E154925B37625B797BED3A1A92867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997314, "uuid": "5d7b917d-e95b-4235-bcdb-b686810bb981", "value": "3072://JziGCBcrJKoUXbVbHMh28HFTX6VwjbiDLgKrdyL8a8vF:HZUBbHMw2TXALz5yLV8vF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997314, "uuid": "fa5108de-be37-4e1c-8a00-931e7d889c99", "value": 158944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997314, "uuid": "fdb22981-852d-4e27-89b3-78ab9ab1bddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997314, "uuid": "e6d3b8a7-5ac7-4a08-9bdc-865a7679ed0e", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbec804d-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985834, "uuid": "75b9285e-19f7-4509-9218-1aaf066f50a1", "comment": "Malware payload (ConnectWise)", "value": "7ee9af5d2715c7af193cd40b0976789e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985834, "uuid": "4e9b2e67-6550-4b2f-b822-70217074e1b1", "comment": "Malware payload (ConnectWise)", "value": "8a93c839f89815382409a17d414deaf4743b3f631fb0114ba81f90746c3badc2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985834, "uuid": "a729cf98-f856-4c9c-ab84-e88a451aaefd", "comment": "Malware payload (ConnectWise)", "value": "0f1ee7f4a16bd43242f19c64ab189585129f11de", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985834, "uuid": "20a034fd-6d5b-4f26-a510-d838dec3b2e4", "comment": "Malware payload (ConnectWise)", "value": "d1d24f94870b9d36c0f1d172d3f26552c307731bdc33b966eb895f9f16da1afb970b8f19a1e239def00dd35c23803852", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985834, "uuid": "a661bbe2-c255-4bea-acdb-89584093916d", "value": "T1E6646C11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985834, "uuid": "c54b77a7-0d17-499f-b97d-df1e23711c3c", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985834, "uuid": "715650ef-8332-41b7-b36a-dea6c61db999", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9W:R1iw7gryNkSV1hy1Z1u2JLu9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985834, "uuid": "4ed1b1fa-798f-471f-9516-f9048589c561", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985834, "uuid": "2007be7c-5d83-4a51-9309-e9862db2418c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985834, "uuid": "4693b029-51a8-4d74-bd95-14b3c5fa745d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60df5873-6411-11f1-a769-42010a9c0008", "comment": "Malware payload (VShell)", "timestamp": 1781016122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016122, "uuid": "e7fd2b09-2892-4ca0-9aef-ce51ece25922", "comment": "Malware payload (VShell)", "value": "c115c2c2341852613619e7c171a9b3d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016122, "uuid": "3e08f1d2-2134-4db2-a25f-2f0b72b7aaad", "comment": "Malware payload (VShell)", "value": "8bba3591bb69083020f7a1f630c8a4105cbf10d71b9f6c97c4df29740501457f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016122, "uuid": "d347fc4f-17ac-4df8-9c94-c1148dd02e22", "comment": "Malware payload (VShell)", "value": "52a636cdeb748b3720f2728648e13333eb5ff846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016122, "uuid": "1b9acfd4-1302-469b-8d79-f59bcef20b13", "comment": "Malware payload (VShell)", "value": "c94c1224082547ed8b9e376ba719ed1965364028586d6a9d2b81dedbb0acd9e8628d2989de49a7e75636ac8e8180ac17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016122, "uuid": "df1f5150-c222-4b81-9e97-a9019be1bb5e", "value": "T171D43B25A2E88BBAF0E2D1768D626D01D6F57C0D0360F68B13947B56AEF31704D3B726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016122, "uuid": "ba1f8341-78e8-4987-8585-620b3164d2f6", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016122, "uuid": "55bb5319-b559-4d6a-a80e-1e3348178831", "value": "12288:FciZ4qN4ZkKdcLtmUzG8GIJ9EuV/+wGBr:i25kkKdcLt08/95V/+9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016122, "uuid": "f1cf3838-5780-441a-9c46-c4855afd8e73", "value": 633289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016122, "uuid": "cb921c2f-7d40-46ec-bfa6-b4a3797c0a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016122, "uuid": "de34737c-cb10-45bf-8d38-541636cd0a22", "value": "\u7d27\u6025\u901a\u77e5_WIFI\u6545\u969c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b34730-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780979783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979783, "uuid": "48749ee0-248d-4a9c-a9ac-12e1cd4c9a05", "comment": "Malware payload (Mirai)", "value": "34b5f5da8110b4a8d4ee9704d95bf1a3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979783, "uuid": "c5ab8ef2-7542-4b33-b851-42f92675ea5f", "comment": "Malware payload (Mirai)", "value": "8ccdb631da5c97b3567524424fecd38fbee863bdd9ff1336cb357a17519a8543", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979783, "uuid": "acdc357a-5a5f-4ad2-b884-bfa810ef8f51", "comment": "Malware payload (Mirai)", "value": "bebba7e6c409dfbb24a5f57fe09f544602c43fe8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979783, "uuid": "ee0bd046-6121-43bd-b2a1-c82c6e6d59d2", "comment": "Malware payload (Mirai)", "value": "2693317197af85c242194b4c9a10d0e553b3e1b8a397ace7681c8170bec54baf1b8cf731cb025800299da4833e3c6ee0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979783, "uuid": "255e00b8-7853-4c4a-9e69-d1250bee1cfd", "value": "T1152173CB002EEA3C4E69AD2F32500608A44AC5F251D39F1AE87DCEE65485D94B140FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979783, "uuid": "04c27cd9-a4f0-434f-a40e-ee1a58dec1fc", "value": "12:5FGEzcuiFztYmW0gYLMEllUAZ5UUPmOzU0lzzUUlAIffC9dbjXY5AolwUyZbBvzu:TGEQb/ayOrNGYQ+HoaUxyA+IhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979783, "uuid": "9ec26308-eeb2-4dc6-88f1-58331d167a7a", "value": 1250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979783, "uuid": "40e4eb5e-afbd-4710-b0c1-e677fac04369", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979783, "uuid": "4e2a53bd-be54-4d09-b12d-01a0242e3bb3", "value": "disconnected.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1c63c6-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781016574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016574, "uuid": "d6029bcb-ebe5-476c-bc24-4acf9e191efc", "comment": "Malware payload (Mirai)", "value": "da586a8fb7ee532e014b079c05d2288a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016574, "uuid": "610f889b-a421-4b91-b301-5e6604ab50d9", "comment": "Malware payload (Mirai)", "value": "8dc3f2db30d24aa8f6f14068ab9e11f723b7dbdc2c43270f09288c78c1543826", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016574, "uuid": "d7181d4d-7c84-4282-8560-60c7acb6ab4a", "comment": "Malware payload (Mirai)", "value": "3257cbb6c233af2635a18aa636aff485ebe98da5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016574, "uuid": "6ea7d966-8317-4aed-91c5-78b556d6e3ef", "comment": "Malware payload (Mirai)", "value": "3956a8da00c80769d20b331f04baa9d893bba7f99d1d3445e92935944495a02c8f1f74ba40d733633760ae13d24af8ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016574, "uuid": "f771c304-1427-4f21-926d-f8fdd8fbfc0e", "value": "T12DE30741F98780F5DA078C705067B33FCB319A255036DAAAEF64EF35D963B82612638D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016574, "uuid": "79b9d3fb-7cda-4968-879e-0982b0cbf557", "value": "3072:2n2fad7l42lb7W8Cs8zkByrtIoLPYxqZitFVa+7A7Qzwv:22yd7l4ebzyrtpLUq4/wQcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016574, "uuid": "6686a958-710a-4a1a-aece-058b3b063d02", "value": 148788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016574, "uuid": "f7009c9c-aa75-4485-96e6-bdd9170d07e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016574, "uuid": "12f7c490-8a90-4f3e-b65b-8f072ab796da", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66d8f8d-640f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781015460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015460, "uuid": "0b764d7e-9186-47ee-81d4-26ad900a21f3", "comment": "Malware payload (ACRStealer)", "value": "a7af88e2982f51bf34e71e59f7ddc653", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ko-logicbeacon-cc", "colour": "#635911", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015460, "uuid": "a2bbb8c0-9b42-47bc-8b06-f5832a09fb52", "comment": "Malware payload (ACRStealer)", "value": "8edbc1689fba83ce58f56bee6e7d9467da4903201311f2c4bc2df414c4fb3360", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ko-logicbeacon-cc", "colour": "#635911", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015460, "uuid": "741af426-603f-4068-a358-6b7224612ff0", "comment": "Malware payload (ACRStealer)", "value": "700c0111459a5b37c317df49271ee90a8db35567", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ko-logicbeacon-cc", "colour": "#635911", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015460, "uuid": "44f731a0-957e-4740-9f5b-89037d5c36d5", "comment": "Malware payload (ACRStealer)", "value": "0f69f439d4ead62795b82461048922d3b929f3c8006eec4436e88183b8e0e7156cd1b2e926b6b815589cb07e16aafefd", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ko-logicbeacon-cc", "colour": "#635911", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015460, "uuid": "b94cfee1-3cfc-42fb-92f9-617539267bd7", "value": "T142F6237AA85C3910F8DD8FFD988939EE83A35E5B6E161A8E7D536234FC573907C80940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015460, "uuid": "e006a69b-9cd9-4e36-8cf1-98cdda055d1f", "value": "393216:vO1QWANCLeYo/KPgB+rjan5Q/1NX41056GgUOe:vOuWA06SPC+in5Qf4108Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015460, "uuid": "a08c10d3-1d59-49ee-926c-07a0c506870e", "value": 16273642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015460, "uuid": "73654deb-4f48-4ae6-8ae8-16444d576769", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015460, "uuid": "cad5ca71-e3c9-411b-89b7-440a478ad71c", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b23221-63ed-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781000912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000912, "uuid": "84ddaec0-c96d-4d7d-b1c0-d5172c04e4fb", "comment": "Malware payload (Vidar)", "value": "59dc4bc8103c1dac67137371ba8d3eff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000912, "uuid": "b4b55878-02ba-4932-8f4f-25df60572d58", "comment": "Malware payload (Vidar)", "value": "8ef2ddeb4c377ddcb0e05e10d2fb067f52dd6a4a7bb2edcca8e4f9c50a622ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000912, "uuid": "81c960f7-1319-4e3f-af43-4a1c59eaf727", "comment": "Malware payload (Vidar)", "value": "709c21f1a200c142b82986234cef01f6e6ad7178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000912, "uuid": "17ef8498-2919-4cb0-91ab-9c8dff85c986", "comment": "Malware payload (Vidar)", "value": "308046a52d2439a15d72be925ef29134b6c7946d2b385284e7c21797a38d08c720e32bcee1d180abd8274b30efcce9ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000912, "uuid": "817f40d9-8e4a-43b7-9c7c-5bd2f5ff7454", "value": "T1D7F56C03A89409EDD0A4723154F67962FB25BC490B3927DB1FA26B746E76BC06CB7F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000912, "uuid": "78954cc0-92b6-4b58-ad98-044b5e813883", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000912, "uuid": "860f99b4-4368-4d6a-bbc9-c7dcce257b8f", "value": "49152:41sUtFqVn6sNwOuAaPqZb3o7uXJ3HGBF5uSlZzc9T4Rt4Asn4Q:4BpY93o7I3HGBF59lZzc9T4X4As4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781000912, "uuid": "d508c3d4-dfec-4ccb-a067-9a4022950d1c", "value": 3351176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781000912, "uuid": "f35d15b0-5840-4f85-b2d2-e1bedfa435ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000912, "uuid": "2ebc46bb-2751-46a2-916b-e4c88a3dc2ad", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6648c84b-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780979624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979624, "uuid": "4dfe6d58-a50a-45a5-a437-d7b10af1c170", "comment": "Malware payload (Mirai)", "value": "d1418b817b8b494265773767a13f054f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979624, "uuid": "5a703900-824a-4695-b20e-45d8fd7590fb", "comment": "Malware payload (Mirai)", "value": "8efc9d9e17aff9c011d46cb56d4f7b407b009ad2b217b06d2941154dc3361f6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979624, "uuid": "4f45aebd-42a3-4ffb-87a9-a57201807706", "comment": "Malware payload (Mirai)", "value": "abd6e4e5875057cade55a7aea5ff6fc36a292912", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979624, "uuid": "ac99fe4a-a267-4ce8-bab2-47e4932f7812", "comment": "Malware payload (Mirai)", "value": "72f31015df7a679c06ef7c1a2fe21408bafcc764819e5138d6999e38c18d6b77f61dd6e4da798c48e0500307dbd15468", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979624, "uuid": "2cc5f974-d41f-4cd9-8fd3-8fb7cb1819c6", "value": "T1CE53095AB8819B15D9C112BAFE0E128E731317ACE3DE73139D24AF20778B56B0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979624, "uuid": "4b17f0ce-eb70-4716-be4f-dda115922574", "value": "1536:Z8n9+eyFO2xU9CaQwX1+shMGibF2Xc4/cd5yY4j:lFOPQah4F2Xc4/cdwfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979624, "uuid": "18fc3bf5-8e24-4ffc-a182-1c329625e95a", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979624, "uuid": "ffd4af26-3fef-466b-86a5-fa42fefd5d59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979624, "uuid": "b4c55235-b523-47bd-92b9-d7c36c238226", "value": "6.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1518a79-639f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780967375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967375, "uuid": "8a438ec6-fa33-4722-a943-0494ea7cab71", "comment": "Malware payload", "value": "e318e551721319418aa4bd3ecc73d4b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967375, "uuid": "e1beca3c-8e0e-4eb4-8f24-bc1122159660", "comment": "Malware payload", "value": "8f5596aa92afb1658451983bb8c01529e97ad5bce91513dcff1e6d9317affc8d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967375, "uuid": "d2fe9a88-9ced-4c36-85d5-e57c9abc76d9", "comment": "Malware payload", "value": "f564c1881f5c89da9853690e9bf368f028c986bf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780967375, "uuid": "58dd3284-2449-491f-91b7-857934c9305d", "comment": "Malware payload", "value": "80a9e8788ac739e42fd3a2ec3659d42216657d0edf399352aaa317e6b6327fe719ed56fbf060749d89d6c537d9666ef6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780967375, "uuid": "836398f1-138b-4fbf-b425-26bc1841cfc1", "value": "T124F0270AE88844BFA03FC89FBBE63DCD110F51552A8B2E2D96B92C47B8B9C4850D1433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780967375, "uuid": "52648736-8076-4d26-a2b3-7fd4fcb9d6b5", "value": "12:/VJ+TNLI5zqiYzkbfEiuy4ghsesFrFBEGghgu+hYuTyisJF8EpASNyiiuyw:NwTNLI5zq7zgyZrTBEGCnuoLpvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780967375, "uuid": "fbcfa4a2-7fad-4157-92ee-db3cb2b4892b", "value": 477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780967375, "uuid": "bfab3c44-f104-459e-91c4-523c24af40aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780967375, "uuid": "1e7454c2-ed04-4a3d-a19d-589b8f446633", "value": "zok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248ec2a6-63f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781003566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003566, "uuid": "c6c17219-436f-4ec2-a226-8c523d990cfa", "comment": "Malware payload", "value": "3f952fc64ed5d5c1dd00dd2d0f337112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003566, "uuid": "cdbd253e-7664-4749-bc72-ece004f5fb9a", "comment": "Malware payload", "value": "900eac9aac32dce2f1acba2e8f8462edf6bfd59d642c4701428e84e9aa08d25a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003566, "uuid": "1e0ac6b3-6dc1-463b-a5eb-a6553a64a8a3", "comment": "Malware payload", "value": "d9c91dc84f0d92c0f28b416cc77e031d2dbdb636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003566, "uuid": "1e306c43-6f79-4673-bdb4-fba7f5550b3b", "comment": "Malware payload", "value": "b527bdca2669775e171e58b1254b6bed22540212eab099fa68957e1cbfbb65b5b73a74acf75f893dfe83c00314aa7127", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003566, "uuid": "fa451c85-0c8d-4b99-ba16-43ae66df7040", "value": "T1D2638C8D6A5C4B63EA4F5E3CE5E0D3276979D3A71841EF8B1C88C1D909833D16B052EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003566, "uuid": "9cdbdd35-65e8-4ff3-bfc0-eba8334d816f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003566, "uuid": "02fd53c2-1890-4358-a832-559013722d0e", "value": "1536:sy6d0xNvWAbMKYGi6ilsB2msMgfAj+puhpV01m1jYfIkXgcxfILYxw:syIAbMKYGiggfq+o901ml5XcKIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003566, "uuid": "4d12946c-35d2-44bf-9517-00142067b460", "value": 67632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003566, "uuid": "9b70ccea-3dfc-4aa7-971b-93fa3a2a57f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003566, "uuid": "45453adf-5a76-49ef-a62d-a7aff334d412", "value": "logs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bddafc-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780985796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985796, "uuid": "603c4851-15ac-412c-b6c3-b254370a57b7", "comment": "Malware payload", "value": "d482abfbe90de012d454229a2f8d5415", "object_relation": "md5", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985796, "uuid": "21340cc8-4632-44c6-ace1-ef87242aee3c", "comment": "Malware payload", "value": "903724d189708db9d352e19fc50735fc012cd4ae7e4fa15b7bcfddd5e3bf416d", "object_relation": "sha256", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985796, "uuid": "1c0d9096-cfd9-46fc-9fa1-acf8a38267ab", "comment": "Malware payload", "value": "fcc61d57597a4d87bf29bd025162d71e8d224b23", "object_relation": "sha1", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985796, "uuid": "140dce16-58ac-4869-8d2b-d4238b2400d7", "comment": "Malware payload", "value": "186c476a73aab9cf65a4df92d8f478ad7f8036db491b5ddf063d1f7f7539f67d0847548d047bbbb2d6869ea56d6e0bce", "object_relation": "sha3-384", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985796, "uuid": "ad8944b2-b48b-4e15-a8f4-0e05fe0e45bf", "value": "T10FB312F329C95D7A82B63B186D410EBA1E323D0EFC3E52F6DD2584C6D0F508B8B60664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985796, "uuid": "797f879b-6332-4e30-8c36-3940398b2fb2", "value": "3072:R1nuie+NlFK39HPLv9WSvrxnvXn8b13C/HRbHne6ZK:7uie+hK39HPLvMSvmb1OxbHJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985796, "uuid": "fd8b0300-2fae-41ed-bf8a-dd1da5229a52", "value": 112329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985796, "uuid": "9b1c55b4-4ee2-4b23-8d2c-9929a9622f65", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985796, "uuid": "f96537ee-b7af-45a6-ad1f-d19d7a8af6ca", "value": "PROFORMA INV RAFEEQ TRADING #270427.002.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7376d21-644b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781041151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781041151, "uuid": "2dae3285-453f-4e86-a47e-67802a45c171", "comment": "Malware payload", "value": "4141d9260d0dbec111724d9194e31dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781041151, "uuid": "cf0c96e3-2dd3-4b4e-8ac3-93d62143bf8b", "comment": "Malware payload", "value": "90a118dfd18008af6438c920447d76f9d265a70d5b01b30efbaf40d32eeff4f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781041151, "uuid": "5820c5bd-0762-4cd9-8053-696186a94c16", "comment": "Malware payload", "value": "e7af36f7d25c75672a8a7feb061d6e85498ad46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781041151, "uuid": "48365321-d579-47d1-8f4a-6a8e48bde409", "comment": "Malware payload", "value": "000cad105a0e7d3a3fa872e1cf196b535befccf71b31395d00146dc06d7005061966dbf06dbb75d8373ae34bbf050401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781041151, "uuid": "a2bec5ef-c1ac-45ba-bd05-bcffcc4c8ff3", "value": "T162E56B07AC944EEDC05A677284F26981BB34B8450F7227C72FA17AB43EB2BD42D72745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781041151, "uuid": "dffe1d91-c81d-4416-9d26-b6111456a612", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781041151, "uuid": "e18da5d8-80ec-4a1e-aa6c-07b26e582e13", "value": "49152:StKjRTsG1UAwBxZyvejEj61ePF4itXtTerZhyu/kWS6RonuOkxnY:Swlrejs61yF42MrxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781041151, "uuid": "febbbf96-d66a-44c8-8e28-cfd3cc9483d1", "value": 3213960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781041151, "uuid": "9ab199b4-e52e-4196-9ca8-9ca1d40f5ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781041151, "uuid": "247a12da-9593-43d1-b3aa-8b2b5b0e7134", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61594437-6438-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1781032873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781032873, "uuid": "e6cdde53-0092-4296-9c71-8ce75c75c840", "comment": "Malware payload (QuasarRAT)", "value": "9d65603576d291863147998a6d87ca5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781032873, "uuid": "b2b9d1d7-ddbb-4fd3-9e73-4d9087771a22", "comment": "Malware payload (QuasarRAT)", "value": "91be91c391126d56488726e79c21e037fe31d0225ded2ab3647827a1caf4c466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781032873, "uuid": "185e06dc-0839-4c89-8ac1-bcf24fdf4ae4", "comment": "Malware payload (QuasarRAT)", "value": "45df09aa05383a6e1b4944fc8180f9cd07339628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781032873, "uuid": "0673a7ce-5a13-4ea1-880b-8816dd3f6434", "comment": "Malware payload (QuasarRAT)", "value": "533244d84bc96758bbeb1947c0a8ce96ed35d090c59e057b6e9951d8cd12585b6c2b382cd767bb30210f2d3cec470367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781032873, "uuid": "d0545833-de99-447c-a118-a85b9c0f728c", "value": "T1FE05F0F695D4BD32C61A2838FC114144C33F794404BFCE6EA9042EAEFBA76E01695E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781032873, "uuid": "a5bb5ca0-e73a-4c3f-86d7-0a1817cbfe38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781032873, "uuid": "e8224b4a-060b-4d67-87f0-f559d7f096fa", "value": "12288:Al1FsBrF/1Q7vN8Ebxsme7L+1S9fg7eg7q2nuvAgXJbazn5AOL14boeW9eNq:APFr7vNTxsHo/qIu4gZbaznWOmbUeNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781032873, "uuid": "6ca2796f-28f6-42a1-9cd5-42676c6d1c77", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781032873, "uuid": "10f3d9a1-4320-4147-be90-77771247ad07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781032873, "uuid": "0a797e40-f8f9-4ce3-8519-919d334d9ea7", "value": "SecuriteInfo.com.BackDoor.Quasar.277.23326.29524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc8372f-63de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780994377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994377, "uuid": "178e7ae2-8140-4378-b93f-db9c7986e890", "comment": "Malware payload (Mirai)", "value": "b80d7f801d26cff19385a152608103a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994377, "uuid": "2e496b2a-e938-4b40-a133-6d290b52571b", "comment": "Malware payload (Mirai)", "value": "920823ca2ba0bda3cbac767246053642825ed4d2568c3cb4b8a3816304914adf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994377, "uuid": "843082ec-7468-4ea2-843c-35d353d9e543", "comment": "Malware payload (Mirai)", "value": "3b19211168d8ba31cf740482a088af2c605130d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994377, "uuid": "eb8c170d-a5c3-45ba-860f-72195ee1866f", "comment": "Malware payload (Mirai)", "value": "ff4afd5df0f1ea0ef2c6dce0c624c0caea87741f592361d70cd86c0e78c0ddd9dec8d2c3fb020fcdfadf8496ebe66e13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994377, "uuid": "9b2887a8-8afd-4ac1-b696-315038910606", "value": "T102C32B56B9919B12D5C321BAFB9E518D33132FB8E3EE3202DD106F50678B8DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994377, "uuid": "9d29af5a-5d50-4705-9595-008f6a2fe3fe", "value": "3072:HhS/0mp/hGJ0sqBxk6j5xahDIaq49hGahWgGA0v7qNL:HCpnGJ0b86jTahEa79h5WgGLqNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780994377, "uuid": "5092a3e7-66f0-471d-ab49-124d8fc067ab", "value": 129972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780994377, "uuid": "a298e013-b26f-43bf-9cf7-b0258ca1e463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994377, "uuid": "37d98fb2-152e-4514-912a-5479a6cd83b9", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83dcf9d-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003008, "uuid": "3992794e-6dd8-4987-9026-47fd1979393d", "comment": "Malware payload (Mirai)", "value": "e044d558edbfc9a058443d3db747e2d3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003008, "uuid": "e6e74a80-aa4b-4c32-b082-729cf4e18939", "comment": "Malware payload (Mirai)", "value": "9227e739752c0fdb64f61ce8c8e99fac47fb0a5b5c1fc5b1480ead6f98e52c6d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003008, "uuid": "98fef297-c848-469f-8209-201f37a08c13", "comment": "Malware payload (Mirai)", "value": "1297b569a743bbf0d303335c792afcbc0d3458d4", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003008, "uuid": "b4634831-8bd7-4565-b2dd-f595a64f1571", "comment": "Malware payload (Mirai)", "value": "a8b5c96d06a03f68e044bcddfaf3d82afcd21968d975e96b11d1f49878084e463c79606bec6a8aa7ab69fe93488135bd", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003008, "uuid": "7ac0b19d-44fe-4b23-b9e2-ce18c656b27d", "value": "T10C64238B9B7342F5D676AB33CFE453C3D5939680B300279EC54887F2066A44DA8ADD8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003008, "uuid": "db0de33d-495d-459e-8d4f-0ae4af7f3ff7", "value": "6144:MWLe4MXbmVf0BdCRZCCm0gPIteQDrVyHKXyo2a7L3SaoXOpYwYjm5blh1CPUfEF1:MceJX+0BdC1mzPItkqXD22Lg7b4b1CPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003008, "uuid": "dc31c8d0-f86f-422d-99a3-0d5365a59493", "value": 326904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003008, "uuid": "5328185d-01d0-4155-87a9-f776d4ea6bfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003008, "uuid": "e926fb1b-1e39-4743-987b-3bd6fcd34542", "value": "1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e878ce3e-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780985855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985855, "uuid": "599b03a6-ed4b-4dcb-b2c8-96e2c20548cf", "comment": "Malware payload", "value": "6e233ef9c930fd4c8e28738a7b00f108", "object_relation": "md5", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985855, "uuid": "c26d27bd-a955-40eb-9560-335a62304b07", "comment": "Malware payload", "value": "928d3bd80420821016ee8cfc1b4d04b39d8db4cee4292e219eea11a155513d5d", "object_relation": "sha256", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985855, "uuid": "1e1183be-c8a9-4909-9f68-0a6bd8e595b8", "comment": "Malware payload", "value": "418e055d8e1c374e3d8863b894e23fbe488495bb", "object_relation": "sha1", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985855, "uuid": "bfc95b16-f97c-4682-92a9-ee49c4e599eb", "comment": "Malware payload", "value": "a3e6dd8971257e36732d697419eb33612eb524ea93cd3f0d419686a6ee32209c43b6f8c0bffb6e6449c230df5e3fb896", "object_relation": "sha3-384", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985855, "uuid": "9af5e503-3616-4b1d-ac0e-58b63fe4cd5c", "value": "T126F4AE1B33568E25D2880236C1E7590183E1A5477677EB0E798523DB2D033FAEE4BB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985855, "uuid": "310a9e16-0eaf-4492-8939-01145ad6b6be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985855, "uuid": "9011f961-d81b-40d9-bde5-59e85471e7de", "value": "12288:XqY4nnbGv9Z2Cfn/POjza1RLAPSjU3jmqEpxDp7T7yiBrnH9U:6BalQC/u/Ou4U3jJEpxDd3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985855, "uuid": "76c3b6e8-db89-4f21-92af-8088a6a5647b", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985855, "uuid": "0091bcc9-2197-4201-a83c-dfcf981a821e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985855, "uuid": "b2aa87e1-c5e3-4ec3-9eea-b1603f00b765", "value": "928d3bd80420821016ee8cfc1b4d04b39d8db4cee4292e219eea11a155513d5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09874f92-63ef-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781001373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001373, "uuid": "142f3acf-b27e-4f1d-a2a8-90b59beb6f46", "comment": "Malware payload (AgentTesla)", "value": "bb3158b98c472ddadc3107d07bd01bd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001373, "uuid": "a106f785-74b0-4ead-95ed-9b9096363e45", "comment": "Malware payload (AgentTesla)", "value": "9366765012e4d7b921d501ad7a0a12b83ea856f664286e0d8d69796d280060ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001373, "uuid": "6ba241c1-5d85-4d39-9680-bfca52c9656d", "comment": "Malware payload (AgentTesla)", "value": "dd9fa44e6de9bb3eb54a528554e403965523edf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001373, "uuid": "ca2c45f8-68f3-4490-80e0-615847b4f8b2", "comment": "Malware payload (AgentTesla)", "value": "d4d74fecc70d0e9aefa1b30fc1b6c19f727f7b25eb9f003344e36434006dbf1e8a18b6253b7369b1abd6df06a713115b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001373, "uuid": "52c80190-86d6-4e02-bb46-04fb2fa2aafe", "value": "T191B53E7BE78A83CDD3BD811E88973495F7745F991B33502CEF2AA3C5AB21519C0C24A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001373, "uuid": "67def029-6386-4c1f-825c-f7759d8d1c73", "value": "384:XVN/WTbpB3dau9eRwuKIUjUQar/Kb2QB9ZpH4ZNgp/bkwBplIU+UmprQcmP7lXJE:qThs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001373, "uuid": "5a6db131-4ad1-4a38-a00f-7e919fa51683", "value": 2339457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001373, "uuid": "f933a26b-78d6-434d-ab80-7ac50abdd487", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001373, "uuid": "2063d1f9-21fa-4601-956f-effaf883d0d1", "value": "Datenblatt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cf9717-63ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780972342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972342, "uuid": "9c35e573-76bf-4a13-bdc7-be1c7e476818", "comment": "Malware payload", "value": "d7b744ff3009216a5453685a23d292e5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972342, "uuid": "995e1f9c-6613-4e53-ab65-2b046afaa8b8", "comment": "Malware payload", "value": "93e71b122a432c2b7acf6a5db6ee3e42e792ef240acee466c4310b052e2416db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972342, "uuid": "3b6464ce-da4f-41c9-966b-5085a179f2d2", "comment": "Malware payload", "value": "67d3521e93081f62d8827392cf946bfcbadda041", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972342, "uuid": "9d5d04bb-42ea-4cb9-a19c-ed43be0e5a7b", "comment": "Malware payload", "value": "a5370e51ac46283cd6497acfbe9dc7862bd0a6a66d7713b4a9233ba2a52a93cdaea6a37cb976ad3bb6d54fc10bf51827", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972342, "uuid": "afcf5070-b2cb-4ac4-9365-630ed2ee6a97", "value": "T1C441419BE1F4C2A1CC734D00B0515AD461EB979A1FB81766D6DC286EA0CFEC07C0DA2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972342, "uuid": "4a2ca713-322c-4311-b93b-090b9c2dd4c4", "value": "48:WZExgiRiKbWIo7lSOYFYQjpoJQQEPpmEcDRw+ETL:74KbWIW0HZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780972342, "uuid": "a2f2caca-62be-454e-8049-297a43d5352c", "value": 2321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780972342, "uuid": "38ab355c-7803-4331-8f3f-618b24fdb024", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972342, "uuid": "76d99468-c119-46e4-b4a4-cbf6fced405f", "value": "re.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4253a37-6422-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781023671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023671, "uuid": "91132296-d253-41a8-858e-9fa1b614156a", "comment": "Malware payload (SalatStealer)", "value": "1be225c9622f5ab328372e7f673e0936", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023671, "uuid": "a5b31bb1-bf11-4552-82e1-66f55c1595fc", "comment": "Malware payload (SalatStealer)", "value": "93f370cec57e6e48a9cb31254edba190232077f9b3d197f5a67d003ebb08d336", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023671, "uuid": "8ed4968e-c8b4-4c09-99c6-784104e064d6", "comment": "Malware payload (SalatStealer)", "value": "84c203a193aafdf1cd4f4908880824b59688a33d", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023671, "uuid": "018c4305-375b-427b-b18e-0bfb3e4d9c82", "comment": "Malware payload (SalatStealer)", "value": "0313b84ed82fe835d6746b300f34cfaeac1e35cc7054a798b47ffe0afe77a658bee622bb4e48ef2f7d5acb89d10ee635", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023671, "uuid": "78e14593-90f3-4050-9d03-4fbad0ee82f7", "value": "T1FB461232A066641BD6F409B3F811D230BE2CA7086B5C59B6C6D0DD0D79684F96FFB24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023671, "uuid": "5fd64f7d-099f-4024-8873-55a4bd7048e3", "value": "dc78060b861de085d3b25326d5393553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023671, "uuid": "b7a9d774-6191-49ce-b765-8884f482edca", "value": "98304:DNvQJoKzXe0L8pS9qtKfmuIvtiYf3E8oqUorywH26YYaAhYu4hAH:yoKTe0L6S0eIvtiYPELqUit26ma94hAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781023671, "uuid": "c432e699-a8dc-48c8-8900-235b63e65cd8", "value": 5680704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781023671, "uuid": "675ecb0b-b528-427d-bedb-42867f34efcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023671, "uuid": "cc1cf722-49b0-419e-a46a-5967b54a4ee9", "value": "ZapretDPI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50ac8c6-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781016666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016666, "uuid": "3c8deb11-a9e9-4170-b9ca-4720fa73b9e0", "comment": "Malware payload (LummaStealer)", "value": "891ad98de136c77ffc9ec7f8333cf68d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016666, "uuid": "26612318-7501-4061-905d-bf44ce30123b", "comment": "Malware payload (LummaStealer)", "value": "97ce35d216de5038106be935182bb4a01d2bd3de44734ffe701bdd524db688ee", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016666, "uuid": "fb6d6503-f39c-4be9-8138-c0e2ff24039f", "comment": "Malware payload (LummaStealer)", "value": "4a264e1e39b6ac2279aef60f37d25cab6ce4d3ce", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016666, "uuid": "bae42067-e942-4112-9655-37e7a1a249e4", "comment": "Malware payload (LummaStealer)", "value": "6f9ffc9aff11f9e02ab679c190bd74390c344330a6535055b82bd88f19f719a1f452522b06b5a95ed9fe0a7c091bf7ab", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016666, "uuid": "f0881d1b-7104-4fc3-9918-15bcf331a9b5", "value": "T137952A41FDC744F5E4031A3259A772AB23359C090B3ADB97EB847ABDF977285092730A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016666, "uuid": "aae75d3e-ba9a-42f3-b39f-beec525b9e16", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016666, "uuid": "be80a2bd-8bce-4176-9bed-46ee062cd282", "value": "24576:Bh1W1Vzh2z+g/LE7gIeM9qWE2GWOhKGwsffRifhhl2k2nSjqylZaBb3gqswXmhrv:Bv+75AWE9haDv6BbQqsBbz+ZW33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016666, "uuid": "62952e2b-7b60-4578-9b2b-4583c3eb9f9d", "value": 1980080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016666, "uuid": "0f6e8869-7151-4ba5-bec3-faae3bca623f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016666, "uuid": "9fdea8a4-304e-4957-b2f2-d829be4e28ae", "value": "w1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98bc546-63cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Sliver)", "timestamp": 1780987897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987897, "uuid": "6317a1a3-e803-4c2a-b021-12dc10a86383", "comment": "Malware payload (Sliver)", "value": "40a48682cbccb9fd3e095f44b57c9d79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987897, "uuid": "e1080b59-52e7-4815-bedd-c6cfcd4edadb", "comment": "Malware payload (Sliver)", "value": "9942d7cf0661119dbb2a5a0140fefdd67def13184e4da7de1db81ab0831f6fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987897, "uuid": "e95a6584-7c72-4180-a20c-e46855045cc6", "comment": "Malware payload (Sliver)", "value": "d8051a50d91fb0e6b7dbc5ba482f0fe0db5f2fbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987897, "uuid": "b69d2aee-753e-47cc-8e57-5faed023eb1e", "comment": "Malware payload (Sliver)", "value": "9fb17bb59dc1ec6dbe465c3d554f2cf7ae027241782d4bac50d4286c849a6ef33a318be195f885434f4086019a25e6db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987897, "uuid": "91ad63fd-daa2-4150-8fdc-72ed2eeeb5e2", "value": "T1B0C64A47F99145E5C0AAD134C6669212BB717C860F3077D72B60B3B82F77BE4AA7A310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987897, "uuid": "9a4aad3b-a6b2-474b-a20a-aaaafde6cf6b", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987897, "uuid": "ba1b45cd-2818-46f7-8d66-14da220e090c", "value": "98304:Xrcl2U6L1TwTp7l1EiZGZBRA5RAp+xK4F:XguJczGiI/C5CQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780987897, "uuid": "aa55d0a9-fb62-4a8f-8752-8fc94dbb7dca", "value": 11616256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780987897, "uuid": "46ad07d5-c9e7-4e70-894f-a2041add5e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987897, "uuid": "ba243274-44b7-4e19-a2ce-197d0538b7f8", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4604ee6d-643c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781034546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034546, "uuid": "f8929af9-dca0-46ab-b366-0945e6405368", "comment": "Malware payload (Mirai)", "value": "37c9f831f554f4672979f7ebd7bc0034", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034546, "uuid": "1fdcb16c-5dac-41c6-ad6c-bd45e90bc3c0", "comment": "Malware payload (Mirai)", "value": "99639936d66b433539d5644018c415c698469b11d108cf543694944b2a32923a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034546, "uuid": "14780022-3644-4b6f-86ff-ca5928019feb", "comment": "Malware payload (Mirai)", "value": "6457bbb6127722105d573b656227654c6d9070ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034546, "uuid": "2807d2b7-7ffc-41a4-b65c-1adde1d1a483", "comment": "Malware payload (Mirai)", "value": "46a0bea93173331a0d4c8d64f01723bb35a045beaa7d987ec2e9bc1c49313ec7ad41031eed6284b94a3e991a7505b436", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034546, "uuid": "ee10793f-e5f6-4c9d-b99b-bfd037ecd0ad", "value": "T1EEB31B95BC818B11D6C215BAFE1F118D33135BBCE3EA7213CE189B2D678A86B0E37515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034546, "uuid": "7c56e31b-eafd-40c6-acbd-f1b89a55350e", "value": "3072:EilKRA5HLrLoQcxEHgBLQofPA5S6YXpkGa8FF7JxMGTJEikE75X:ESXccuLQER6YXmGacF71TOOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781034546, "uuid": "3bab442c-07db-4358-a95e-5ad0ca46b88b", "value": 114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781034546, "uuid": "f915e5f3-c854-406b-a645-f900bfbb365d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034546, "uuid": "0719cb64-0282-405d-adcc-0ec7a7119a7a", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e319cd-6413-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781016855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016855, "uuid": "9e64ff47-b80e-4629-a44d-4c4af280fb5f", "comment": "Malware payload (RemusStealer)", "value": "c1a04b9de9519200ca286e2429790dc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016855, "uuid": "21d48c5f-0c0f-4129-bedb-e76108546fa8", "comment": "Malware payload (RemusStealer)", "value": "9a896728db9f1cb583d2a74781286142769632dc3dce6ef1d41c676bf1b4e03c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016855, "uuid": "61f431d3-e90f-4537-86f4-fce0ca57ef1d", "comment": "Malware payload (RemusStealer)", "value": "2ad8065b5cdc4620145d171e6ce1db8b8bd228ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016855, "uuid": "b76cc8a6-3cd7-408c-8976-f2b8807dc04a", "comment": "Malware payload (RemusStealer)", "value": "34de3e33bd0d60de3ead9d28fcd4cc7f8c45ffe59e73151e3d2685332b5bddfc63cd4db3c12d05f01c4c121dce62244f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016855, "uuid": "07c1d964-58dd-4531-a3cd-b7429b2c1162", "value": "T1C2B53B07BCE109E9C496633288F26696BB25BC450F3613D72FA1BB782E72BD01C76754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016855, "uuid": "f4bce63b-379f-42ad-96c7-629ae7fc30a4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016855, "uuid": "d6e8564e-0554-4d51-b2c2-6e6c47ae5f19", "value": "24576:wNmRzwxgemhJmR/9tuqbikPNdf5DK+74Hc6n6b/Sefu/nBele7tKDyiY2Kv5K:wN0zwbm498qbiSdf5e+7KSSeEnFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016855, "uuid": "d56943ef-e003-462b-9a94-769252c1befd", "value": 2372232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016855, "uuid": "ee84682c-caff-48cc-af1f-52207eb855a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016855, "uuid": "ab289545-d76b-4f74-8def-c9c7cac104ec", "value": "crz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d85cf0-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "0c8887ee-606b-4c1b-9458-45a22c4de570", "comment": "Malware payload (ConnectWise)", "value": "f2e4e647172e7ea8e1f98692b48bd3bc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "485d629b-2f8e-407e-b06d-43a19e2386ea", "comment": "Malware payload (ConnectWise)", "value": "9af1432af9e801c7a362502c66778d12dbdb89f5acf1e6c822ada3e9b516a128", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "75a55e4d-d0dd-4ce7-bd4d-e4a2e9a8af97", "comment": "Malware payload (ConnectWise)", "value": "8b633a87b676dead4e217dbd225ceb8a77648bda", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "a464baa5-815c-43fc-bed2-03beb0b9b8b1", "comment": "Malware payload (ConnectWise)", "value": "b4a297fc4ea2d4a9a1a1340370b851498b49d6c94e66562f18f4f130ead38a0772b0731e66cab307ed79380617a62a18", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "0fa2374c-aae4-4348-87e2-29a3a58ab773", "value": "T1E846E002B3D695B6D4AF063CD87A42A96674BC044712C7FF57D4BD692D32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "09b2b170-8754-4e57-bbf8-b15ba69c9563", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "85d27cd7-8472-4934-924c-2407de32749e", "value": "98304:hzs6efPhFFNUhJFF3s+BoiGg1Gc977zbt:pfefPCFF3bBR1H9773", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985829, "uuid": "385027c8-d1ac-4245-9f12-dc090af54f35", "value": 5676368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985829, "uuid": "0de7f21b-8a54-4f56-a3e7-8f23711bcb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "1d67a6be-0faf-4c97-bfac-0327b63b68a3", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee252362-641b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781020654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781020654, "uuid": "b5845556-b650-4c9e-9604-085596182846", "comment": "Malware payload (Vidar)", "value": "783c3edc798a51a5d0dc1fa4358d1d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781020654, "uuid": "4aab204b-3797-4496-ae76-d2b4b8d5459f", "comment": "Malware payload (Vidar)", "value": "9c27aafc4dba0c33c7334a6825289994271d8a585fa944266be3b1022f6ec2c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781020654, "uuid": "68b39265-1214-438d-bdc7-5996f979773d", "comment": "Malware payload (Vidar)", "value": "0771b944c6910f68f1e7cd358df1830de0b6da38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781020654, "uuid": "ad59f74d-cacb-499d-a586-fc8e69a0340c", "comment": "Malware payload (Vidar)", "value": "813f9f5ec14bbb67d699636fab792e9bf72ae3fbf7fcd9a2cc3f3847d3431650d8b578309269f0f138a1ddfd83d7b0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781020654, "uuid": "aa8d2c1e-bec3-4377-9e53-9e753bbb3232", "value": "T1C2068D13BC9104E9C869723089B3AA567BB17C490B3257D72F91BA783F32BE41D3A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781020654, "uuid": "14062e6b-35a5-443f-a467-4c1c3de9e100", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781020654, "uuid": "0f328588-f5f9-422a-993f-786133263fbe", "value": "49152:eVe1qj78keEPmBSVyIJk1uo8r95fzCafJV3Ubd1hufPcM/o:ew9diCWnBVkj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781020654, "uuid": "88264735-1e9f-46fc-8820-b6543aa109c4", "value": 3799928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781020654, "uuid": "ad278d74-2126-47cc-914c-31845bc9d887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781020654, "uuid": "fdf29c96-43dc-42d3-a94a-0252b32d5cd4", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1ef0d0-63b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780974505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974505, "uuid": "c975929b-31f2-49dc-8523-a0b74a95e8cb", "comment": "Malware payload (Mirai)", "value": "6e86582bd420b40981e9aa43886a87ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974505, "uuid": "930cfbdc-1db6-4138-b414-61cb2d32765d", "comment": "Malware payload (Mirai)", "value": "9ccaf7ada0881a3b65aa20928cfd03d0c1efbf46b2c82e4f5e71d6426c29d495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974505, "uuid": "cd934178-e4d6-4702-9b75-f15742887a55", "comment": "Malware payload (Mirai)", "value": "f55250dcf0f4fdbdecebac1892427e97313c0020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974505, "uuid": "e601bfe6-8553-4830-818e-88f3c7693b6f", "comment": "Malware payload (Mirai)", "value": "824ae32e4398e3fa360f7439389cf1762165d11c0f18ef40e22674ed7a14013a38d554efaacf2f6379e000502f2a5c1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974505, "uuid": "c9927284-9b7a-4c03-be21-30971a6cb91f", "value": "T15A145BA9BA0F6C41F2C2D3F9DE4C83E13E1735E3C7768971781202EDDAA39D95A90502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974505, "uuid": "61dbea6c-30bd-4bbc-9f64-eafd0a04e900", "value": "3072:Gl0Pai5y5aBkKwbS7w1/lOwZ/7r3h9UmpV8MxMnoq:Gl0PayyIBkKwG7a/0wl7rRpV8Dnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780974505, "uuid": "a4cdd651-7af4-40d2-83d0-0a7d5987f129", "value": 190448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780974505, "uuid": "cd66bb53-3be5-40fa-b4fd-736f9bec3d36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974505, "uuid": "8e71b064-36b5-4e3d-b0d2-df94c8b04a49", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b5b6ec-6447-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781039508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039508, "uuid": "d04cc748-f838-484e-860b-9e9062af9d0e", "comment": "Malware payload (Mirai)", "value": "c053a51757df6f4271d0ed13c80846f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039508, "uuid": "538bb5b3-d25a-4587-87cd-dd456b029f5a", "comment": "Malware payload (Mirai)", "value": "9cce96fb49e1ae341f19e7b8da0c9886c49b554fde182bb7516574043c7b31d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039508, "uuid": "13201d31-9f61-4331-a21c-888a0c2239cf", "comment": "Malware payload (Mirai)", "value": "377d2a397c2e03c0f110d8a2c014cb14382deb97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039508, "uuid": "654cb883-aa1f-42c6-8882-dc6d1bd5cfb3", "comment": "Malware payload (Mirai)", "value": "77fbf27f03b81d4cc959a3e988d88e66a076d0883a137e90bcc88d30f798dec7b8ac63cd8694d90c901ac6ead294e937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039508, "uuid": "8eb66783-12c8-4450-91d4-fde24cbaaaba", "value": "T1F1B34A4273690407E3A70DB1293F6BF193EFD5A121F0A685A85E9B4F8271E322546FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039508, "uuid": "ff0a3e48-b208-48df-a668-fd31301602a5", "value": "1536:ZWmNb4uGcBEKUdkrLYIHiv2bd8XR9xCV4r8FAkivZqpV9fR2E5j+On0rr+0kWqD:8mh4ccSATrx0rR75rt0VqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781039508, "uuid": "9a80aeb0-a7fc-4c37-a294-f0750989190a", "value": 108872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781039508, "uuid": "1e1882e9-5dd3-4b67-9d05-9c5cb2a41a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039508, "uuid": "bda8ad76-ff34-49f0-8155-32940adcb1b7", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf2d226-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003040, "uuid": "98950e29-a9f2-4603-a0c4-396334d1388b", "comment": "Malware payload (Mirai)", "value": "6802db47b306762e01f49de5c1071614", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003040, "uuid": "7d2a003a-b682-451c-a264-263d01b8482f", "comment": "Malware payload (Mirai)", "value": "9d8b313dc7c6f21d5b21881d1e1f2bb61fdc3611cc150008bc43b52d0ad5f494", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003040, "uuid": "74bb7be2-1540-481a-8aad-352991ae68a4", "comment": "Malware payload (Mirai)", "value": "4e10f5940a2e478208486b26fe316c5e8239e257", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003040, "uuid": "9222a642-52f3-4e5a-8439-3858a15c76a3", "comment": "Malware payload (Mirai)", "value": "6dc04ac2362b6d25305c9aed10d800b3d47152ecdc4c78f82d2e0094d1bf3db81be894f1605ca7d791f90883e4715bbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003040, "uuid": "9792fb6e-9f78-4072-85cb-a286501f740b", "value": "T1F1058E9FFA5E3C43D2DAE33E9B8E83B1622BB190C21750537581132C95C6ADDCBB1694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003040, "uuid": "9ae0f6e6-8271-44f3-9153-394ac5285ce6", "value": "12288:jABy/6pnWo46XbQdMdpslvI0Yx5Rk03u6Ftw58GKsh9S2UDyo:jwR4cKEps0JkwI9lUDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003040, "uuid": "4ef7d4b4-780a-4af0-9bd1-729bd41d68d3", "value": 816792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003040, "uuid": "69edd266-7943-4603-8e7d-f7b36cf5729a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003040, "uuid": "cca109a7-3cec-4817-aa38-bc9fb9a82004", "value": "4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d328de27-63cb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780986249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986249, "uuid": "1eb1834f-2e93-4992-9137-ce39667edb13", "comment": "Malware payload (AsyncRAT)", "value": "0fc2b2a5d39d4ab82ce8ad23636daf83", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986249, "uuid": "6603ebd8-8606-4943-a10d-253440e8ab28", "comment": "Malware payload (AsyncRAT)", "value": "9dc57e253a48be197c9d9e6df5127bdf6dc126d2c79abfc5aa14ca4a1f62574c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986249, "uuid": "fe6db54e-9399-452c-b2d8-f0b5a3bddd5d", "comment": "Malware payload (AsyncRAT)", "value": "b3d71296f52303822011909654855e6b97825890", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986249, "uuid": "d100a261-5ac2-4d64-b6af-7e6baad50857", "comment": "Malware payload (AsyncRAT)", "value": "dc459a6a766cb2c9cb9c08a0de2beba408e11f2f9e45d6192df4a10cae1bc632fab8b441ac5f7724365ab28bff0cff5a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986249, "uuid": "9dce0c2c-d062-4561-8645-a06d749607a4", "value": "T123E22C4877E04312C9FEAFF02DF3710A1675E11B9913EB5E0CD4CA962B67AC146907EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986249, "uuid": "cb50660d-1fc3-4533-9b8a-2d762945e2dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986249, "uuid": "a84a2455-a4f1-46cf-bef5-3815d680d40b", "value": "768:ZxC3fOJ5yBvGFbO752aDFo9j0DOjhHmbQ:TCPOeB+bO752uFo9j0DOjYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986249, "uuid": "2f2884a6-31a7-4b0a-afa6-799b50e3c109", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986249, "uuid": "d7929500-ea08-45c5-82f3-bf2a45ccae8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986249, "uuid": "a2958d9d-157a-429b-99d2-ee333faca6a4", "value": "Test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac97864-6413-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781016944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016944, "uuid": "60d43ed9-9d4f-4301-bc14-dc7b844da342", "comment": "Malware payload (ACRStealer)", "value": "ea31d2619927877c234825e9c7b7ec6c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016944, "uuid": "82cd1497-177b-47b0-89a0-58bfc59307b5", "comment": "Malware payload (ACRStealer)", "value": "a035ba236748eac942eb9ff9d62941f29527f5f8c6beb0d7eb519d8016ed1597", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016944, "uuid": "c9158c31-f7b4-4386-bce4-faa39020e123", "comment": "Malware payload (ACRStealer)", "value": "7e3b9faa82ee16130d6ab81b6ac75aceec16a855", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016944, "uuid": "85ff6b21-2adb-4f49-ab28-981f6432e437", "comment": "Malware payload (ACRStealer)", "value": "501b046f1d7674f56900a8561734c705565dcb013f41e7a90b757401a5d227ad673445a036c73cb1b0d636066a595c45", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016944, "uuid": "226a7159-4353-4f91-8989-92c9e39af708", "value": "T1B9C55C46BCE10AEDC55A633288F62695BB24BC444F3623D72FA1B7782E72BD42C71744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016944, "uuid": "11243711-c3ba-4c81-877c-64bd4d2b542e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016944, "uuid": "84c572cf-66c3-4571-93a4-9dbc9e44a089", "value": "49152:8Y0rYRTEYK2S6Sw7bM8olT8aq1oexUZ2uyndE:8WpbK8olTIdUtydE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016944, "uuid": "9fefa92a-605a-47fe-a076-3dc93fb3b8ec", "value": 2726536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016944, "uuid": "1415e0e7-381b-4d83-ab11-905254f5801a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016944, "uuid": "28b98a5d-bb0e-4e29-b34b-e0e1014bb6c4", "value": "hnmh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff2e9d2-63aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780971856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971856, "uuid": "2868f9b5-6af4-41d1-a0e1-9842b41b1d73", "comment": "Malware payload (Mirai)", "value": "996ab9bdf923e2306ed3b05884fb0643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971856, "uuid": "789062a1-a382-48bd-8c34-624d6d760cdc", "comment": "Malware payload (Mirai)", "value": "a09d4c56ed1f5539952a74fe8e28b505e7100feda7b0f23de77b3718befc50fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971856, "uuid": "96e7fcc5-28a2-4328-a615-ce4c0847a18a", "comment": "Malware payload (Mirai)", "value": "49972b3ddb65f502ecfee85be13ee30c0cfa7d87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971856, "uuid": "4dd741f2-45c6-40ff-b553-895636d922d6", "comment": "Malware payload (Mirai)", "value": "69f12ace81a17fe0b949be766da3929d2a406dbe4f7cb82c290fa30587c90898d4d0b43ad39ad4570e2314b631b75957", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971856, "uuid": "75c05518-7cdb-4a85-9d9a-77229394673b", "value": "T11ED31945FD445F57C6C266BBFF4E428D7B2A0768D2EE720389256F30378B85A0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971856, "uuid": "cd31ea93-7bcc-4e2b-a618-f832d5093950", "value": "3072:dtIvFzUDG867hD4OcwalZmEAmIr+6GCWnX:dqvl8qJ4OcweZmE1g/GX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971856, "uuid": "ee2e8747-41af-4bce-a2e6-148f263f715e", "value": 135544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971856, "uuid": "a5de7036-42aa-4098-aaa9-9f209727803a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971856, "uuid": "a264c924-9546-4afa-a8e3-8b9b1db597a7", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe13aaa-63a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780971695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971695, "uuid": "1b25c39d-933f-411a-8059-32c9231ea934", "comment": "Malware payload (Mirai)", "value": "802b04e2ebb124d873b2942a7fb8badf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971695, "uuid": "a219a7df-22b2-456d-8786-ecbae8f62ebd", "comment": "Malware payload (Mirai)", "value": "a0c42cd30090e52e3c79928b4ec5657df21c7e06adfdea4d36cb6efbc2ecf36e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971695, "uuid": "94d32a7b-23be-4d67-ab87-a5063054293e", "comment": "Malware payload (Mirai)", "value": "b574511c96549d3b428467b13b6a417975db8f53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971695, "uuid": "55f5a205-5e9e-4006-89b7-16cf85c6ecec", "comment": "Malware payload (Mirai)", "value": "ec404a64ae705232693202c49d052cb684ecc8ebd638bd0d74b99e68b0c476e47ec819f53dad96b5485939ee2fa2b6bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971695, "uuid": "cc816e59-1d39-488e-bbac-fda9690369e0", "value": "T144630982622C0947C5E21EB0357B17E0D7AAEF9221F4F349260FB719D1B1D3B6846E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971695, "uuid": "5f0224a2-6fb0-4557-9d66-4bbca79c068b", "value": "1536:/CLhQHzmBnbLdvp3as2yJjJnv6V90gKi4M:/CLh+zmdNv5JjJnv2KZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971695, "uuid": "20bc0153-90e9-45ac-b62a-80053cfeff72", "value": 66988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971695, "uuid": "44e0aeb6-4721-4c57-9ff3-61a4f05c1931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971695, "uuid": "aa2aa58b-6135-49df-b94a-548fffce9fc0", "value": "azsxd.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642e177e-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780979621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979621, "uuid": "951651cc-0ce5-47db-b7d2-6b4b036ea57c", "comment": "Malware payload (Mirai)", "value": "24fb3e1469a4e46f19161b8ec34ec981", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979621, "uuid": "a44fa20b-314f-44c8-a2a4-cbffa2daa846", "comment": "Malware payload (Mirai)", "value": "a2032c084c76a60e6d107c6235fdd784df4413ff2d4dfd11c07f138c0afbd46a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979621, "uuid": "7616520d-794f-4997-b55d-852fc2fff7d7", "comment": "Malware payload (Mirai)", "value": "8b1f4233d221827fc3923dca268afc4975abb930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979621, "uuid": "0bc5b922-dc1b-42c3-b6a6-4f41a06d1c4c", "comment": "Malware payload (Mirai)", "value": "355d8300880933c4d5b601b23301eefbbfbcfb1a1802439446d7ceb054632f3585a29bbca118c9c272ef24393d785b82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979621, "uuid": "9f96f15a-b60b-4422-a3f8-c24a6dca6ea7", "value": "T1B6330994B8819A13CAC516B7FF0E438D7B166398E2DE7343DD16AF24378B92B0D6B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979621, "uuid": "f83e3508-ab98-4185-892e-15c95cbf804b", "value": "768:P+Zymx+aUBsI2bd+Wb8MBuk0Aq0cMvCAXTQ2f2d1psVvmuw9bvaKI:GZvs7BRSbRMkr/vCAjSd12ZsbvaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979621, "uuid": "e4a8bfaa-3369-4e1f-a47c-3438285214f4", "value": 54620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979621, "uuid": "ba350eab-aaf2-488c-a275-c62864ff0a53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979621, "uuid": "af364957-e485-4c72-9a43-10b8acbb12e0", "value": "4.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f934e90a-643b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781034417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034417, "uuid": "6a803248-539a-4cbf-b6db-4704ad19c384", "comment": "Malware payload (Mirai)", "value": "564a6b60b3ba450b66c0394020bd9763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034417, "uuid": "a8844185-cddc-4ae8-ae4a-6813abeb749e", "comment": "Malware payload (Mirai)", "value": "a22d8b18c786add3221524b4d2adeddd5b1ac7d7edb558b715c07bf45c441086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034417, "uuid": "000b8b13-f10b-42b3-94b6-d8870394b393", "comment": "Malware payload (Mirai)", "value": "7d59cf089a730bb8f32f533b55bacc69ce9bf4e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034417, "uuid": "0b917e5c-58c8-454f-a4ac-d44929932a07", "comment": "Malware payload (Mirai)", "value": "fbdd01c95faf654c5efe6ad07808d049f969d8f27bb21c81f91708e6283d9a470ed99d0f8c60a9ecdb08049adbb76521", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034417, "uuid": "43197221-e5c8-463a-8336-24c221a29b48", "value": "T19DA3AE12CDA45CACF0766D7120B89AF94B13B540991B6DF73C878225104BED8F6EB7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034417, "uuid": "c3e92d82-aa89-48e6-9535-795037c23ec0", "value": "1536:KR9uu2GgRgWKfSC9XFeMuF/sO3cwu2hNMKifxi7MKzwMCZ0qR1qfV0kt:KR9uHGgRJtC9XFkFx3cmi8D0MKD0V0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781034417, "uuid": "6755bc6a-2a38-4766-b555-5b1e7a0c4c55", "value": 99896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781034417, "uuid": "649d9066-2a0f-48f5-9472-9a722953b20e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034417, "uuid": "40546469-2e22-4877-9c0a-dae356239277", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5226d22b-63a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780971430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971430, "uuid": "34e3c325-6b05-4381-b675-4d41f08a7a74", "comment": "Malware payload (Mirai)", "value": "146f1f7cdfd780d109a0a178b9ef0b87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971430, "uuid": "00d1dc15-e2e6-44a0-953b-e9c26ff7de45", "comment": "Malware payload (Mirai)", "value": "a3c5cc97a3e1a688e28ec5c68522ceb14a40c693b9c1f1a8dfd91497108da6a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971430, "uuid": "c9fcc705-4d42-422c-b4b1-03877bc1be13", "comment": "Malware payload (Mirai)", "value": "6e3ed2249ae6ce81f579ee9f3449e121419c66de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971430, "uuid": "c19210ea-6898-499e-bdcd-46cc0f21a497", "comment": "Malware payload (Mirai)", "value": "5e3770ab1fc59f273bb32e2b67f92a7959e614234e6f87dc4fbaf51cd83f5478df66043fd7fd611ed7be404ed77b1501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971430, "uuid": "57ab1846-30e1-470d-b458-0dbde7b379fe", "value": "T1D7539E6AED3F2DC4E54A05B8B824CF7C5723A909DAD759E188664272D007EDCBC983B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971430, "uuid": "fbd64553-8a83-4dd1-86a3-13a9bcbee26f", "value": "1536:QDp0xKDrf/rShdmbGTnlmD/1hE1hoekCN:Q1Drf/TbGw7Khoek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971430, "uuid": "f493b3bd-2b70-4b84-bf7a-ad065ca6a2ba", "value": 62588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971430, "uuid": "273d769b-4b80-4e6a-88da-bbe2fab300ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971430, "uuid": "c04d2608-9616-4573-9a34-17936823d332", "value": "azsxd.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e2fd8a-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985873, "uuid": "00fbc33c-97c8-465b-9881-657e95231dc8", "comment": "Malware payload (ConnectWise)", "value": "f7667bf75ef21825bcc43b27026b1da7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985873, "uuid": "7f694d17-ffc6-4e76-891e-905c3ac79e14", "comment": "Malware payload (ConnectWise)", "value": "a3e0c7eb739d4991d2d781ad9d6ad9067aeef036eabe8e22ce157ef6b2aff595", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985873, "uuid": "0f8b1276-bbef-4e3e-9259-b043179aae3b", "comment": "Malware payload (ConnectWise)", "value": "1b650dbeeb6d51be5f655c8421a374972594c28a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985873, "uuid": "1c4177ba-e8f2-4505-b7fa-ccd7749d618b", "comment": "Malware payload (ConnectWise)", "value": "5cc4253ebe1d9a8a4b88136ee4efc462846432fc0cb75dff0d72fc876ccc578cd1caaff398711f9adc3f91f45a603080", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985873, "uuid": "db62cf58-c034-4f34-bd8a-7252052fc0d6", "value": "T12346F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985873, "uuid": "c2010d20-3432-48a9-a1b0-f6b37486afd3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985873, "uuid": "e1f10cfc-d46b-49f1-9eb3-eb90ed6ba3be", "value": "49152:dfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:5qs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985873, "uuid": "740771af-cdd8-47da-b3d4-60272ae904bc", "value": 5648624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985873, "uuid": "501eee64-e3c5-48c5-8c7f-eba88e873725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985873, "uuid": "9f396907-b4e8-4107-b418-1287c87ed902", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9a77dc-6408-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781012439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781012439, "uuid": "33f8eade-bd22-47bd-99e0-e4b9e062e52f", "comment": "Malware payload (ValleyRAT)", "value": "6ea3d19ac7e1b170b906244682d76667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781012439, "uuid": "bd4d0ed0-4b57-4bad-ba41-1070279e1771", "comment": "Malware payload (ValleyRAT)", "value": "a44ef560476c335ea77f28d688b1fe93d74382f1d9028651414785c76bdb4d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781012439, "uuid": "78ee02f5-357c-4ee9-af81-0fe66e2351c0", "comment": "Malware payload (ValleyRAT)", "value": "0fa12b365e06956caa9a6ce0f0056143e3db183c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781012439, "uuid": "d546d4e6-85cd-45f0-9dbd-8d35bdd611cd", "comment": "Malware payload (ValleyRAT)", "value": "8885368ee71c946c1675a64b95e2e9de8471217819598432521c94ecfa29df30021a80a3472f7d7b852b1bbfab85eabc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781012439, "uuid": "8e677ea9-1ff3-42ba-bf1f-72bf254e7fc7", "value": "T1D0F78302B70585CEE076A278948B4FA0E336EDB186B1973723B5371D1FFA34C8EA6554", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781012439, "uuid": "541094bd-2e3f-4f00-b60d-9a628859d458", "value": "e611cb40dae30a74fa3f15a0e816a66a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781012439, "uuid": "4a79ff6a-f2b4-449e-af49-e6634df9f480", "value": "196608:/5VvrkQ2dqbMx1LAJbQeAiZHSoTAucxDwG4:/5Vvr7wNs8ocxn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781012439, "uuid": "621db90f-024a-4cb2-805a-ba46db3e602e", "value": 73816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781012439, "uuid": "a24334ce-7c1a-4275-803c-8465d48f1b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781012439, "uuid": "6f483125-688d-4ac4-9179-67c6d24890d2", "value": "app_softwae86352008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c2e48a-63df-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780994662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994662, "uuid": "eec18075-57fe-4f3f-ad52-28b85d02c0eb", "comment": "Malware payload (PureLogsStealer)", "value": "62e9ef507c108c4f5e9e0085af20977e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994662, "uuid": "b34dda57-f49c-464c-8715-2d7dacf6f9fc", "comment": "Malware payload (PureLogsStealer)", "value": "a5903b21a481d11fd8ac07ba5ec097c300f40e247906a0ce2f05f6edccb7630d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994662, "uuid": "17411f3c-d09f-44ae-ae27-1c28b846384e", "comment": "Malware payload (PureLogsStealer)", "value": "5039d09385932a16ef0947a497791981d8f153ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780994662, "uuid": "78b03534-ab9c-4333-8fad-3fbb9280bc7d", "comment": "Malware payload (PureLogsStealer)", "value": "e79773b4827231b4a5888ab6a115e060b2c11f397546c7e9c7497852daa4e63c62a3f629c8a141d99ef8d74b32cccbae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994662, "uuid": "a9eeb094-c3a7-45af-b27a-0edd1692b165", "value": "T1E2F4F73DCC19013ED572DA2DC49A494FF8C29517222CE84760D73B5BAF6398277923AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994662, "uuid": "81010007-55e1-44fd-986e-dce3ca806456", "value": "3072:qPluyXlHjX7ZXq/uD28gj2wD68rJ1BYhWAR3awnrE7tEhbdqiWquGDKcU8lwOe0Z:SVCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780994662, "uuid": "2dce727d-ba19-46ff-a72f-5c80957e6cfe", "value": 773088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780994662, "uuid": "bc7f540e-208d-4f1a-bbc3-43464ec2cba9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780994662, "uuid": "6cbb51d9-5743-4f3b-9bc3-7aa24131f432", "value": "output_lrx67ae6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8dcc37e-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "30c006eb-9258-4db9-a418-2314d71e2d0e", "comment": "Malware payload (ConnectWise)", "value": "c9f43c3edd255d8b9600294a9940edd3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "67078421-2660-4cff-9775-6c201afe36da", "comment": "Malware payload (ConnectWise)", "value": "a71a9454423e385d497144eb58617da51af5e475f8086e1e25aa82549b2a9423", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "4565dc92-2f96-4da1-9ccb-efd095ec7de5", "comment": "Malware payload (ConnectWise)", "value": "0e865458a8f3e702a61b1a858e6a5e7e96256da8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985829, "uuid": "330cd52d-2abb-4eb7-9f85-6dde0225ee41", "comment": "Malware payload (ConnectWise)", "value": "6ce4890f5c5443031a85b5d27601af91819018b807e5e02130e6dc77cb3b26f8f9eabc5bd170a842f9e41c810eddd0f6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "47e1b76b-0b6f-4fee-923d-2d857d8689de", "value": "T10846E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "31da709e-4a4f-412f-850c-7fd49cea480c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "69cd2928-a15e-409b-9cc2-7cd96446ba1b", "value": "49152:BEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:WEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985829, "uuid": "82fe04d4-48d2-4b8f-9961-6e524736c5a4", "value": 5622408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985829, "uuid": "03b8c912-812e-4c4b-a186-4e1a6dad01a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985829, "uuid": "75e5446d-d304-4173-8fff-b54c1a178423", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5025bc48-63cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780986888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986888, "uuid": "404854e5-0a28-4c4e-a90b-61e1ccda2baa", "comment": "Malware payload (Mirai)", "value": "2487a49612232fe54e1965f57ebf4fe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986888, "uuid": "592291d3-fcb9-4175-a408-c849fd6ac0c6", "comment": "Malware payload (Mirai)", "value": "a7679ce5f6f693f6a7235b1e37b5677f81ae818abb7809bc81eee3f2d80e1907", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986888, "uuid": "2abbadcf-4f86-46dc-aef1-4318e9b1e845", "comment": "Malware payload (Mirai)", "value": "dd7c906e833d5cd83947af6b3e551f0044f3c767", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986888, "uuid": "6b4f43a6-2636-4e25-b108-67769a0cfbd6", "comment": "Malware payload (Mirai)", "value": "993e2759d9624165d0a6c04c9bce70c3acc1aa9ca13381a92843b91e076610290b26ed3f5540a5fa666d416a863a1258", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986888, "uuid": "f0f7e061-5d11-4355-8671-25c37b8f544a", "value": "T14A144A47EE890EDFC45BCEF086AF836B19E3559B58D2B2F4547C8C0C355D28A46E3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986888, "uuid": "a2145418-1ef2-47c9-9e79-3e17200127d5", "value": "6144:lHGPvSArA8DTSl5KB7FDeOC9E9Idoniq:EM8DTSl5K6IIini", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986888, "uuid": "600cda9a-306d-404e-8d09-4cc24a6fc9da", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986888, "uuid": "992562f2-2d32-423b-876c-270a68a41281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986888, "uuid": "6ebaca0f-6151-4fc7-a239-c9922dee7630", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c93c0d-6410-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781015622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015622, "uuid": "22535f6d-29ba-48ef-91b2-972174d0e8ab", "comment": "Malware payload", "value": "486eb9f581fa6a8695b3a7215fceced0", "object_relation": "md5", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015622, "uuid": "91a996cb-19a4-4bbc-90e8-9b54ed07be84", "comment": "Malware payload", "value": "a7939b429f50866c8b6bae8d4d1af7154f3e82efa077a9a4688e593bd0bc1e71", "object_relation": "sha256", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015622, "uuid": "79e51d09-b616-4dbb-9a57-b4ad9fd58ce9", "comment": "Malware payload", "value": "c2f76905f66917a20d95fd903fc7110731d9783e", "object_relation": "sha1", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015622, "uuid": "15d03ebc-fc1e-4756-a745-1f77712d8fb3", "comment": "Malware payload", "value": "23f7e8702ded770912577afae54d391b69c8987a7a672ec7aaf3acc5aee0c3ea656f8bbd347a8decd26a4584698a1c0f", "object_relation": "sha3-384", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015622, "uuid": "dfc8da6f-8349-471c-b7e3-5fb04fc949e0", "value": "T1529733FFEA4182078299DFBD58092DA6B1573235C6CE1EAA74341F96FAC0E1C580CD79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015622, "uuid": "a00fb594-42f6-4788-b4e9-a1721402a9ab", "value": "786432:f0wZeJ5T+U2gfQ6tqD7ooTO48MkrGYLMLJnRPXJfwfIC4dePWHTT89:80ezTxdQD7xOKkryRPX9wfIxd/H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015622, "uuid": "b8608aaa-7363-4ac0-bf07-3f57937d61f2", "value": 43211273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015622, "uuid": "6d942884-7ecd-4b8b-9b49-424ee007efc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015622, "uuid": "089448c1-d913-4ace-ab2d-8cd28a0e82b7", "value": "Setup_File_16.758.7808.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc8523a-63d2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780989136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989136, "uuid": "7dd4f904-61ac-496d-911e-85f4d127b4cd", "comment": "Malware payload (RemcosRAT)", "value": "45b6994852dde2a02cc4d56f71867892", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989136, "uuid": "fd6ad310-f8f6-43fd-813f-c144dbdc1490", "comment": "Malware payload (RemcosRAT)", "value": "a7f22d7a476aec7896d52f78a5e2533b71d2fa376e01a797cccdb04e853fc089", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989136, "uuid": "c3b75c9e-539e-46d0-abbd-b2e70f9bd26e", "comment": "Malware payload (RemcosRAT)", "value": "d23ef23e48e7aa8d91590ff579074a8367dc6597", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989136, "uuid": "75ab5530-59f2-4e36-b94d-c63999457a13", "comment": "Malware payload (RemcosRAT)", "value": "b940ada7cba0ac86f50abecc3f95ae8362650f28a97a7867ca6ce051f783e0ee7eb30d244b011e286ddc9d35594282c7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989136, "uuid": "3ae1dadd-695e-42f0-b25b-72ea8863b2c9", "value": "T187F6C7214262CB2434D3DF00F512AAD3F776FE9AB61A636488856B2C69500EB77F1F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989136, "uuid": "3c4b4196-2853-4d51-83ea-03f3256190be", "value": "96:XwLQPirpSdPyA5Qpj7EbiHiGhQ9PK02HR3jEmqQqkqKAP1pnt2YDcWrJPCI/V7Vm:npZKAdgKMLDi4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780989136, "uuid": "f6ba10fc-1d6d-4dcb-a8d9-af81da236f4e", "value": 15371536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780989136, "uuid": "fd354b17-a645-4ce3-ae99-1e158123cd09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989136, "uuid": "70845202-8d6f-4d3c-94bd-711cbe1683e7", "value": "RFQ_Inquiry_09-06_Nabaa_Al_Asrar_Co.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acb10dd-63ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781001590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001590, "uuid": "73d6bb28-6f43-4fd3-9b1e-e2c53aa52087", "comment": "Malware payload (Formbook)", "value": "5888d07f582b6bdaa1c5316083d130c0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001590, "uuid": "1852c730-e5d5-4cf7-9fa6-1af263f62490", "comment": "Malware payload (Formbook)", "value": "a842f17e63301d2e5a1456b410cb584a9ba122b0d629f77110129b70da1ef85e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001590, "uuid": "cd0257ff-862f-4c1e-8dd8-361bb498ab59", "comment": "Malware payload (Formbook)", "value": "ab5f869128408f9b558358ba9cd1d2c9e3816adc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001590, "uuid": "034b4c44-456f-4213-b853-787053558eac", "comment": "Malware payload (Formbook)", "value": "2c19d9ce14ad24bc446eef9fba614edef49cee9bbc39f2a475bffb79e7adba89d5efa9976eb5586d58ec5dd8acef10e0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001590, "uuid": "fc3fa82e-e25c-4301-8031-6eb90d106588", "value": "T18AE55C17D66F974D180A3B61106A5D9AFE89CAFCEF726BC4E0CF90B510EE1110B852B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001590, "uuid": "9ecca65e-b08e-4d67-a300-4ec145d5c4a0", "value": "49152:iF7le1UGJ6DiB/ZHsEPoft1b402GlINqcZxjRhvWs4MyxA+1kb7tdjsoz2YhLNQU:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001590, "uuid": "5728e093-e357-459f-9d75-1ef8cb1e2999", "value": 3105000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001590, "uuid": "970e3f50-882b-41a2-af8d-bd19cf8f169b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001590, "uuid": "c3ac9ab1-1f0d-459b-ac2c-92a795da4555", "value": "Invoice_2776 (30% Advance) \u2013 PO JB252-PO11.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b35fe3-63ec-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781000486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000486, "uuid": "5d332539-9f73-40a4-a164-77ee66724f5e", "comment": "Malware payload (PureLogsStealer)", "value": "8c2ada3658c41919cd9f731ad0781106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000486, "uuid": "4176539e-21b5-457a-9676-7a05557fa0f6", "comment": "Malware payload (PureLogsStealer)", "value": "aa00ee0b08aa375618c6ee930810dbb5ef92f35c1d6d07faeebfa027311c0acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000486, "uuid": "d7d4b49a-5285-4ae9-8478-79d1c5724cde", "comment": "Malware payload (PureLogsStealer)", "value": "9139d15006cda33cab9b922ef7bb1ec70e78c3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000486, "uuid": "bcb72674-416c-4766-bd3d-b0d150b411c9", "comment": "Malware payload (PureLogsStealer)", "value": "034361c7d1754101cc77b866dd3b115ef9ed87a98ae9d8599aeb90956db8a46e1d5dd713eb349e99749cb23201071a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000486, "uuid": "70d81bf4-9e5f-46ad-8de3-afb3fa6ce934", "value": "T1B9F4BF1B37958F21D2841236C1E7550187E264477A7BE70E7A8117DA29033BBEE8F39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000486, "uuid": "ee93c230-e584-4ca8-b76c-e9d54c886a14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000486, "uuid": "51b78071-7a3c-4c8f-a1cd-65ab0ff260f3", "value": "12288:SwZixucAxfQchEmdgvSqTBOHj0TQSTUNJj499rakTqq9PCknLclqFxd:SwLfhhEmqzOHgvWJj4Lr1TPPCSws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781000486, "uuid": "821925ea-276d-4713-97cc-f2000445d955", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781000486, "uuid": "9dc13c40-7546-4c27-b228-6324865f4a24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000486, "uuid": "84efa695-29f7-4616-82f2-c9bec88ae172", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.66149937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd5e48e-63b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780974506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974506, "uuid": "ebc2758a-5d1c-4b08-b976-b2bdf4cb0beb", "comment": "Malware payload", "value": "a23c5c9e5b6b24a7ebf4f8117d85fb70", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974506, "uuid": "09aa975f-6273-4fe0-97ea-7ff5864d289b", "comment": "Malware payload", "value": "aa517f4712f180eb978b7a9b1d9dc3a5f34cfb05dbb7c927785943b4132dcecf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974506, "uuid": "4cf5c0d3-de0f-4800-8978-40f788458415", "comment": "Malware payload", "value": "8e2117fa646b2d689e8444e5188d3a58438c56c9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974506, "uuid": "4fc6e36d-5558-4046-b441-50f79b0d475e", "comment": "Malware payload", "value": "6e3211c955b4ec450f505566ced91de55d247a29973d37dd56a3f2c905def10f670c4fec22d58112776aa24ef808bd03", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974506, "uuid": "8b53fd9a-88b9-41e4-8cdf-89f5e8cdb6af", "value": "T18D138D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C19B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974506, "uuid": "278d3ec7-f9f8-4b1f-acf3-41ed837a9248", "value": "768:w+d9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:w++co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780974506, "uuid": "e52eb81b-9822-448f-89a9-a1cca803e911", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780974506, "uuid": "bab08c86-a66f-4bd4-b7c1-ced47d2ce380", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974506, "uuid": "c0611e50-6370-4cac-9dda-6572f7ee573e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81447ef-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985828, "uuid": "f5f86964-6f30-4c9a-b58e-ed16f746fb19", "comment": "Malware payload (ConnectWise)", "value": "56a3da41e077fe7b25d42b7ea4dc08b1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985828, "uuid": "50ebf0f1-3a0d-4c63-930b-117c604945b8", "comment": "Malware payload (ConnectWise)", "value": "abff8aed4b24bec9b53e7980f2e5f52555d48eb3e45d7942e98c13698a65d202", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985828, "uuid": "dec0ff13-130b-4a14-bd4b-50e197c72f4b", "comment": "Malware payload (ConnectWise)", "value": "88d82d0d222ba05eb02dba88ba4430da2c81fa74", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985828, "uuid": "2cad3156-ec23-4aab-ba97-b359c9169eb3", "comment": "Malware payload (ConnectWise)", "value": "03da3626b53d6279f7f44f49c8bae9b107da9e64eb05282aac864aadbc59859e78e08aa42731d4a427cc98cc7e207366", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985828, "uuid": "3fc4a2fd-2787-4c3b-a93c-3a1848319c5e", "value": "T13746E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985828, "uuid": "7cda1c6b-22c6-49bd-8a8d-60e5774dd3ad", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985828, "uuid": "b433f8cf-483c-49c0-a775-ccde1f9a55d9", "value": "49152:cEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:1Es6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985828, "uuid": "9c0fbc43-5718-4cde-b405-c02d8268611c", "value": 5622104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985828, "uuid": "ed4a613c-ca5d-412f-8bc1-e1a6adaf0181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985828, "uuid": "1d3d825f-a94e-4385-bfde-67c7abbe7939", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b98646-643b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781034408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034408, "uuid": "2208e951-80c0-4d8a-adf0-0d5460745dbe", "comment": "Malware payload (RemusStealer)", "value": "1b3049ab4cd06c81de9a8fde94782ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034408, "uuid": "39254327-6451-44c0-9b2d-8770c22fb097", "comment": "Malware payload (RemusStealer)", "value": "ac187a01e34ba3ba6bd51326390e19f58e2de2c82646f34017628eaa9198f082", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034408, "uuid": "c45c4804-508e-4a77-adc0-0e891a5689b6", "comment": "Malware payload (RemusStealer)", "value": "d3140bf477ca00da49202121b4c9504156ebb059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034408, "uuid": "0042a6e7-ee32-4b76-9288-66a021035b29", "comment": "Malware payload (RemusStealer)", "value": "68b6dbf7ea210c820aab017403917c2fe3bd4906f46ee3ea491462fd0336a9117ca336a917b5340d39c6d3e1487c47ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034408, "uuid": "41a470a3-6019-43cf-ab8f-5d38058a95e1", "value": "T1E8E54B07B8A108FDC0A9B33085A366567B357C480B3617E72F91BB782E72BE15D7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034408, "uuid": "3d76e93e-7f21-44c0-8337-cc43accf65e2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034408, "uuid": "02cc4324-0b6f-4e67-b367-47fd7863bc0d", "value": "24576:Cx0K1jZmvNmJLW1+vljccA9Rr7VCsUkiXAfAjtvrbItoGyxFJBelenk9D/1FWz8h:Cx08dm8JSMdjcLRrhCOWkoGxhu2Gch1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781034408, "uuid": "b72d38a9-1dc9-4cac-a150-9541ec850edd", "value": 3037576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781034408, "uuid": "49503d77-7937-43c0-9def-3bd22f71be67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034408, "uuid": "8cf27700-ac4e-43d7-b336-dba5d518991f", "value": "\u041did\u0435sinstr\u0430\u0440\u042564-v.5.185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b48979-63e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997313, "uuid": "d1514370-6847-43ca-914e-fbf79ce84387", "comment": "Malware payload (Mirai)", "value": "7df7458c727e0c645bc1ecd5c8d0d428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997313, "uuid": "3f54ebd3-5d55-4f12-bd43-55ed94634222", "comment": "Malware payload (Mirai)", "value": "ad4f66199fb38c2860d8a2dc8f906037e59963bc5691bf5b532f17eefa9d99d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997313, "uuid": "fe78c923-6e43-431b-9299-3ad94189de3f", "comment": "Malware payload (Mirai)", "value": "0da6c93e08ce4a4d73045d17520c1542626f5f72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997313, "uuid": "d31e7e98-4652-48c6-b391-4b335c465a6d", "comment": "Malware payload (Mirai)", "value": "6450497f11b26c6a46bf9e940da9eb8b120b0dc28da22a83488064687d6815465b2a698d8f5deda28e031ba522f6b713", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997313, "uuid": "60a86e31-9d2e-4093-83dc-629a5b9efdf5", "value": "T18D43027656521217D93094B0ED1FA014B3227B3E736FB41025E4CAE0EA87D81EDA93EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997313, "uuid": "70988867-5952-4340-995e-70aabbe4aa5d", "value": "1536:GpC7yVQOqrgqwaFZCNMQE0iGbk1JZaTEC9jn1ILm:GpqHrgFavCNRE0/gC9r1ILm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997313, "uuid": "65b0816f-53ce-49e1-b607-b49b4503226c", "value": 57812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997313, "uuid": "0e380d33-e183-4a39-8e77-df5de15cdd79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997313, "uuid": "c649c581-0c1a-4a2b-8a67-648757397173", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c49cab4-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781016571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016571, "uuid": "221eee30-3ddb-45f5-9f35-72fc010aba5f", "comment": "Malware payload (Mirai)", "value": "7cf0f818463a7d8d0d8407dc412a2292", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016571, "uuid": "c0085abd-6131-44f0-8bf4-15c0bb7972e2", "comment": "Malware payload (Mirai)", "value": "ad750002ced82cfc0451fd5a8d60a11b2c946266f7934ecc3ba1d0e61baf61c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016571, "uuid": "6de56238-926f-4e08-8fba-eeaf5dc8cadf", "comment": "Malware payload (Mirai)", "value": "c29e3c5a87de2f479af32b2c1bbf95a956fd4a29", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016571, "uuid": "d26d6812-ca94-4f34-afdb-4bef53ae17d9", "comment": "Malware payload (Mirai)", "value": "aa5cf1a588943427493a17b7a2a67bcce3a44104ed21823eb30689e1c711d2313383dddca027c220ed00112d48a425ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016571, "uuid": "25fa9bba-ac36-41c9-9fe8-f400a1d96165", "value": "T189347C96B8D6B848DCA502F05BC7833D2A5342C24F5AA0D3FC4E7BA9DC72D8A6511FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016571, "uuid": "905c0049-723c-4cd0-97a5-fa66b3da65f7", "value": "3072:oRgVAPeCamF6l/szpe4PPjHMvea437mxjGLwQIFYeY2o7fsuXgxKqJ:oaiPeR/sz/nLaHMzeYX3wKqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016571, "uuid": "0a4baf93-386d-40f6-9f71-d2ed3cae937b", "value": 231492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016571, "uuid": "dce28da1-a70e-4451-910c-38abaeec6314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016571, "uuid": "876a38b1-26e4-4e0a-b54e-ca1aa2f1f128", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf02e75-63ee-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781001322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001322, "uuid": "35ecc91f-7abd-44de-82ae-aa82283cd692", "comment": "Malware payload (AgentTesla)", "value": "9959d0d2cb19f1e100e379fef2b44712", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001322, "uuid": "8c0fa017-8204-47a0-bff0-d490ebfa9779", "comment": "Malware payload (AgentTesla)", "value": "ae3aa303c38f1949b7e3deb21e072c46ffbb83b29f4e35c929ec0a5de6ffe30f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001322, "uuid": "74bbaf8e-c9b6-4356-82f8-75e246833c71", "comment": "Malware payload (AgentTesla)", "value": "d6a91c616c071c84fb58a7407bdf8a75613884e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001322, "uuid": "4d454d7d-9f02-4aa1-9c61-a02967944860", "comment": "Malware payload (AgentTesla)", "value": "3fc992b71307bfd86e0399b0e7ea72f41398001c3b67c31360cff7516b305da85e85fcf12a15f5659931d092bd10ac47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001322, "uuid": "8deea5a1-229e-464a-a8b0-9ad25bc63010", "value": "T18EA530E241CC3488A69D4AA0ED74F3867F484CAA4C5BF38DA1BD476318765C116B3BBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001322, "uuid": "654e6e95-9357-4cfd-98ff-16b3daf9d011", "value": "1536:zbwMaW0c+IcfrJgwViqj5uCwcUR6VOip+xO9MxZaBwGRsMfafq/7BU6cy5V7PONh:zHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001322, "uuid": "241ed9e9-a928-4201-bf90-aa15de0aaf21", "value": 2265339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001322, "uuid": "e9f845ee-7d81-44a4-b294-ca40c91b9de7", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001322, "uuid": "21312be7-ee9e-4d38-bc96-e918f8158506", "value": "ae3aa303c38f1949b7e3deb21e072c46ffbb83b29f4e35c929ec0a5de6ffe30f.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23987dd1-63a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780970063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970063, "uuid": "07974a13-9ad7-4da4-ba73-0f4fd787b8ef", "comment": "Malware payload (Mirai)", "value": "09511057c755c37c572890db2dee208e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970063, "uuid": "7b5a2848-822c-4ee3-81d6-eaf314e1e87f", "comment": "Malware payload (Mirai)", "value": "aecd51e3d27fe0b2ed2214f64a520797cc81db19c86536e5b9a2e09cba7dc736", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970063, "uuid": "b60519df-321c-4496-a216-ebd61c2ca9da", "comment": "Malware payload (Mirai)", "value": "7dea2702fcbde4ba84e1bd881e70c0140c630985", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970063, "uuid": "cda3a092-2fde-4733-8c3a-681b5b771dad", "comment": "Malware payload (Mirai)", "value": "e4afafd1ebe457b4b408fd2d6189193668125383671972ea8e9057757e02740c44e655d636c71ddcfa17b48ec100855b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970063, "uuid": "10a3f8e2-0e43-4798-92fb-c8c3efeec205", "value": "T148534AC5C643DAF5EC1122B51437AB218E7AE13B0A39F917E3E92E366C13B518A0735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970063, "uuid": "9cac3ad3-6599-4b2d-996a-14505c2a78f8", "value": "1536:VYPm3gwIu/VS2vcgaO4d9i1pn4Bj8WvAv5D7bkmwFgeXgGihE:VYPwr/VS2vfaO09Ip4Bj8tD7bXwFNXuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780970063, "uuid": "10f1f319-03ea-4cc3-ac3a-802d4761bf6d", "value": 62416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780970063, "uuid": "72e6f6d8-43c4-466d-92fd-7ac8796d92ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970063, "uuid": "bf7c28a7-bb59-495e-a260-0d3356fac3ea", "value": "azsxd.i5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2002692b-63f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003988, "uuid": "cece16fc-3806-4ae9-b383-66d31e05c66f", "comment": "Malware payload (Mirai)", "value": "b8bb1cd7bfcf4ad13027fb830f83637d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003988, "uuid": "28850dfd-cb64-4409-85ef-ea5cde92ff96", "comment": "Malware payload (Mirai)", "value": "aeeb5313ac9fd0e32b4f84de7ac47da8d9761b327ac35d32f2b8d51f0fb8424f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003988, "uuid": "d6161255-8387-41f4-9f3d-5049dcb3f516", "comment": "Malware payload (Mirai)", "value": "fae55d1bc64854768c354fcaf6f0971e5b657722", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003988, "uuid": "cbb3ec1b-a985-46cc-820c-d6a986b3d4e8", "comment": "Malware payload (Mirai)", "value": "44457871890f2be2fa66ec2861b20bfe9a5df66520457fa7a45480e658c3e38f5a629aabd6e888f7381aafa67b4e1809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003988, "uuid": "fbe05fec-1964-4a00-ad44-45566ab4b6b0", "value": "T188B30849FC415B11D5D722BAFA5E028D335357ACE3EAB102AE211F2133CAA5F0F63916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003988, "uuid": "0f90203f-0cd5-4c7f-a814-baf6f76f679f", "value": "3072:KIYHMA3+4GbMVd+SadsXnaWhUu7j/OrUPJbT:KIEMc+HMVdradUnaWhUu7y8bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003988, "uuid": "69dc5279-3306-47ed-9e32-d10da5ac6cd2", "value": 116720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003988, "uuid": "b963284e-799d-4e66-8891-765ad8c00153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003988, "uuid": "93e25db7-71bc-4aa5-a918-db45da22fe52", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd90ab5c-63d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780991850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991850, "uuid": "7e20ef92-c750-4af0-8b98-d1296138523c", "comment": "Malware payload", "value": "1002851e4393ce1e5b0d71271755ec51", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991850, "uuid": "c931d29a-eb01-4fd4-b1e2-d9fb3017b511", "comment": "Malware payload", "value": "afc1803107162699dd2af420dd2ada2a313eee6f08c6f9081a566870341087a3", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991850, "uuid": "b32f4d73-1b40-4181-9331-be8fab83af52", "comment": "Malware payload", "value": "2b955b49aa94c52860b52a6b81f77ba51649a5d5", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991850, "uuid": "2286b422-2630-4887-843c-92389f0441eb", "comment": "Malware payload", "value": "b3a724ba61d7f24a6b7ddc6996937f6f5811c7b77fee1a4ce6502a2117e513ac41d91903995837ce2cfbe74eea877755", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991850, "uuid": "440942c6-64a5-4c1b-a997-9cdeb02100f0", "value": "T176742BA7213EA9E9ED4A323CFD0B2B7FB581742107B1F5F2E90642380DE2665913535E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991850, "uuid": "ad87a4ea-5c10-4f23-aee7-8e7c974f55ad", "value": "3072:BuI4fJ9+Fy8QjB28g0BlIjGMNosoPwPa1epPVW3o4808Fi4LenCnp3VkggkfdxQJ:wJ9dQiNeWEeulVkc/pr1U0clDvPHuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991850, "uuid": "5cc2db63-9ca6-4c11-893d-e6ec71fd0ddf", "value": 362624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991850, "uuid": "68776bfc-47d9-46e8-87b1-10c4610f68fc", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991850, "uuid": "e51c1177-3d48-4ad2-9d1d-7215de9469bf", "value": "GITHUBCODE~.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001c7596-6449-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781040012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040012, "uuid": "b8ddbfc5-b7e2-47af-8d21-c0dfeb16c380", "comment": "Malware payload (Mirai)", "value": "37ef20322e39a3f5aab7ff8fb017fb02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040012, "uuid": "4d112b6f-5057-4916-b4a5-c47ac4ba27fe", "comment": "Malware payload (Mirai)", "value": "afc729a286e981232fec5907c6b2cbe640a79e60b00d657e10a1e1a6da8d5ff0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040012, "uuid": "0304f985-df3a-4bfc-a1c1-868e7a510c45", "comment": "Malware payload (Mirai)", "value": "12db66bcc2361a89e65aa20cf9d1039fd4aa2e99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040012, "uuid": "d22f4256-cf4f-4289-9fd8-e6df4a69c8f9", "comment": "Malware payload (Mirai)", "value": "9639b2d72e2b379f938a22e01941a34d44e6073d34f2c6e52379b1e89dbb8dd4197dd18cd4814ee4f4b9f81f81ee7bd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040012, "uuid": "badde2ef-e2e4-4ee3-83ec-a70c882333c6", "value": "T1C7D3E91F6E239F7DF33882354BB78B35A765239123E0C585D26CEA105E6024D686FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040012, "uuid": "0fa9f393-db96-4933-9b36-bece9fa08981", "value": "1536:g9+lXv21icsg9yD5iyCiy66yzFXyHpk3Bad/rSgXoKN4he7TyXi5PQ0kYJ:gwx21vlsDPcpZJSgXtani5I0xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781040012, "uuid": "7c4a57c7-21e5-4025-b982-4ef7adfb3176", "value": 132580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781040012, "uuid": "304c1c93-ec91-4033-aad1-96e15e6a7185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040012, "uuid": "781008b6-64af-4ab9-82f4-adf7fa39cb23", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f209eb50-6401-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781009494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781009494, "uuid": "d7602b4b-d3a3-4bdf-b10d-25b5d4e7d239", "comment": "Malware payload", "value": "79d48a321c2a2eebc20bf93d4243be4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781009494, "uuid": "aa77c418-cb6f-405e-974a-bec83bf917bf", "comment": "Malware payload", "value": "b1aa30190c7000337b4e3466db07dad3cff5d2b61ebeeecf1bda85fb27677e68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781009494, "uuid": "c9ede898-d3ae-406b-9af3-1889bbd3c6aa", "comment": "Malware payload", "value": "509d650261f34c9d1ca31050fd5b5fe412389805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781009494, "uuid": "9f988262-a6b4-44fd-9b03-2ce49077cd59", "comment": "Malware payload", "value": "ff9a4b6999369ddb6a3423b05962580a7bbfb9d278eb6ae0d37abe6f6fb137d83bfc515dc32ca5ee3834afc47b1d425c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781009494, "uuid": "76570708-ac62-4bf1-b07e-f31388d59a41", "value": "T1D4B23B05E3A300BCC89DC7B1C16B5512EEBE3C172B50BADF67A126297C30794B529EB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781009494, "uuid": "ece05e21-9053-4eb3-8111-bfc3b8898ddc", "value": "a2706f6f638154d2b431abe5e1551efb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781009494, "uuid": "3a2e4e2b-f4d8-42b0-9c12-1b196055517d", "value": "768:XpmljpNfUDnCy8Dbmk5lwOClqAAAAAAUY:Xpm9pRUDnCyGbmk5OOCjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781009494, "uuid": "ff3e1753-f135-4666-ae91-a449f680e5d8", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781009494, "uuid": "ac6ea406-9562-4fbc-bc73-46b37e714736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781009494, "uuid": "e14f1a3c-9efe-4031-94f4-4bbd248644be", "value": "MTDYN20260906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff15937a-6410-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781015958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015958, "uuid": "47e76315-077d-479a-9f8d-64b5ecc027f6", "comment": "Malware payload (RemusStealer)", "value": "8fdae030ad39176f574a2ac8609a777a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015958, "uuid": "43a24e5f-097d-4c73-9675-e94e3905b3cc", "comment": "Malware payload (RemusStealer)", "value": "b1d4d047f43abc1901c6c56ad7a0c07d69c55e18e326bfc0e38e1e71af43f09a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015958, "uuid": "1bc902b6-910b-486c-9b6f-08340a7826f6", "comment": "Malware payload (RemusStealer)", "value": "8015b01435be2f9c6e2d37f27941dda3fafdcf64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015958, "uuid": "3f3e204c-4d3c-462b-9474-faf86c07d29b", "comment": "Malware payload (RemusStealer)", "value": "cd2d4ad58dc07f35e8c1a2f48bd08c97ab1e0f95c91228f9a597bd44bb02cf780daaedfb23848e583c5b6d32c6791703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015958, "uuid": "720d1f31-9c20-4d1c-bd56-1647eb587df0", "value": "T159B53B46BCE109EDC49A633288E22596BB24BC450F3613D72FA1BB782F76BD05C76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015958, "uuid": "46cc48ca-1f46-44e4-85eb-9a1a3ba36b5b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015958, "uuid": "d9d00352-1fb3-4fae-a60f-42d2e955a595", "value": "24576:NstfWdMA67WgH/vHgWuFACZ+ws6HD2e7A1Ce/o/nBele7tKDyiVefR2:NsdWdG7tfglFACY6HSJ/6nzR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015958, "uuid": "3974d785-beac-4f43-81e7-72f4377afdbe", "value": 2372232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015958, "uuid": "7bc0176a-e50e-4289-a25d-62b02d701443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015958, "uuid": "e761f9a5-15dc-4f32-b618-ebc08a8d7a87", "value": "werwte.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74681d57-643f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781035912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035912, "uuid": "6d5108c0-03ab-42a7-bad6-21fdba6d5e9e", "comment": "Malware payload", "value": "e0fa2f9c53ca30a6eceb0a8940dda727", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035912, "uuid": "0e44a443-4a94-4414-8772-ecd89601b0d1", "comment": "Malware payload", "value": "b21c939fb54dc4d8a37e2fb80395fd6622fba5fa545dd67a74f81473330d7f1f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035912, "uuid": "b3a3850e-90da-4027-b8ca-72e3414e6ea1", "comment": "Malware payload", "value": "2b00f8861b931eee5ea766869e17c1d4e88a774c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035912, "uuid": "72875b48-a18e-45de-84a8-2fba43c73e2a", "comment": "Malware payload", "value": "b3fa0f9e51154cf88dacc5d2d93c7b707ee55de9752d68057ba81de0eb6631d377d25d7a7f310bbc592f1e62bc5a49ff", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035912, "uuid": "63f88bf3-b9c4-4ed2-a9ab-648c81d0a5c1", "value": "T1CAA15DC9139358707CE69C276169C814F6C9B68AEEC14F4490DCF4F9A48CF09BE42AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035912, "uuid": "ed106cb7-8556-4f06-9278-185d2b760c73", "value": "96:IKhEcfEnsTE1O1mj1m580yGoAYQuSsE6e8E:d/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035912, "uuid": "f55c69ac-bb11-4fb1-a223-ed1b648ab883", "value": 5050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035912, "uuid": "5a568cf6-bfc4-49ca-9158-d368415da22c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035912, "uuid": "23d884b0-188b-4838-9ecd-9ea99aba7eb8", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08354a4a-63cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780986338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986338, "uuid": "22106f4f-2ebb-4a7a-8e72-8a5ea7e85733", "comment": "Malware payload (Mirai)", "value": "2082603aa731736137cc20efcf4fc15f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986338, "uuid": "6dfa3ffe-9f80-402e-8415-142030648d5d", "comment": "Malware payload (Mirai)", "value": "b248ca410760484dcd2aed87158b34ee7feec746120d5d336cb762a905a45dfe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986338, "uuid": "49d09a24-0e0f-4b8e-bb2c-4d1c026230e4", "comment": "Malware payload (Mirai)", "value": "9d2cdbce628c8050930b230ab9d8f9c8562f8847", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986338, "uuid": "501a847e-547b-4ddf-84da-b4a915e8c1c1", "comment": "Malware payload (Mirai)", "value": "68bbb2e1fddb51dcc4cd355804fcfd6c674fe50c9df672967149cf3b8bbe929f58383ba49c2dcaeb1e2527e996212d4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986338, "uuid": "5d6c572d-f67c-4325-bd9b-d1a3bec20403", "value": "T18A936CC4F243D5F5EC5301B1A137F7375B32F0A6112AEA53D3699936ECA2501E60ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986338, "uuid": "6c222f59-4849-4fb8-96b7-7928f2700250", "value": "1536:oO5RYspvBzglf8rH1m/QfKSj1cTdpMV6kgp/BfF+SUJIVpo:oKRYspvBzgl0rHc/Qf3j1Y3Mgko/LnDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986338, "uuid": "d889ff9e-79b4-4d75-9ede-f58c6f3e0e15", "value": 93032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986338, "uuid": "367f52b6-4d97-4055-bf98-bac2b0b8311d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986338, "uuid": "513d296d-125b-49af-bf43-4fc570a0bf6f", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d846e3d-6429-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781026398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026398, "uuid": "6d6a6e89-7dca-4123-ac94-46fec6928996", "comment": "Malware payload", "value": "790b4a63409c9df3f0802c232a45bf50", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026398, "uuid": "39855016-d338-4543-9c51-309369410be9", "comment": "Malware payload", "value": "b33e46be97b982ed3defdc711c4571999711780a37083bb8edba674b5cc14e79", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026398, "uuid": "2c9a4c75-3200-4bcb-9d83-df1b00011a48", "comment": "Malware payload", "value": "01301553e8c1c47312f0205cabb22d4d5b2e08e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026398, "uuid": "580a01a8-0498-44a0-9877-c5897e3ef441", "comment": "Malware payload", "value": "ad562dee1447a7ac38eca9de16a7c3e3b64d37e2355b534b2cd680bfda10ee2958879810c690a635dfed46fcf3accbe7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026398, "uuid": "69b5b87a-a9a4-43ba-8e00-11aa6fbaf545", "value": "T1CAD05E36A0C756AA25AC59E32CD42D98606FA80C240488598A67ABD8256365228ADFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026398, "uuid": "643ca6c2-d8f6-4f2a-a33a-e590555adfad", "value": "6:iay2AOzckHHy7nhKIxhVBzcwGivkKLNmeH03n:iQFk9GivkD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781026398, "uuid": "d37c3a8d-0be4-42cc-b05e-fcb8b52f7648", "value": 241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781026398, "uuid": "1a3b2204-d87d-440b-8e11-deb12b9b378e", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026398, "uuid": "171c38a7-c490-463b-8b85-8470a3c04a42", "value": "75.119.132.109_1781026392076802_hello.world_ADd_allow_url_include_3d1_ADd_auto_prepend_file_3dphp_input.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce265b4e-63c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780984093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984093, "uuid": "ff63fd93-18a3-4db8-bff8-98d224e672eb", "comment": "Malware payload (Vidar)", "value": "e509165cb0d640ba8633392c55b83755", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984093, "uuid": "5882673b-1887-4a5f-bf96-a1e256eb040b", "comment": "Malware payload (Vidar)", "value": "b3dca01519f6ea9a4da3b66ffb3aaf3ee57bd4323897a3c343750870c8f74385", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984093, "uuid": "7541d455-7763-4692-9706-da6be166b506", "comment": "Malware payload (Vidar)", "value": "bee5a57fd8ec77bb530973a083a824d2b306b8ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984093, "uuid": "92bdc138-92e2-4d23-90b9-8e7578812965", "comment": "Malware payload (Vidar)", "value": "4d0c776cef0d517c186015b12386c231deadfcc185ce1706c1d6e83167c35d328bd4086e663cb857620ccb4a4b219f62", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984093, "uuid": "87e41531-2444-4d40-a0c8-82e2ee0f7314", "value": "T117F58C4BBDE008B7C0A9523148B25252BB3DFC494B3667D32EA07A3A2E777D5AC75344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984093, "uuid": "f009f439-7f27-452a-95ac-a89af4e05123", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984093, "uuid": "ec835772-5bc1-4ce7-9209-6ac6526e0566", "value": "49152:WT2YOUenoOzFunHxKKWFjWDKph/JU0l63atRM2g0u7+grmcKRz+:Wy6OMoVjIKT/JFcatRPg0u7ZrhCz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780984093, "uuid": "0d83c5df-d38e-4038-8b7b-922920333b40", "value": 3479224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780984093, "uuid": "81882d25-180a-4ce8-b0ef-19498e7f252a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984093, "uuid": "13ae9d83-8cdc-477e-aa52-e3fa53d9458f", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdc4c69-643d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035126, "uuid": "89ab5c8f-b95a-4575-8447-39b5b3ea0855", "comment": "Malware payload (Mirai)", "value": "6c6fe59368a2aabdfd0448a09c3d3bfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035126, "uuid": "9badcdd9-d6d2-45bd-b44c-96698247126b", "comment": "Malware payload (Mirai)", "value": "b400fa98064d92f3b2bacd2784e9a82fa98dfe0d176a2eab1ef050bdd9c2be81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035126, "uuid": "7df027ec-b483-467c-ae8e-81fc45f68eaa", "comment": "Malware payload (Mirai)", "value": "5b196c537bbf1bbfae95e895876a9f968bd409f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035126, "uuid": "0a228f2a-1493-41ad-8508-425793127017", "comment": "Malware payload (Mirai)", "value": "0c0afe3bfd0fe6fb14df6f972f43afd7a0250bf28af02af6a50f037a0170f80523867b429c3475d77e825ed482b0b54f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035126, "uuid": "c76333e2-1367-46a5-ac27-128f5a5094e5", "value": "T16163B65A2E218FEDF76DC73447B74E2167A923C622E1D784D29CE5001FA034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035126, "uuid": "61e2fdd7-de78-400d-b585-57ee0ef9ef50", "value": "1536:exZwvHy+gl35RWwJIA43QTXVneFkMUilF:YCPq35IwW3QTXzMUilF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035126, "uuid": "7666922c-3018-4ca2-b8a6-67b3f10dc4e8", "value": 68416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035126, "uuid": "8577183b-9e4c-469e-a277-f261749eac46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035126, "uuid": "e38521d6-716a-4b53-867c-d9606f120f55", "value": "godisdead.2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a4b72d-63f0-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781002063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002063, "uuid": "2b0b2593-4df6-4126-b861-86b216f785c8", "comment": "Malware payload (ConnectWise)", "value": "d4ccaf073696c70693ea35739b05abcc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002063, "uuid": "506a5945-6668-480c-bcbf-8e65d85ec8fd", "comment": "Malware payload (ConnectWise)", "value": "b5903061132c7f84b061641eade7ad72eeabf3fbd4247162d74065adef622f7f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002063, "uuid": "31259fed-c6f2-45a3-b958-eb7259be4be3", "comment": "Malware payload (ConnectWise)", "value": "9f4beec40e2defbdefb5c6fdb8bc63842ad59ffd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002063, "uuid": "667e616a-5e2e-4716-97fd-5b787f628f74", "comment": "Malware payload (ConnectWise)", "value": "ace2a9255dce3ab0c7edd900d92ccb780140987345bb2bfca5a30336f5b573ce8b83eaa499af4be0b4e1a5c3950f6835", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002063, "uuid": "f755ad52-8b70-44f1-bbaf-1f741a951bf7", "value": "T116836C43B5D18876E9720E3118B1D9B4593FBE110E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002063, "uuid": "b84f3526-87a6-43e5-8225-f1d547e9c427", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002063, "uuid": "55d4eb08-ba7d-48bb-8457-1c7f00065cd2", "value": "1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYj70JI:genkyfPAwiMq0RqRfbaWZJYYjwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781002063, "uuid": "21ddfe95-2a0a-4eb8-90f1-2fdf9d161f17", "value": 83160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781002063, "uuid": "16f113a4-448a-4c89-8e61-5b6fb6a612b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002063, "uuid": "10ad62b9-4a34-46c6-afc0-59d26cb421cd", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081a9dca-63cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780986338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986338, "uuid": "39fa41c9-5c13-44c2-a899-02df21f96fa3", "comment": "Malware payload (Mirai)", "value": "2be13bfd6dc34efe5af63b3c9d839be0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986338, "uuid": "a5382fb9-bf20-49a1-90ba-9f4a76f10d6b", "comment": "Malware payload (Mirai)", "value": "b5c1a652665b005a2aeb0a8dc6aaafd835f55e27a679a80e5f4ea9bf36569b05", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986338, "uuid": "1f61e1d6-77d6-4574-a147-e1ef193c2632", "comment": "Malware payload (Mirai)", "value": "ee7548bc2b8b2f906c702fabe61d3eb43ae21b6b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986338, "uuid": "a58b3778-f5e4-43fa-b46b-a2ec1029f6ab", "comment": "Malware payload (Mirai)", "value": "5cadd6fbbe68563877974ee0f5235a8a16a289512679b460ccd82339b75020581b7ab272b640f6fe93ff588a76fbeaa2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986338, "uuid": "a3ef1bae-e78d-4ccd-a7e2-148100aa9f01", "value": "T11B041A46EA404B13C0D627B9FADF42463333AB5497E773069528AFB43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986338, "uuid": "0d4eee70-2d08-4b22-aa9f-43f395c233b4", "value": "3072:0vlEOIwGiF61K1uTa9nPorjHycsbsL5smUzNopM/RN1L:0tEOI6F6MITa9nPorjS4L5smsapM/RNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986338, "uuid": "0caffdbe-a7bf-4463-917c-60bad5e181b7", "value": 188274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986338, "uuid": "41819fed-dbfe-4329-9b4b-309a242dc780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986338, "uuid": "655b449f-fdcc-4d00-8c37-07f12f2831be", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90f8d16-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "56877bc5-de59-4ec8-b889-6847e89ad484", "comment": "Malware payload (Mirai)", "value": "00441e2c2d013bd938ee75268f28467a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "2d47d7dd-8efc-4296-ae6d-f14d0b4e5be2", "comment": "Malware payload (Mirai)", "value": "b5d674e0ee0286799afc018080dd61ab986437ac9bc549457e9d96bbbf9cdd95", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "a3586f0e-3822-47a7-8751-a505fd919d87", "comment": "Malware payload (Mirai)", "value": "d5dfc5a9f33ca66a7faafdfb7c492bb64f185212", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "52776a4a-df17-4fc0-8daf-71d31b72f019", "comment": "Malware payload (Mirai)", "value": "32485a040cfce35958b0ad39f7849ef89000ecdc86c01556293a2cdd8a422b55950133c7f9afbb2003cec8c3cc996612", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003010, "uuid": "7596ffaf-be49-42ee-a11e-5312a44b10b0", "value": "T1484423E4A5DD2D13E12D0938C09E405E1B03796FB405A21F1936E9B6999F8DFC5FC28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003010, "uuid": "ebc6f803-f823-4aca-bde2-56692590252f", "value": "6144:5dDSbBroiMKrUM5UwaYBGDuFsHCkxx8SzSzIn:5d0cihrUKUvYBGD0sHLxySzS8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003010, "uuid": "3895bb66-6304-4fb2-a3a1-4209313cc8b2", "value": 266500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003010, "uuid": "5701282f-e817-4538-a30f-4bc47dda4655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003010, "uuid": "111e6ce8-c204-487f-98e3-381400a2931a", "value": "3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a409fd-640a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781013037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013037, "uuid": "59a83021-b8b9-442a-a1e7-ca3267843fe7", "comment": "Malware payload (Mirai)", "value": "610012cb3283f6f6a65cb79cbc568f2c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013037, "uuid": "7ef3bf8d-475e-4da8-9376-6b0192682b1d", "comment": "Malware payload (Mirai)", "value": "b61c91545ce49c9751531e8a8043f4aa113550679d5ddc7bb29b451bc4a452d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013037, "uuid": "e603f5ff-4db4-4d14-818f-12098a4b9f1d", "comment": "Malware payload (Mirai)", "value": "8d62c5e10ff1ba8bf514929939cf239eaa13848b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781013037, "uuid": "49443d25-34c7-4694-9a71-43bf08918771", "comment": "Malware payload (Mirai)", "value": "e91e0ef78853bff4a05df6565fa680803e913bb8e37bfedb7843609f9025e6461f3d8c537898184b2e0520d001f1826c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781013037, "uuid": "806fdd54-73ab-4373-838c-1d2eb56464a2", "value": "T120412FCB61924975BEA0ED6B31AE484D33C0A5EB90DFEF645CDC34E4809FE987404697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781013037, "uuid": "b2e5841f-d73a-4406-969c-18cf23916f50", "value": "48:vtwtkt1atItchtPLsft7Atkttjg11JtMttU3CGttdUvpLttmhEqJttn76Zc:vmqvaWGh9LsfRA66qjU3CGjdUvpLjmhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781013037, "uuid": "af10f4b4-2141-420d-82b3-e91f68ac4d0a", "value": 1954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781013037, "uuid": "d2701659-5bda-40e8-a15a-6c12078ec802", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781013037, "uuid": "5b97fc6c-9234-45d0-9df1-10aa0ec3e17e", "value": "Ciabins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434f303e-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "de7b1c44-8aa4-462f-b42b-52166b8b66b4", "comment": "Malware payload (Mirai)", "value": "aec7d04b88d6637ade99cabad2c82d27", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "b1faa4fb-cb28-46b0-acd5-cbbca3a9c022", "comment": "Malware payload (Mirai)", "value": "b69ced4bb7167a06b39d39e8d825881a71cb5a014c13e14b144ebfb0e189051e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "d5e36d53-f985-4fa5-895b-756a3972a89a", "comment": "Malware payload (Mirai)", "value": "e711106a7d4f82c6acb7baa06a2a409401d637d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "e8916bff-4a5e-4368-9bf5-1f60f55b5f11", "comment": "Malware payload (Mirai)", "value": "3a0872259ebec1c7b18d7b0e6c2f59f8b321a22929164b0ff4e5c871ecfa2e7e6e7e84a5dbebec8dd39a7b007cc75e9a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985578, "uuid": "12c8165f-4dd3-411a-b221-a7aa8bc52e1f", "value": "T1C904F806BF520FB7CC6BDD3302E90B0139CCA85B26A52B753274E964F54A58B59E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985578, "uuid": "bb38c7a6-4934-44b4-8150-2e61bcff6cf9", "value": "1536:7F5Rt9x+JnMJpjUaXlI6tqdjpGFYrRnRzM44W+F61KhdZXGyz/hlNPMkta1GFHhz:7XRt9UqJia1LqdjYlF37znPMAaEj9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985578, "uuid": "c416089b-446e-494a-ac6a-865d197237e5", "value": 183032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985578, "uuid": "e6a2665b-fb7a-4b13-b410-f0484f3c5760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985578, "uuid": "e2d160f7-e16a-42fb-afb4-3e871659755f", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c5fb4c-63ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780987545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987545, "uuid": "7d4cf134-06ef-4ef9-8300-fb4f84980543", "comment": "Malware payload", "value": "49c19633d8a24eab63d87d45e44bf3d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987545, "uuid": "98fc475c-1bfe-47bc-bf19-808174db137a", "comment": "Malware payload", "value": "b726c7310e7798308f10df82a26dcd4983eedf914de99cdb4d66a3190b325c40", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987545, "uuid": "7f983386-257b-4911-88e2-1f6535464fc4", "comment": "Malware payload", "value": "eb38fe0568339c502acb7a7ab9f8b71b71f992c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987545, "uuid": "278b1de3-af37-4328-9e1b-6645da0738d9", "comment": "Malware payload", "value": "bc49e65f7fe3120b0a2e9fe9d2da5083396a0907c1ef394cc9ca836f6b4a28ea9fc042b65e694fe9b8cb51d272df8a81", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987545, "uuid": "ad6de383-a182-41e1-8456-f14c7f3131aa", "value": "T19AD533E19D841AF19B926BC9FB7C9661CFD11B07514934E2BACF0A941B7F33792E1202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987545, "uuid": "01c59b1d-da6c-4d3f-a822-e419c3719671", "value": "49152:2M/6zyU33rlPEvfJ/owGozFxZZj0LtHLhxemF22gnPDi:r693rlPefBG4FxDj0LtHGmUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780987545, "uuid": "9ea51e50-2d4d-4aaa-bf01-f8ee498ee0eb", "value": 2877364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780987545, "uuid": "c61c9212-ab4a-43c9-8c6c-2b8039a9d2fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987545, "uuid": "9d2c87bc-0fef-477a-b20a-4d99d99b095f", "value": "tcp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74054cd-642b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781027515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781027515, "uuid": "b3e5e716-3c5c-4a00-9481-3db8b49fbc99", "comment": "Malware payload", "value": "9248efc955d224695fa8b2568e2b7c14", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781027515, "uuid": "5707a26e-be03-4923-973f-9f4eb701cb90", "comment": "Malware payload", "value": "b7e6db2c6c2fc2e452a17b0c2104fadcc4862012fffbcc58acb49a856385d0b9", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781027515, "uuid": "9d8a3099-b8ca-4491-bd10-d0f393d77bfa", "comment": "Malware payload", "value": "8ccb84eedc43360bd7a81d6499ee4b9f007e38da", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781027515, "uuid": "dd38204c-8124-4d84-8e5e-af8900dd8241", "comment": "Malware payload", "value": "6a4367a17d16cf3fbb2468327bb73ea3a50548ad35beb6c014be727f501624e584c7fa83ed3aa7a6d52039f618a3c0a4", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781027515, "uuid": "565db66f-61f8-4ef1-b743-3c55deebc5ff", "value": "T1EB37339183528F62F9DEB53F50A791A1F172F8506723598F5FA802643FAB0E18D3E790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781027515, "uuid": "d60caa0a-81a2-4f31-b16f-4ef634aa638a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781027515, "uuid": "7b309577-18f6-46a3-b6a8-1b4641b57b73", "value": "393216:bOluzPOH9uE0pvcu1MUdq1B7GRCRxOggdHsnOTqiqJ0piWpQw4adw4:SiPHJFp1MUg1wGxUgO2iy0pFmw4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781027515, "uuid": "4bd82a46-254e-4391-81b0-c467f12a614b", "value": 22588846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781027515, "uuid": "3e3f2864-f0a9-4d26-ade6-6c373a2f54c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781027515, "uuid": "ee4feb0a-e516-401d-9427-588c516f89bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a27fc0f-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781016514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016514, "uuid": "1e0ca06c-f6f5-4ddd-ab93-bed1806bfbd3", "comment": "Malware payload (Mirai)", "value": "a270abf84ba4ab891070afa92164b0c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016514, "uuid": "2e24100f-edd0-40c2-84e2-fa651ae00100", "comment": "Malware payload (Mirai)", "value": "b7f2f1cb3589c11d1e87f9057b001a942d67f7705c30f681c5864d64deeba53a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016514, "uuid": "8ab377c8-a485-4626-83d5-33796037c276", "comment": "Malware payload (Mirai)", "value": "23b74191f9796df6e66302eeed059f4b853afa69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016514, "uuid": "082ff544-3d3b-45e7-8963-bd3c00f00524", "comment": "Malware payload (Mirai)", "value": "e3ac3c66eade6d4a42916366d87437c97fab2f618caef00da708e0cf8a120767d1b51376245ce5ba1b9563e992f8f90f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016514, "uuid": "020255f7-d3ef-42e1-b734-27a09740c1bb", "value": "T1B241AA8672F0F15AB594B9A0789047F07681E19110ED362B9FA3E833B5F67F0E2F4642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016514, "uuid": "a510e69d-7211-4a67-9f6c-93bc3b5705dd", "value": "48:q9AxKkCrVANEM5CboZtMUQbwnQWycO2DwD0gacY8:n/5957Zxplk9D0A3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016514, "uuid": "1bbcaa20-7cd8-4371-bdb6-6aee125ae5ff", "value": 2365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016514, "uuid": "7952b031-ad16-4fd3-880c-94c62400dd9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016514, "uuid": "0c32062e-6ca6-4823-bed4-b09914730438", "value": "Sassy.Cloudflare.cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9706171d-6414-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781017502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017502, "uuid": "b68f7f7f-67b6-4e10-adba-6b008632cf8b", "comment": "Malware payload (RemusStealer)", "value": "05954a81f0de918f5316a6eab0dd5bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017502, "uuid": "5b1e514a-c550-4171-9470-2b1b151499aa", "comment": "Malware payload (RemusStealer)", "value": "b80530a828c11ceece0440e08ac3a496e8abc076df4cfa7a6ec652c2fb800558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017502, "uuid": "94fa6de1-ab3d-44be-a1f3-8137b3ad38a3", "comment": "Malware payload (RemusStealer)", "value": "31eb93c2c74520ba0117aca3fbc60005ab468b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017502, "uuid": "587c6e0a-8986-43fe-8c22-afe3cba0e5a3", "comment": "Malware payload (RemusStealer)", "value": "df3a94d2c8350db81bb92df48b9e4bc925d00d1bdb39b626a737421905368b8f88fcc3a5c2609e14f23281642a2f5f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralcoreflux10-lol", "colour": "#3A62D8", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017502, "uuid": "4a3f0b03-8be7-49e0-a553-83c2d56473ba", "value": "T1A524086BD2A331FCD262C0745266A232B733B93D47289EF74293D3359D219C05F79A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017502, "uuid": "afd0c779-d0e7-4f44-91ad-2a2a47ac4f0e", "value": "8b41a1754e41495e9695410df2f316c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017502, "uuid": "870d8e34-d2e3-4cb2-a6b3-cadf75b6c17d", "value": "3072:AEvG46zsRMlwQqS8a7/UymQTrMNTfeAd3PxVv2NLTTkTFqXZlzeqxY3iPlAKEdZT:urVwQGajObeaPxVv2NLTIpezY3iSZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017502, "uuid": "61033a15-5346-4720-8e61-f9803efd6017", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017502, "uuid": "e7cd8d30-82be-43ce-a0d9-c0f82e5211c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017502, "uuid": "f7353f51-ef2d-4814-bd38-d2a778ed58bc", "value": "crz uncrypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4439d6b5-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985580, "uuid": "cf724bd1-f4f7-4a37-9f9c-eecba36ace23", "comment": "Malware payload (Mirai)", "value": "a149192f82f14cb9bdf3d70b54f0a4d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985580, "uuid": "2b12ae84-0209-4f91-9212-452f21c3517c", "comment": "Malware payload (Mirai)", "value": "b8c6a5d0158de7a55d6dcbb66e8c2c69906a059c9dce2bb3be137d285a303343", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985580, "uuid": "fec452d1-584f-4469-a5c4-0ecc5a4a8b63", "comment": "Malware payload (Mirai)", "value": "fcbdd96459d935f2c6928752bd7a2dafaeae2bab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985580, "uuid": "188df05a-a86c-4731-a121-eb78511c3bdb", "comment": "Malware payload (Mirai)", "value": "0305cf53681b5c9891af1469f9876613c72012c2e0a2d951acd8fa951b326331252475c68c7d119ccf8be3801ccbb4bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985580, "uuid": "b2daa468-57f7-49f6-8f3d-122359db0c5b", "value": "T1ADC31863ED169F46C257A0F0A1F24E741F52BDAA49531FBAA872EAE44043CCCF5057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985580, "uuid": "40eb8d5d-c9bc-444d-b899-6a51c4525d92", "value": "1536:CxhC/HcvDVZxmcCSfSVqyzSrgc13qTt9Exd/9i7OCsKUlGHGXA3YN5xWmz5FpTfI:MAvcv1mTQOuHiUhA3QxWa5FNUPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985580, "uuid": "002544c7-92b6-4d6f-a6c4-a981d7c197c2", "value": 122384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985580, "uuid": "512954da-9df2-4403-b685-e6f0548101d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985580, "uuid": "15134fd9-3fcb-4498-a76a-d9e4382313a7", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afeb621-642d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781028058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028058, "uuid": "eee124f8-0ee9-4b54-86c3-e42a4a0831c7", "comment": "Malware payload", "value": "17bb2de6c19221471200c83d4d96b1fe", "object_relation": "md5", "Tag": [ { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028058, "uuid": "58527a80-3a8e-4a3c-896a-9c56e42e4f9f", "comment": "Malware payload", "value": "b9a5bc4338429ec3b3101caf3ec2669824d9e13dd3705dc975449baa77344e45", "object_relation": "sha256", "Tag": [ { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028058, "uuid": "76966e77-c309-4050-b7a1-745db4c01113", "comment": "Malware payload", "value": "39d55bcf3021713608c9d0f49c8c56342fa090ba", "object_relation": "sha1", "Tag": [ { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028058, "uuid": "62fc8248-5a47-463e-8527-6c0e87c1eab7", "comment": "Malware payload", "value": "88c10ec4f03671906c2d39dfba30d0c177be70423219fb1f3863a711cda4c3bd897cd845ae3df14d28ca8f6c05d0158d", "object_relation": "sha3-384", "Tag": [ { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028058, "uuid": "9829c3fe-17f5-4c58-a735-04841c3cddbe", "value": "T15AC34A213457C071D99D9A7E1CA4BBF0476D6920DFA14DE33B841A2B9E306D3AD38D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028058, "uuid": "083b80fb-0492-4ad5-8777-917d20a36008", "value": "41a061f19f2a7afce4f3586f40ee23ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028058, "uuid": "1af67710-bb43-4cd6-b180-647a5dd5776e", "value": "3072:PYOCGInnVo+TOVQET2bGWG6ZoRxgK1v5y5RmVSb:PGVi/8GWPZqoaSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781028058, "uuid": "e2476959-c880-4242-bebe-7e1a0cd25ce2", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781028058, "uuid": "4c3478b6-5914-456f-846f-3fc5bf75672e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028058, "uuid": "7c2a9f87-845a-4c3c-b401-5e62d0a0df9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08c648f-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003049, "uuid": "8588519c-eede-463f-9477-dbf836d0d59e", "comment": "Malware payload (Mirai)", "value": "e4cf78950192afe800ca56d39ec7770d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003049, "uuid": "2c5e0c7c-0cf6-4ce1-80e3-4e0c46f334df", "comment": "Malware payload (Mirai)", "value": "baa22c31c203be3f18f5d448dbb171507cee70db9458787892c082a7d61807a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003049, "uuid": "97d2772a-3a74-47e7-9f3d-ae9283abb37d", "comment": "Malware payload (Mirai)", "value": "600090018652d41dc6904e7aaf5d7419e7724526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003049, "uuid": "d00f216d-401a-45a3-af19-d0f2bff38df8", "comment": "Malware payload (Mirai)", "value": "66eccf45c207ba105f4864db5996e374ffd143fec79225e722d40cd7555d868c32d27be5be63355b17d887a061646cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003049, "uuid": "93eaf16a-ee65-415a-a339-2b93650714f1", "value": "T1E2F46B5377318F94E361D27405F387219AA911A30BE355C6A3BCC2207A50B6DAD6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003049, "uuid": "223302df-528c-41d1-8b2b-7efbc8ebe3fc", "value": "12288:4g6aP/e+LFDFJP/3umvmK446CGD8zB0uT2Dl3Igp1pKCVzJOClss:pZpLJZf446CGD8l0uT2h3MCZkClp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003049, "uuid": "59e51149-bf9e-4a77-a4b6-171c82008170", "value": 793192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003049, "uuid": "def7134e-45d9-4050-996a-078e6b30bacd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003049, "uuid": "369066c6-5e00-4fa5-a9e0-e29b9fedbeb3", "value": "5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ec4273-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1781002761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002761, "uuid": "98ca8ce8-85b9-4cd4-a6b5-fc21d2cc5c71", "comment": "Malware payload (GuLoader)", "value": "95d65fa25280498e23df66f57402deea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002761, "uuid": "c40c492b-741c-4d54-8d97-d85ab3dd9aa1", "comment": "Malware payload (GuLoader)", "value": "bb65b72f7a354c96d0dca93f14f144a7ef2b9d738bf35d8ae5edd9031f1e4247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002761, "uuid": "1f759736-2672-4a63-b86c-f868f3803cf3", "comment": "Malware payload (GuLoader)", "value": "4d77790e63ff1295100667494b93652bf019520c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781002761, "uuid": "46591490-9a05-46e7-8791-34210d390f80", "comment": "Malware payload (GuLoader)", "value": "10ee59ab90cb407c4ad172122ff52f777f480a16d3d014dc3eb1e652dbf5a0a1df6b748877c671a868824dfcba7c64b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002761, "uuid": "d0dabfc8-8903-446e-b067-527bf47d6ee7", "value": "T1AAB412067624E033E5D4BA395F06D2335B887D0066011A7633F2BE8BB67EB335A9E15D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002761, "uuid": "d9168c90-d702-4ea6-9fc1-2994beacf448", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002761, "uuid": "f9bf6487-e31c-49ce-a8ab-6ec3dde11218", "value": "12288:NbaYrw1py2BOKMq7awJfpxWw5EjbJ29tuJV0UFqj/ARr:NbaYrw1Qqr1JfTTSbJcg0UcDARr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781002761, "uuid": "3e863cbc-1148-419d-a433-13bc44dc2f93", "value": 503080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781002761, "uuid": "1bc794f6-5892-45d1-b89b-c7dbedd1036e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781002761, "uuid": "30208c4e-767d-42e0-ad46-87ab9cb218c1", "value": "Invoice0022090525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69d8eb0-63ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781001314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001314, "uuid": "97c9b856-2d5b-4818-becd-e69b6b908f2a", "comment": "Malware payload", "value": "7c9948206cac2eecd1a3678a44d9f17d", "object_relation": "md5", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001314, "uuid": "e8572768-70a1-4996-a7f3-4f2fa362b859", "comment": "Malware payload", "value": "bbbc67f10824a6772863b6f7f7399972b6472e7133bac8f05fa0020d03547a1a", "object_relation": "sha256", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001314, "uuid": "1487c7c6-728d-4fc4-b50c-8aa768a67dff", "comment": "Malware payload", "value": "aa26347da65a43793dc33e0dbb2973838ee4d410", "object_relation": "sha1", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781001314, "uuid": "c406e1c9-22d3-4780-913e-888336d2fdab", "comment": "Malware payload", "value": "b0e1f630270fa3071d751b3b3713ac9c845b49b039ba11319887eee85f7c90f90f6eba9684a644f6c99759a18fb65f13", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001314, "uuid": "2f236e60-0916-48a1-9a9e-f2473f48fc86", "value": "T17233D0FA61C0814349B10C64C7638DF3D51EE0BB549C21BA7E7ADF62AE419C6987A0DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001314, "uuid": "1e3771aa-aa5f-48a2-b1a0-db57067276c8", "value": "768:KzvotTpmoWx7zN+0Tj3ZpAG84fvIikSPPo+yoE0Z5eKD7EjP8g3fzm:KzvsmfNnppAGffAKfv5rU3fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781001314, "uuid": "91004455-68eb-4a60-9b98-adae8f51ef64", "value": 50158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781001314, "uuid": "1d7a09ae-be32-40ba-890f-dc40986a5cc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781001314, "uuid": "1d0ab2c9-9d81-4eeb-b12d-cbbdcaad9d0d", "value": "bbbc67f10824a6772863b6f7f7399972b6472e7133bac8f05fa0020d03547a1a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a851baed-63a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780970286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970286, "uuid": "08b4e737-7e90-4b4f-9cd9-166314b31924", "comment": "Malware payload (Mirai)", "value": "780a8530a01f1a5130006c68d3b23d27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970286, "uuid": "7b821c99-6b8b-4e0c-b8ed-fdb5802c39a5", "comment": "Malware payload (Mirai)", "value": "bc1f71daac9b6515474b2b3d63221ce76065d63de5833c80dd3696f78b0cdf25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970286, "uuid": "64fc129d-2d14-47dd-b249-9168004c98d7", "comment": "Malware payload (Mirai)", "value": "6bf0a9194e1e285282846ccc51d77c06ecbc4615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970286, "uuid": "56e205a4-2a40-4ebc-b257-0060c5d8895d", "comment": "Malware payload (Mirai)", "value": "4df6b4d42ec88aa7a335cb855fe1688ec4c23576d231f7462a8c38a27e09ab4f463d21845cb04fa783110f38b740c631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970286, "uuid": "ebdc8081-8e03-42c7-98cc-b94458827341", "value": "T18E735C89FBC3E0F4DD0705B1116BF77E8734DE121124CE5ADB94BE76AD32602A51A62C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970286, "uuid": "9a8788e7-6b68-4a5c-84b8-9acf8f22ec57", "value": "1536:g6x4arE2VlzRstt21hA5e71CnoStkWMU131fMI1yAg0Jpr:g6xdfRj1hA54S/iFif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780970286, "uuid": "2459a4cb-725b-4899-876b-30d6c841fb5f", "value": 79020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780970286, "uuid": "15de7106-3ec9-4ca8-8332-8185cd454f61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970286, "uuid": "4d343dd7-8f03-48f2-92d1-3f01f50e2572", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d54e80-63e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780996832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996832, "uuid": "b00c41d3-b5b1-4045-8c53-5cee693f5c42", "comment": "Malware payload (Mirai)", "value": "71bdaceb66b906d88aec142f88a2af8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996832, "uuid": "b25bbc37-3d6d-4429-a22b-63fbc710c4b8", "comment": "Malware payload (Mirai)", "value": "bc38bc400ac81f116dd1b7c9cb5eba64acac2a5aa24dabc2334d7c6e57c23429", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996832, "uuid": "df4455c9-349e-4860-aa59-9725f1bcb67b", "comment": "Malware payload (Mirai)", "value": "75df16f2fbf3f626fe5d2f3640883bceab01f904", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996832, "uuid": "e7fd8540-787a-4ed7-93b3-1bdbeec570e9", "comment": "Malware payload (Mirai)", "value": "2386877fc9ed12a43c3deeed3e15dd36cf04db8856adc7fa2510892f1d727ef382e386cbcd59240cffb3db13c27bb11e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996832, "uuid": "6fba8a1b-7d52-4562-bfe2-3e096cc1436d", "value": "T1CE04985A6F228FADF278C73047B74A35976D23D623E1D684D2ACC1142F6025E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996832, "uuid": "f3b1b076-9dda-4e96-8ae0-d1994e4b9216", "value": "3072:99dzthIO3YLfTt5135BkYKVsjClsy0kJjuh3Q+d6M:99dzthIw0fTd5WYqyhkkNQ+IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780996832, "uuid": "ffe56570-6432-49b2-a0ab-12438b16acc0", "value": 181556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780996832, "uuid": "1c175085-9762-4c3e-9dbf-763d17e7bba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996832, "uuid": "28750b03-9c16-421b-9e0c-558288de1417", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5765ee-63dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780993482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993482, "uuid": "ed02e81a-5b23-4a89-b60d-34a8967c87b6", "comment": "Malware payload (Mirai)", "value": "c50949b7aaf0582432457142584f36ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993482, "uuid": "3553baef-a3fc-41f5-8ac4-2af9437b2a07", "comment": "Malware payload (Mirai)", "value": "bd891a97c57ead9344f2f449bbfd6aebc565eccc610c56f333a76f9ca1937d99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993482, "uuid": "2097d087-3539-454d-9136-94c1fab88ca5", "comment": "Malware payload (Mirai)", "value": "280f39c7515a8334c86ce5aec268f9e996c6a501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993482, "uuid": "141c4be7-d150-4147-8b38-6d65892884d5", "comment": "Malware payload (Mirai)", "value": "3b76e4b92a2d689b60255d882a0f44f403af582a26b6640a70e84c4ca0a55a57183addcfe65738debc8a921540ecbf97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993482, "uuid": "88378be1-9abf-4979-9a22-54aab15cc9f3", "value": "T112B31845FC415B27C6C212B7FB4E43897B2A57D8E3EE320399256F20379B96B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993482, "uuid": "49b81a40-d53e-4fed-ba26-edfe1694359c", "value": "1536:605wZL64uH5/2GAZy4Vd6FT9HgSHu5jDdBKdlwTcwywSN51D1hG2wJC0XfJ+OvjO:60PD5/8U4aFZHgS6jjv3QWfX+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780993482, "uuid": "7b18b682-be10-47a1-b576-5ca84c21cd38", "value": 115104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780993482, "uuid": "a3446e41-a7c0-4907-a220-617e6d4514cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993482, "uuid": "8cb1a1f5-f26d-493d-8523-739afe6d2516", "value": "CRY.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a0292a-63a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780971627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971627, "uuid": "133d407a-c076-4a6b-ab43-b2ff3f1b6a44", "comment": "Malware payload (Mirai)", "value": "7e4c6e83049e08fc2fc29ea2ddb72769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971627, "uuid": "aa62116b-7be2-4c33-93ab-ffe60a283ae5", "comment": "Malware payload (Mirai)", "value": "bdde6169c71605a97997024d58b8c90337984f41ff065fa9f1054581d4069c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971627, "uuid": "05cf8737-0800-4785-9242-e60e2db5d8e5", "comment": "Malware payload (Mirai)", "value": "7f199b62db2e8d51cf815c97e8b46bf2444d1c6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971627, "uuid": "5e4d3f22-b81f-4d1d-b5d3-1086c3c529d9", "comment": "Malware payload (Mirai)", "value": "f733e243b3036a5cb08a9bece362081536d52b22ede29aa112153ac38717e0e6d7f2efad77e7cf8817fb4639538f052a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971627, "uuid": "f0328044-79d5-4393-835d-3e90b8feb61f", "value": "T1C743F1B31DEF93FDC756B8B0681AA0D8C7D525019E1B8A0F175970FF842AAC92D01F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971627, "uuid": "8bb3fee7-364c-4ff5-921e-1c1348ad0862", "value": "1536:229JsDtvxeV/ffs/OLl19XGgB7gaZCNizcG9+s1:2/VkV3sI192gB7rZCNAcGp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971627, "uuid": "6424c165-38b1-43b9-94f9-09ab7f95fa88", "value": 55908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971627, "uuid": "d82e3e6d-5d6b-43d1-a4f4-e1839c57709b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971627, "uuid": "b2be6ed9-6499-4318-b14c-f8212c6f27e9", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc77010-63ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780973597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973597, "uuid": "06ea2ae1-9de7-4dee-a13d-40c267929a4d", "comment": "Malware payload (Mirai)", "value": "07448c19d606d1f3a2ca87c40185faac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973597, "uuid": "01f092f8-f110-4254-a36d-c12ceeb06e02", "comment": "Malware payload (Mirai)", "value": "be8b5afa4457c9591428053ab065d9290ae16c257cf95507eaae239c722e9866", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973597, "uuid": "82746d96-f377-4390-bd2d-983fbc4c0b7b", "comment": "Malware payload (Mirai)", "value": "374eccc0872686e2d500497f06a52c770aa5010c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973597, "uuid": "0bfa8a96-4437-4f3a-b6b5-ce89eb33cd18", "comment": "Malware payload (Mirai)", "value": "bb32cfbeb3cba27d9e2c328221d1ddb56950cd234ff2455cfe1f3a49861d3e095024ddb326fac6ae82b98749e820f2f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973597, "uuid": "540df49f-d0ef-45a5-ac2c-0ef180ccc704", "value": "T1EA73188578869A1AC6D0537BFA0E43CD372573D8E2CE3203CD619F6176CA92F1DAB191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973597, "uuid": "281ad43e-62da-4b4e-a856-abdbb4e01427", "value": "768:w8XP/urX5fu5X8o27o3MoMPo+l5Zz70ba2cmGcwB7yxqLNIKmmIsqeknu1StVTHS:dXuZaGDFXUaxXlpywLWKggID/gP/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780973597, "uuid": "0f042d1d-fa89-4b7d-bd81-899c6715cb09", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780973597, "uuid": "3a8ad28d-9048-4544-a9e1-c90718203302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973597, "uuid": "1bd0b69b-d870-413f-b689-37ffafbe2e84", "value": "azsxd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bf94ea-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985846, "uuid": "c9ed6ef5-5472-4227-8193-146f444df878", "comment": "Malware payload (ConnectWise)", "value": "e75e2de95193e503510ba887ee406922", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985846, "uuid": "4037dbc2-0ee9-4963-bbaf-fee880b13f05", "comment": "Malware payload (ConnectWise)", "value": "c0c746714331f6d6d51cb868d8bed66bfebb8106b63d4074b3ad6c23b77a533d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985846, "uuid": "037e9768-aa3f-4405-a29c-dbf9220a8ebb", "comment": "Malware payload (ConnectWise)", "value": "0e09510894ddf3a5cd0841e23b1e93d69b7dee6e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985846, "uuid": "c1d9456d-b70f-4044-834a-f44669de6f39", "comment": "Malware payload (ConnectWise)", "value": "4168575f64a95c1f96c6e2c269aedf252585b793c07fe575a2f2705e96e0f1ef70d3f024ad69f056d834df546fa81076", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985846, "uuid": "3ebd43a0-37eb-44d9-b441-f5d6473ad1a4", "value": "T129646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985846, "uuid": "6a6e555a-c4bb-4b45-90e1-01a4ca5fa321", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985846, "uuid": "24becd27-6e18-4cec-a212-ccca77bf136a", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9T:h1iw7gryNkSV1hy1Z1u2JLu9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985846, "uuid": "87595ae9-6687-4d4f-af5d-1bf1eeb291b5", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985846, "uuid": "78fd8609-49ba-49ce-bef1-3a5276f6de01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985846, "uuid": "f048e0b7-2d81-459b-9e12-b812a4640888", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67f2784-6440-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781036452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036452, "uuid": "2f65abff-bc73-49d4-8941-cb63e0d4af37", "comment": "Malware payload (Mirai)", "value": "ef77022255dea2bebacebf6248af4410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036452, "uuid": "19f184fb-d07a-4c2e-a278-1ecfc9e3961f", "comment": "Malware payload (Mirai)", "value": "c0fae9b0a558065e0245026ab5386bc383db4dc9e040c5cd0f90875822ac70bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036452, "uuid": "4b55baa8-5e4d-4753-b6e2-dc2277170a65", "comment": "Malware payload (Mirai)", "value": "bad31876f9b1caadd0aeb56b3ed0cdc510ca278c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036452, "uuid": "8b731472-fbf3-4250-90d2-f282eb6a9f43", "comment": "Malware payload (Mirai)", "value": "484204c767cd7deafaae97192cf87ece71c9104b4a3f098c07d38a3403a24672e7ca62b21594dba5cedd3c5d5cc9542c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036452, "uuid": "c23937e4-0b66-4192-9d0d-9f4a99525cba", "value": "T15FE36CC5F743C0F5E91B01B03066E7369A72E439102BFE97D7A9AE32EC93511961A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036452, "uuid": "f678961f-1daa-4bfc-a8c7-4e84937f5e19", "value": "3072:qwpENeJRmsegpLvsZkhLBDnwI0Pq8vQwZ1WY6pi523oaGmYdjZGWqmk:tpENeJwsegVvgkhLBDwIqq8vQwsNKj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781036452, "uuid": "c7d4eb22-b3a8-45cf-863b-e4dc3f59755c", "value": 154216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781036452, "uuid": "65fefd21-41c2-4fac-8b3d-fec8a02c7260", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036452, "uuid": "6fa9507e-4aab-47a0-bb9a-a21cef079846", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca93ecd8-63a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780971202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971202, "uuid": "a00c4eef-8b4b-45e4-845d-10b94bb97f3b", "comment": "Malware payload (Mirai)", "value": "1a9a2351834c4eb88cf0c9e46bc4d5c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971202, "uuid": "0bc4c0c2-e7c7-4bcf-acef-788db24a5719", "comment": "Malware payload (Mirai)", "value": "c1584b66afb8e687bdba42fd13feb767d6cc4c9706309f3de10fe6ab195a06d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971202, "uuid": "5d47c8b5-b0c3-4dac-9c5f-9d7b7f54e55f", "comment": "Malware payload (Mirai)", "value": "6893357d78ed307b52e85ca382aa40384e22f850", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971202, "uuid": "30966dca-2909-46c1-80a5-3fe517a160d2", "comment": "Malware payload (Mirai)", "value": "eed19baa99576a22185792fe8eac1e1e73e5f058835c05995f9fa91ac797f8750d86dbcaf3909dfb20c2c4a5f360ec4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971202, "uuid": "6670aee8-b379-4ab5-8830-955deebe3b64", "value": "T175633BD6E801AD3CFC4EE6BEC1554B09F931736899530A3B9262FCB31C321E45EA6E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971202, "uuid": "0be18f89-9c46-4c2d-9365-634b95458d18", "value": "1536:sfEU8x74k5Gy99F1bzRc3o8UiL5ERrX7W6:XckpR6fL8rrW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971202, "uuid": "7a8e821b-0b75-467b-8af0-4aabb99142ae", "value": 67588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971202, "uuid": "afd13147-02d5-4094-9cb8-e2d9f11d2286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971202, "uuid": "7aa1b83c-63e7-4369-aa86-77a0175d9aca", "value": "azsxd.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206e8fc0-640e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781014726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014726, "uuid": "a65e3132-4ad8-493f-b11f-1e8cd58c9ea6", "comment": "Malware payload", "value": "64dc1037e18be58e65e005f8c8e4e89a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014726, "uuid": "b0e05a42-7e65-4ed0-a59b-bfa368f15592", "comment": "Malware payload", "value": "c1676bb8161ef4a5497268fad85402cf7f1caadf8d6acad3a9d39f62ecf80d1f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014726, "uuid": "1bb80bde-967c-4716-bc18-12c92fd1cacd", "comment": "Malware payload", "value": "fe5cb934613a28bb7cf7c3085beda19d33bb73ea", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014726, "uuid": "cdd9a2cf-4c00-46bd-bbac-3f8442b49548", "comment": "Malware payload", "value": "e5a2b8f65bd10b9c6ecdc089b5d9a671a2d62981ba4a6c4db24e13db9634fa1fb27bb3346040891376f8496a93e00535", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781014726, "uuid": "6be9161b-9e79-447d-8bb1-7c477f2474d2", "value": "T11A01AFCEC005DB9441C5E4AD23D7A444B850C3CB254A8FB9BE6C587ECBB5A087059FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781014726, "uuid": "c1e7ebe1-a28b-4851-a0d2-84f669c5ab60", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkacNFIPwSIh5G/8I4X3InaoFOIOAX:kXCKysE2hi0ziQvZohawUm5S8znMaVUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781014726, "uuid": "f681d7a9-4f44-400f-b8f3-972e554c49f2", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781014726, "uuid": "7e3c7257-0598-4eff-bb86-054ac7f3d6de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781014726, "uuid": "de370fd6-a5fe-47fa-aa7a-041c9c4f8c23", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427a2471-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985577, "uuid": "6018875e-db12-4830-a0e7-75c4bf49fc66", "comment": "Malware payload (Mirai)", "value": "d7f823527e05b1b246fc518890d1def3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985577, "uuid": "7766b99c-117f-4b1a-9e13-f7b0366c8554", "comment": "Malware payload (Mirai)", "value": "c35fdc75fa5c958ef5a217a9de324dae13b7c7637bcd5c21c14c2e920ebb7ab4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985577, "uuid": "a0278d13-e3ed-4280-bdf1-70fad1331df5", "comment": "Malware payload (Mirai)", "value": "3fe3a6e212a97c057066a9b85a52847a05d6ca42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985577, "uuid": "677e15cb-6955-42eb-8f66-ccd55e9ecdd6", "comment": "Malware payload (Mirai)", "value": "747ebdf60c0f5328d39db63298cbdc67233a36661907f337d59fb2b7cefa7fa221fb3d24c9006ef510d85c298840d326", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985577, "uuid": "3a556f1c-40c9-4e73-89d7-bbace15d7a04", "value": "T182D3E746BD418F13C5C321F7FB9E469C3B1A6BA9D6EB7102A8217FA037864D70D36611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985577, "uuid": "0b96c30a-e784-41f3-ba60-f8191a97c4a3", "value": "3072:5KQuWWTN8YvrZK4CvjAoLZEOMsGzvplL:5Krpzg4C7Ao1EOXGzvplL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985577, "uuid": "4a6da3af-bc05-4768-bd9a-9fcf12edad78", "value": 138708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985577, "uuid": "62074d52-65ed-4acc-b145-ade1c9c493e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985577, "uuid": "2da1bcd9-b4ad-48a0-beb8-753b602d2186", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fe9344-63a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780970707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970707, "uuid": "454b801a-b3bd-49b7-a83c-a6d7dfc53b80", "comment": "Malware payload", "value": "c2788f4f047c7ad00913b2b8aee028e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970707, "uuid": "4a2bdd68-33fd-4949-ba55-465a10100a9c", "comment": "Malware payload", "value": "c3f07c63ec4443e86c1d2d89778238d0664adeb3c7865c17582b96f3fdae71b5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970707, "uuid": "f3feaa93-64b7-4eb0-820c-bc93eaaaa4f8", "comment": "Malware payload", "value": "ecd2dfbd611fc1d287484b4aee18f8c7c81f44af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780970707, "uuid": "07708010-9e06-4e2e-8481-18e70de9d2ec", "comment": "Malware payload", "value": "2c6dcce37fb967965f9433906561e773d74660726d5667a2030d02127b53b21f023c0edad5114232f9ea1ddc0d9adc40", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970707, "uuid": "f3aff0ca-0d54-4cac-b57f-3b90e4e88249", "value": "T1EB01AFCEC216D66041D5F89D72D762807411C3CB16464BA47F9C443EDBAEB58B156F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970707, "uuid": "c548121d-dac4-446f-b35d-3f93ff86e575", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaAIv2sIRQBPXI4QBusRIx9BgIk9UauD:kXCKysE2hi0ziQvZohaAclpXC746xO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780970707, "uuid": "0161b03f-3f2b-4b53-9d19-b8e2642da7df", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780970707, "uuid": "bd65ad5f-4439-4964-9449-eca8c73985d4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780970707, "uuid": "69e5995d-704e-44cc-852b-1e52415482d5", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351693db-6417-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1781018626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018626, "uuid": "bf3696a8-c018-4bbc-927a-037861280f49", "comment": "Malware payload (DarkTortilla)", "value": "8b23cdf28beb8dd0fad20a6b7c4c8bab", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018626, "uuid": "22fc7dd1-05ac-422e-96a2-2aebaca50480", "comment": "Malware payload (DarkTortilla)", "value": "c42684eccc16352eda0fbcaa11ba149b9ff8b021dc88e646e1bba76c619858d8", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018626, "uuid": "5b47ddba-b8cf-4f38-ab23-a19d9f570c76", "comment": "Malware payload (DarkTortilla)", "value": "abba38b8b58e84a62bfc3a9c4ee7a635e0019c56", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781018626, "uuid": "781fba5a-c4be-4598-bc57-aed2d26e5c17", "comment": "Malware payload (DarkTortilla)", "value": "1fa08d5b6e033e90a92862faf1cbfe67f4c81d98473c16d0534b7c69c9b409fcca5516df446885f7798bd63de74892c6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018626, "uuid": "3fe42f39-95b3-4fa4-aa09-eafecd8a2017", "value": "T1D365F1165DC32BA4C2BD5FB4C26A189823F0D8579396E7AB2FD802F8DB6374ACD07451", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018626, "uuid": "17787e2c-0bbf-439d-acb9-63152473e968", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018626, "uuid": "0b81f627-e324-42c1-8d9c-448006bbf333", "value": "24576:Or7a/tXeT5ySthrvVA5mtjOvUWOCsb6qYd2Yo:Ov8Ow0rvdCOx6qkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781018626, "uuid": "901b8bb6-e7d5-4de7-a8c2-673368ffc443", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781018626, "uuid": "37421305-a7ac-43d5-85f8-4a6c23cc1ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781018626, "uuid": "818cb53b-131c-4cc5-ab56-dbdb2bba184a", "value": "Nueva orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6e2a47-63cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780986052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986052, "uuid": "b02c0e52-a4a6-4799-beed-a25153bcf492", "comment": "Malware payload (Gafgyt)", "value": "fde0e8d5364660d949e54ee2953150f8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986052, "uuid": "212394c7-07f5-4b3b-a329-2abdf45f1ac7", "comment": "Malware payload (Gafgyt)", "value": "c48fdf8873bb19fc06b79fa0ab32ff3b2dc0c5804c98787d29361c2a5b5ad660", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986052, "uuid": "b02b513d-7122-4894-a94b-7adc89c18e5f", "comment": "Malware payload (Gafgyt)", "value": "5c7310d7653d40bd0d9d12870594b1d2322128cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986052, "uuid": "587ee953-eed6-47c4-92be-8131c85ffd93", "comment": "Malware payload (Gafgyt)", "value": "aea33de143d7c2418ad553e9452ab6a9ea7ee92b479a64acaa84cc097edb8ccf299b4481f57c7203b536ad2714c1bd9c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986052, "uuid": "0369c091-8bae-47c2-a9c4-9f81c1e21bf6", "value": "T15F2160C651E21A76EC669D37747A4CD930C4F48A10E5FF4468ED38E5008DE9BF081B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986052, "uuid": "f27af352-3948-4512-8b2d-5cca169deaec", "value": "12:q0Fw8RV3sbV7aW0Fw8/ofvo0Fw8LYDX0Fw8i2fX0Fw8YzB+xX0Fw8lHO0Fw8RNIk:vwAw6IJwBIwUswDVjwwLw0NI4mkswHKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986052, "uuid": "df67dc29-4e0c-4715-a96c-477cd777a24a", "value": 1130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986052, "uuid": "2d6f85a0-e40e-4183-8675-471c6d6a3900", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986052, "uuid": "0bbf89bf-71b5-436d-b636-5299a08668aa", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675a4fd2-63cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Sliver)", "timestamp": 1780987786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987786, "uuid": "cf6a28c8-9477-4eb4-bb2d-e979fa81b847", "comment": "Malware payload (Sliver)", "value": "a1a01af029caf193ca58748715f6dcf3", "object_relation": "md5", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987786, "uuid": "56a452dd-d800-4620-9f76-a0169f77fbed", "comment": "Malware payload (Sliver)", "value": "c53d7da58ab93cf0e8aef8e76d81220cf8e0fd387e85914e09da5c6fba8de60e", "object_relation": "sha256", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987786, "uuid": "9f38d2c2-0b83-4961-8e05-03babf196ada", "comment": "Malware payload (Sliver)", "value": "fa4f7df24f1fca9fd175f6f2e4400f526c4ac330", "object_relation": "sha1", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987786, "uuid": "868a7a5d-3aa5-421d-a154-e33a120cb45f", "comment": "Malware payload (Sliver)", "value": "b2025631fe9cd13239ca7c21c30c3bfb33bdcc7466f531dc4ff9e49bf1014b5177ebf33591b3ea266e663f51ead751c3", "object_relation": "sha3-384", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987786, "uuid": "0956936b-597a-48a5-8364-ea7a805f5b56", "value": "T1FF0612C76A72DE27F68C70F6D528F9768D4CBE610CF7B54259F8B99E043A8524F100A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987786, "uuid": "462774d1-e41e-48eb-a724-318ed6529ef6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987786, "uuid": "8550bd17-a361-4d30-acbc-dfdd0cd16384", "value": "98304:qh3RlY0og+2MNsnEFuVGJccwEN64OojtufAeR5Fr:qh33Y0mjjwVGCiNBkftF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780987786, "uuid": "05d434e7-a26b-4b37-a2f9-abb8e3d3b1cc", "value": 3843584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780987786, "uuid": "7243ad3d-3dc9-4207-9bfc-1e825a98e6eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987786, "uuid": "5112ed7a-f340-44ae-96b0-cd75fa8c5a65", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51bade7-63da-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780992749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992749, "uuid": "338b7d55-7ddd-4647-87cd-1312d5f84f7f", "comment": "Malware payload (Mirai)", "value": "ea6fdeff3fac409e37acc9abe0732561", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992749, "uuid": "65d1cbca-7d11-453e-950d-a41645030bfc", "comment": "Malware payload (Mirai)", "value": "c581f7eb7dd8daea280d8d2f3b6133e231ff56f8e117c4d322a376dfe45d4b5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992749, "uuid": "11ea8ad0-26ea-463c-ad98-75bb1f9108e8", "comment": "Malware payload (Mirai)", "value": "15c87acf4906045c651539e53aaf139f1e1a40de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992749, "uuid": "9475ed75-33fb-49a3-8f2b-f3201f62fdbe", "comment": "Malware payload (Mirai)", "value": "fccf9f7f2d58f54eedf056596166e31dd3c0631d38e2b98df68808ab955928a104622743fd29ce88799185a6d0c438fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992749, "uuid": "6c37aa3e-80eb-491d-a39e-03b8e63fa9ac", "value": "T12AC32905B31C0943D2632EF03A3F2BE1D7AF9AC121A4E640355FAA89A1B2D375946DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992749, "uuid": "2078c577-2e93-485c-a7ed-dfb92c5b06ca", "value": "1536:sJoL5UKFE9IXxZbxiFOcy5n6froEiTVgvAKeQrOfkC5qn4yCIfLqO+h/:sJM5UPsx1DCreT3K04lh+h/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992749, "uuid": "93c59749-6df4-4b90-b4c8-fad9f2589f0f", "value": 118904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992749, "uuid": "c3a58be4-c3a1-42a7-8e17-bc152f6efe68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992749, "uuid": "46292ef3-6cb0-4125-b9e4-c9e51b6731a8", "value": "CRY.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc459a1d-63af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780974212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974212, "uuid": "bd162ef0-ad6e-471c-a244-1090372b0291", "comment": "Malware payload", "value": "9396f05d4e4db457a45d5833e1964b07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974212, "uuid": "d1ea16a4-359f-4f9b-aa6f-5888b9836921", "comment": "Malware payload", "value": "c71e597cdbee5b424da1c63dbacf3bec8c5a1218cd03290aa95d95f3c746a042", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974212, "uuid": "6070748b-6585-4547-b654-aa5bda11248d", "comment": "Malware payload", "value": "966be18202f9d22af920db4866c28d84146482df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780974212, "uuid": "e01230e2-5616-411d-9439-b0742b248189", "comment": "Malware payload", "value": "b905420f9cc2eacf604dcb23cf7e5d3caf1dc899e17b7e4361b36e941ceb35e56af0bc2e6acd075887d4a149c2e9e38d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974212, "uuid": "8644c030-9122-4780-bfaf-b2b7bc9eb998", "value": "T173C34AB3CC256E68C624E5B4B0708FB92F63A960554B4FBE15B7C2789043D8DFA053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974212, "uuid": "2c24d1dd-d4c3-4091-b11a-2f14e2846d74", "value": "1536:A1h9vi4jj4vqxECcLKCYnV7uHsfQ+o/5JydqWtZb2s9AFSkX5v5:uzv5oOEyCGEeQ+ohYkWXb5AkkXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780974212, "uuid": "af7d02eb-fadf-41b3-97cc-9fbb65763f5f", "value": 119480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780974212, "uuid": "a24dab97-5fcf-4b8e-885a-1e02353620b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780974212, "uuid": "97349835-ee19-46cc-81e6-c89c0805ac79", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677545d1-63db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780992940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992940, "uuid": "31886732-0b5c-40f2-8b4a-26631afe4bbb", "comment": "Malware payload (Mirai)", "value": "cd371e6692f43fa963cffc5fdd1ee3d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992940, "uuid": "b5c8d8c0-5988-4151-8a00-fa732a6dda67", "comment": "Malware payload (Mirai)", "value": "c7a759b1524c1e91fa1b67cc4cbe0d5f18ad83704b6dc461e5fd1d3ba7959bcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992940, "uuid": "3d3e9184-2cf9-4d53-8512-19a03e86f2ee", "comment": "Malware payload (Mirai)", "value": "c1be2de1b2845846ada54bee2edceb617d89e426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992940, "uuid": "204a38d0-7e08-452d-982b-313f96d80740", "comment": "Malware payload (Mirai)", "value": "c9b4442c04775e7e516a35cf17ac10d341955328b7b7e6484578be6e9f16d3840312092c4425a0cfd657fe4d8a50ce75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992940, "uuid": "e16d61bc-868b-4d14-9102-b6d57cd1c908", "value": "T168435C02BDB93B13C0E1B53A11BB8B6272912BD91684D24EBE710D5FBF212942D17EF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992940, "uuid": "9aa6a2ee-256a-4fbb-9f04-5d98e46817aa", "value": "1536:/6HieDkrcihZuUkEHdMqsdBQV8o5cQPNG+:/sZXJly/4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992940, "uuid": "ac6bcf36-8b9b-4078-8aae-006a7a0e74ea", "value": 56352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992940, "uuid": "50229910-a81e-4416-90c1-aecec78c0bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992940, "uuid": "4022843f-838c-423b-a2e3-e63479493604", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45285236-643c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781034544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034544, "uuid": "f4fbabab-1568-4200-be3a-f94d2a504686", "comment": "Malware payload (Mirai)", "value": "0035f1ba68bda0704d3c2cf627fa4dff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034544, "uuid": "7beef4c3-689c-475c-9ad0-1cec4705c053", "comment": "Malware payload (Mirai)", "value": "c7ab0d251c14f2caac2265830ecedcd9626e3fbbc0d88bf51fc48fc473139ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034544, "uuid": "18bab7ff-4b96-45e3-8cfb-23518436cf02", "comment": "Malware payload (Mirai)", "value": "643076e5156f5ee467b378c8664e3e04158d6663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034544, "uuid": "1297f275-5e20-4d50-af36-d7cfd4ef0dcd", "comment": "Malware payload (Mirai)", "value": "6bcbd2483a6dd60331784f1c7f11aad721da7b16552c03340387dd58032281dc4f4c2e262aea53248e1f844867abb6d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034544, "uuid": "5810f740-f07e-44bd-bebe-4dd287a678e0", "value": "T1F08313909A9052CFCAD9DE3C7B9EBB57F1F802E368569B400A155CC5D0C816763F9131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034544, "uuid": "17217a3f-0237-4cae-9097-0f1bc1d71ffd", "value": "1536:IgzXl3YcuYCtzMXDrLbwWH60n1OjN0rV2Nv1hrsVd8yB6UuAZX+Ov7OzfEOeR/1O:fzZYF6z/Xn8jicv1lsVIy+SOzDeRXOH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781034544, "uuid": "5fd098b1-90be-4c0c-8200-76549f087e55", "value": 86344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781034544, "uuid": "992234f6-95bc-4bac-89cc-f82f53048f74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034544, "uuid": "a756b96d-0bdf-41a3-bfc1-cbaaccec5a90", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5693604a-6414-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781017393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017393, "uuid": "9e8e01c0-33a6-4701-94f7-be655b6b4407", "comment": "Malware payload (ACRStealer)", "value": "ca71bcf03e10490df2f36a1cf082da98", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017393, "uuid": "9b05e8a4-8435-4d11-b03a-c03aad0556b9", "comment": "Malware payload (ACRStealer)", "value": "c925d40f07f21bd55de00c498fef9baf6d95e1ed666ff4fc8fce57ee6ef3915c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017393, "uuid": "2d8af0ce-5f5f-40ed-ae8d-78f782a7e287", "comment": "Malware payload (ACRStealer)", "value": "6344547c6eb9c51a17cfee77b73bdd7428d07dd8", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781017393, "uuid": "d63b9fe2-8dbb-4e4d-bccf-8695c0bb9d40", "comment": "Malware payload (ACRStealer)", "value": "493a6d540adeb2c9afc23f50beefc5ec1f3a2565756b3a7f9ba6c427026f635998c083806df6ba3488b9bcefbc3b7e4c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017393, "uuid": "64ead3b6-46c6-4da9-a673-ed22d58a746e", "value": "T113C65A2024D86607FD7ADFBD89DC76540F7AB2953722FE289B4109ED0FD1B49CA025A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017393, "uuid": "af666a5f-5029-40af-9d3b-95ba03c04f6f", "value": "196608:UpoJPz1QUfGYb+zsMRfmB8w2UiewtBHRMN:eUfGYizsMpvw2cOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781017393, "uuid": "dc52956d-678c-43f0-b0e9-62e8d43ead10", "value": 11507712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781017393, "uuid": "52345a0e-466a-4ea2-bc8f-c10607a2f662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781017393, "uuid": "f93f645f-729a-48b3-9c3f-e5b5bff36ab5", "value": "U1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a803af-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780979618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979618, "uuid": "24b80520-832c-474f-b547-e7ebdbd9a741", "comment": "Malware payload (Mirai)", "value": "be0bf33b2eb5bfc602730e755df8ea83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979618, "uuid": "ea95fcb8-254a-482e-ba82-12e770f91b57", "comment": "Malware payload (Mirai)", "value": "c95bc6321807f5ee2976696e2affc14aec9808bfc3ade9bda084c43032bdebed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979618, "uuid": "272f0d29-b16e-490b-ae15-98b7004de6c2", "comment": "Malware payload (Mirai)", "value": "0945329e32d2e62feafc7395c35e6ef2149faa9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979618, "uuid": "552d450f-3eab-4996-8ac4-f2e653bcf00f", "comment": "Malware payload (Mirai)", "value": "2d08269779a877476234be2b2ea1144f2d3e293d34c20bdc988954b558693873cd433e2ed76f41b4737812c757c4975e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979618, "uuid": "61ecf59d-df11-445f-b46f-95d8e2e5e970", "value": "T10E136AC5EA43E5B1FC6211B6213797238A76E53A153CEB42C7652434EC93A10E72F3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979618, "uuid": "fd1a1d18-327c-4470-8886-30e2ae3e0f06", "value": "768:hfIKORD0psZQey18F7THoDPX/FOu4aAwrx8uYSicI7d:h2RD0psZQeio83FvdlrxYSici", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979618, "uuid": "2e2b8e58-74cf-4e8a-a9ba-c9efc29316a5", "value": 42092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979618, "uuid": "d1cea7aa-e387-42dd-8228-92f0cd06363f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979618, "uuid": "132054a4-c2aa-4bcf-aca2-29b01d5118ea", "value": "1.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016a70d2-6449-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781040014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040014, "uuid": "0f1b0a66-697e-438f-bcff-2304ccdc1453", "comment": "Malware payload (Mirai)", "value": "f9c6bdac91e57d39769616ec63b8d076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040014, "uuid": "6e3d1d68-5861-493e-a999-6fb79f41f0cf", "comment": "Malware payload (Mirai)", "value": "c9cba6112c73bd56fc11ff9d0ab1070e3e55de850461360f90d7b7af5ee3ebdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040014, "uuid": "e537b81e-8b74-43cf-9f2f-4eff7cbae7c2", "comment": "Malware payload (Mirai)", "value": "78a975289f058247caf43e9fbd2be5493740da1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040014, "uuid": "0c3a6b31-10db-40a6-a01a-7c94cea11de3", "comment": "Malware payload (Mirai)", "value": "bf5b2804558d90a6aa9bd6eaa3e658f2c8b9c916d5dda1249addd29a21a72ab497e2e08bfd7c961e3981300a7ece1829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040014, "uuid": "f7c4d551-3a23-4abc-9785-f5863ae6912a", "value": "T1C48301E0A36D84E0C3716377E6B7C6DB4FCE4A3A8069E6A41E10B20CF9D597445687CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040014, "uuid": "db2d3394-70ae-4e89-a8ed-6fffe1432fc7", "value": "1536:6e3Rj82PhWrVn8Hh6DEQ4YbOba+fR6WnoTGejwEuCJ9j2vf9yxmovLm:35fleEQWl0WnoT58GIfQwyLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781040014, "uuid": "95114029-6f50-4d04-8ac3-262dadb8d6a1", "value": 81520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781040014, "uuid": "7e5ca36a-8a59-48e7-b7f8-a9abe9a8011a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040014, "uuid": "b313e60e-56ed-4585-b40d-a938374940ec", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f4304e-643d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035009, "uuid": "b240ada5-0dab-4556-abfc-cf6a50f8a21c", "comment": "Malware payload (Mirai)", "value": "f7c9939356741ae85c5fae978ec5481f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035009, "uuid": "3f962cce-d86b-445d-b120-784a1f8042f3", "comment": "Malware payload (Mirai)", "value": "c9e0d10bcc05964059de82ef58cc63296d1e75276c6b12f52da5cb36f69a0639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035009, "uuid": "70310fff-35bb-4411-9b01-228cdddb5ca4", "comment": "Malware payload (Mirai)", "value": "f2372e79da67c678c28d723660ec5a8a297ce3cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035009, "uuid": "056c2e50-b844-42d1-9248-6be16d1e5543", "comment": "Malware payload (Mirai)", "value": "dd6ee6d6b32969b8b260d706d250b1655a2c16ac83c4f0ad4107fe068edea662ca1ae00e399b83bd20199c802cf6b01d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035009, "uuid": "92996fa4-b263-43a5-adb6-981b07482fbb", "value": "T1B5135CA3CE3A2D18D2A98579B0251B799773D465C1571FAA447AC33AC003EEDF44A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035009, "uuid": "bc6e6244-dc1c-4210-aa79-cd3bce73dffa", "value": "768:d0wIJaHedxarmTX5iq5OnKCrCVZ7ca9N/o15H7nUCD0VpdfXmXKI:ddI8HedDTJp5cKCrC77/9NQ1BnUCDMQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035009, "uuid": "638822f0-56e4-4ba5-99b4-2d3298de7509", "value": 43584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035009, "uuid": "cf78d2b6-d6cf-496e-839b-34dc2569b95d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035009, "uuid": "24db1347-f1eb-4393-a697-b96813567109", "value": "godisdead.11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff630ff-63b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780978003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780978003, "uuid": "796e1c9e-1ffd-484d-be91-c89511b24130", "comment": "Malware payload (Vidar)", "value": "3cd5127b728793f264e13f177f3bc696", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780978003, "uuid": "52e6c88f-5422-4656-ac74-07ef03a04b3a", "comment": "Malware payload (Vidar)", "value": "c9fe647b22294464fc0d66007f1963cf9756606478d0d5138a85bfd5e4da975d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780978003, "uuid": "2362917e-b170-457f-b4d6-45617c336f35", "comment": "Malware payload (Vidar)", "value": "c869b3c0c594aff56dd3028989713c5f301ae14d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780978003, "uuid": "88698ee6-9b07-4f43-bdc4-888257e452c1", "comment": "Malware payload (Vidar)", "value": "f52917b21e0eb567e3750f5173ea81cf9ba6efb3c2a57bbeae10654a3e304b4a3e737ae86f3344d30114bc8f052af6ca", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780978003, "uuid": "913b6508-3dbd-415d-b19a-476fc8a78912", "value": "T1D1366B076DE04AEAD86953328EE25292B777BC190F2133C72E60A37C2E736D41D76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780978003, "uuid": "2d23b79b-71d2-4574-a59e-c0ee19bc8251", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780978003, "uuid": "c191bfd1-12e2-4705-81b4-7188bee767cb", "value": "49152:J4Cz1xq04n679qvzOCm2C9Nn6k/4w5+vUn44:JZk0gggkpUvU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780978003, "uuid": "814534b4-2bad-4f46-86e5-8fabd320f910", "value": 5026464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780978003, "uuid": "eea2770c-c2d3-40a8-97d4-f2a15aec8634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780978003, "uuid": "ecfe9f63-e5b6-4014-9ae7-043026c228bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868b4fea-643c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781034654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034654, "uuid": "1ba9b1cc-eb45-4dca-92a1-d7e5f861a62d", "comment": "Malware payload (Mirai)", "value": "72ed63b66bd18ceb09793ed7148b81a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034654, "uuid": "441dd65e-3012-493c-8ba6-6bc4c6f1b7ea", "comment": "Malware payload (Mirai)", "value": "cbd34b141bfe94d1984e9c427736c05098d24ea6a6fb3ffbf0ff42e02e5bb27a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034654, "uuid": "9db04cb7-bce2-4c53-a28e-8b54f55855eb", "comment": "Malware payload (Mirai)", "value": "ea60e14c99aa5373898913d9c8cd0288e72149d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034654, "uuid": "61ae19e8-73a2-4818-a709-adc782109309", "comment": "Malware payload (Mirai)", "value": "3f2287de0e3191167f652a3643e6340a1bd288f555cdf8405550909a07be5e4296a3af098c3b005ad613cae1bfd51f85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034654, "uuid": "eef6e737-b9c1-49a7-a285-ef44bdb29aa0", "value": "T19663A50AEB654EF7EC6FCD3706B9070135CC951A11A93B393974C82CB65E54B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034654, "uuid": "b62fe26a-bc4f-48ae-af38-8d1d887d3587", "value": "1536:78a07+JccgprTOldudVU5Zqwmo2dCUsMkY1:7O7+X4rlM5N1MkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781034654, "uuid": "6903f023-b7b8-4eba-83dc-b52da3aba150", "value": 68928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781034654, "uuid": "03b90ab2-1ec8-44ea-9a9e-3a0dc0b89a1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034654, "uuid": "73a38ae9-5c7b-4e18-8aec-f683e586a7a2", "value": "godisdead.3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855f42d2-642e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781028639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028639, "uuid": "fd073608-901f-405b-92bb-c7effd028262", "comment": "Malware payload", "value": "ce39855edd899c4efc2d67bc53829183", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028639, "uuid": "2b114d3f-827e-4924-bd95-7efbcda6f5fc", "comment": "Malware payload", "value": "cc85b0eba36b19d3ca7e5c41fb8723ecdeb1fa058760854b960b987a5eef5f25", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028639, "uuid": "a66fdc87-8fcb-400d-97be-4c85f66d4c03", "comment": "Malware payload", "value": "6a0167ea19c2a3187c82eb3084f9b2fb3b9e9095", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028639, "uuid": "03c46665-465a-4918-9c54-cbf86c43402e", "comment": "Malware payload", "value": "3acc404e82e64e59210c52105dadd6fce6f6e3fa3c6f89ee522a50141a729ff5d39af85089540662e3b94bfc1e145c3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028639, "uuid": "fc905ac3-50c9-4c0a-b779-a0f89e10fcc3", "value": "T1A8D2B4CA3BC2F8705722E43F392BB0A7E52A5C84B7094295FB35B0A9F95C328C574759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028639, "uuid": "5c569484-9b65-40ab-a2b4-b8efda232b86", "value": "384:TpWdqAVuBkg2/jRHQ7qk00jsm9dw4+LiFbvHT0UUwr5+5qSFb0COIBiLEhC74PO:Tpa7uBcNHkqk0wBfwyN0ycxF4TN774G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781028639, "uuid": "ab481233-e535-4a34-b058-f42b035af67c", "value": 31117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781028639, "uuid": "cc323ec9-8005-40e0-9f33-ffc69f82715e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028639, "uuid": "02f84667-18c3-414c-a9a0-587ba1de5202", "value": "ADVANTEK - HAIL & GHASHA - \u8a62\u50f9\u55ae - \u7522\u54c1\u958b\u767c\u9805\u76ee (PKG 1) - GOP03260803-01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1514e50-63ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780972985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972985, "uuid": "83305c7d-6de0-43a7-a6fe-22d8a1be113b", "comment": "Malware payload (Mirai)", "value": "113dbfcd7b717ab216b5d2e5bbff3685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972985, "uuid": "cc663b9f-988d-4a33-8c4f-1096241eb19d", "comment": "Malware payload (Mirai)", "value": "ccbee4fa9a38c4f523fbde4a71e5b66d0a016931fe91e9abbce964f5b1390bfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972985, "uuid": "c5af638c-d904-49e0-8992-34b726bc1943", "comment": "Malware payload (Mirai)", "value": "7af22ebf3663750545511590f46f96be0a4eced6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972985, "uuid": "47a35077-5549-496e-8ced-9b5c7110f192", "comment": "Malware payload (Mirai)", "value": "071a0819474c729fe7f2bf2d8b3bda183df050d372df3fefe836f53f07c21cee4ebbae96b5a3ccf3fbce4ed3b1722fb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972985, "uuid": "2ca64f5f-ad73-4b7d-ab0a-9231e85ee598", "value": "T14AE3814CEE64AB3DC3E332FEE75902CE336A1B98B7E670219D314A5537C8B95A535120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972985, "uuid": "a64fefeb-167f-4850-8bbe-e633fc58733e", "value": "3072:+HvhA6gdpQPNfceNSi2qVqyD7MM9FRuwGfVn4goZcxBZPKXysok3:RyNGM9FvaqgoZcxBdKz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780972985, "uuid": "0d019b22-9e72-405d-9f4e-72e0dc595bbd", "value": 143760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780972985, "uuid": "687bae9a-dff6-4d9b-af83-a9eab4a7de85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972985, "uuid": "0126a70f-88f0-497c-b4a6-114b4365e3bc", "value": "azsxd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dae8e44-63e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997568, "uuid": "5263aebf-da2b-4c66-961c-9b935fd54abb", "comment": "Malware payload (Mirai)", "value": "efe50d91265ba99f3cdb2a03fa85ff0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997568, "uuid": "01d4c8a1-cd90-4345-8bf5-8ab40ac79bc7", "comment": "Malware payload (Mirai)", "value": "ce7d31abba5c710b3d7e2274536725d2211a720aee03d4ca5f66723feeb65f00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997568, "uuid": "3628087c-fb4a-45bb-ae70-806002c927c9", "comment": "Malware payload (Mirai)", "value": "d493cf1821bb4ba498435e02b18dc9ffa55bc357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997568, "uuid": "ef57fa24-cf57-4a06-bf5f-5a04864887b7", "comment": "Malware payload (Mirai)", "value": "5a3f64c02487c7f17b54ed44f16684bc10285b8fb25521107f11d3aa47bc150ed7125554c041b97f6260bf744a41199c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997568, "uuid": "fdb92edc-e1cb-4403-9814-71d8202db2b6", "value": "T123C33A17B4D180FDC4DAC2748FEEAA26DD33B4AD1234B11B27D8AA721E49E311F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997568, "uuid": "4b77beee-daa5-4c91-9056-7f3138c6ab53", "value": "3072:mLImZHLpEmZwzIAfuJHusD+wan8dQ5ZsUZWEW:2FEx8P+znHJcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997568, "uuid": "cf744cef-ee5b-4e43-9e0b-6289b4a805e5", "value": 126264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997568, "uuid": "378ed13e-8b55-490a-b3b5-25fa0ee569ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997568, "uuid": "f86e614f-2d58-4926-a059-03b5cccd05dd", "value": "CRY.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2443fbcc-63e3-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780996264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996264, "uuid": "c706870c-206a-4665-b534-387bf7ed9ba4", "comment": "Malware payload (PureLogsStealer)", "value": "0cb10ef1da21b22298935b2320bf5d92", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996264, "uuid": "43818705-1f3b-4168-a612-361fa42ac2b1", "comment": "Malware payload (PureLogsStealer)", "value": "cef42618c684a86091d21e8b3e7a406fa030b64596b84cf3e13f9c26e46c0fcb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996264, "uuid": "4f39b702-e552-438b-b9db-0f979f317606", "comment": "Malware payload (PureLogsStealer)", "value": "e263f06e6b325b8c62d2131b7e656be31f06837e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996264, "uuid": "760a8aec-3604-4fd0-af43-d1afa2ee0878", "comment": "Malware payload (PureLogsStealer)", "value": "c8d62cfd0a9f820b9c85b723e1168ff89da1a3fb9634be714efe7f4fbb0d11c09f8af5286df2aa615e3681287b2b3340", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996264, "uuid": "f8720616-a7aa-4854-b67b-246a3699b382", "value": "T1AC05EA3DDD64423EE132D618C59A081FF8A1298B522CEE5720C2375F5EA384677D37AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996264, "uuid": "d158fa91-2593-4615-b691-00185a86b65f", "value": "3072:vrmmSuMdYiwL8qHEpFglvqZojlZXUsSb2QK0obGVOj0A5jdkJN+V85ysZGPHZljr:tLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780996264, "uuid": "0bcda59c-f377-4a67-9eb0-8627e6f33d7c", "value": 856854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780996264, "uuid": "71cbccaa-afb1-4265-ab88-934541f25c3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996264, "uuid": "2e844450-9778-4661-b67d-2f3d99512d1a", "value": "Shipping documents Order No. 1010036193.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c8f07d-63d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991433, "uuid": "f2a76861-de9f-4fda-b5d3-d9f1f2ea3995", "comment": "Malware payload (Mirai)", "value": "e7a7dd4286f75293c7c36a5c373f533b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991433, "uuid": "7849bbc8-f628-40b2-bf39-827157692931", "comment": "Malware payload (Mirai)", "value": "cfc983388408019184a7cb14da7673398572c0f3a1f52e4248775f3f22553e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991433, "uuid": "193449c3-296c-439a-8e1f-0148bba6ba7c", "comment": "Malware payload (Mirai)", "value": "0e18698d2b3e929466f3977921b35728250a2747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991433, "uuid": "17b25f5f-d116-4a38-9ede-bdd1e51e2c5a", "comment": "Malware payload (Mirai)", "value": "3c78c1270971f6adfc7ad82e0e9b5a32137042f4ca78c50b61e35b076db89b380da8108d70e851f0c1147f4a661a5517", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991433, "uuid": "fe2b0ccd-f1ac-488f-bbd1-4e3e560ea505", "value": "T1E5C30A527D419F13C6C321F6FBEE42483B136B78D7EA3102E9257F91278B8DA0E26651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991433, "uuid": "dda50fb5-b35d-4ae5-ac93-bb697a84cacd", "value": "3072:jd2KJiEDBHT5mEO0oRF0xB/cug5ZcpHX:XBHT5NO0A0xB/vdpHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991433, "uuid": "78d43fc3-c00b-4252-aa94-33c8aee71eff", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991433, "uuid": "a3934fcb-402e-4678-8a76-e0acef7c6078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991433, "uuid": "5c014853-d501-4467-b333-9a2cb9041941", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593dc0b6-63dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780993776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993776, "uuid": "f8646fca-4f7e-4166-a6cd-bcc50431674e", "comment": "Malware payload (Mirai)", "value": "222782c6f0cddabf8dbd1b6f05d34c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993776, "uuid": "942bac8a-5cdc-474c-8a64-246b4dac954b", "comment": "Malware payload (Mirai)", "value": "d00a5e9da30b117b9a44f04607263ffe603634024bfdca9668452fa55b56480c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993776, "uuid": "2b247e9f-881b-42ab-885f-8cf30acf1bd8", "comment": "Malware payload (Mirai)", "value": "c7a454525e5c7ec4cf71bd949e98d3284fd7f4c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993776, "uuid": "cef93f54-61c7-4843-ba71-4c6854daeaaa", "comment": "Malware payload (Mirai)", "value": "248be15014fe7fcf3bf0579da61f9dc10bee9e9413908ea9c6413f80814318ad27cc61c8de3d045d3d050a0383a4ccde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993776, "uuid": "db0df0b2-f17a-4353-b3e0-33f1dc86211c", "value": "T1DE43021D146942DDFCF240B053780BC83A9E0F90E7569DE569A973A786C6A20314FAF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993776, "uuid": "9cd66014-d5a1-4bee-8631-f2c411fbbf3b", "value": "1536:Z4wY44RWMH4PNKo2UK/MWNzZCD44RQjWu7rY7UVJuS:Z7YlRWJMZ/MWNzk4e/u7rwUVQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780993776, "uuid": "20db41dd-dab0-422d-8dec-1e43a01557fe", "value": 56680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780993776, "uuid": "0edc12e3-b73f-44f7-955d-504bd8f7e903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993776, "uuid": "01956afb-4fec-47bb-83d3-31b95304927c", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8871a9-63b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780976492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780976492, "uuid": "af2c11a1-5af2-4b09-b908-a3b97aa143a9", "comment": "Malware payload (Formbook)", "value": "05180dfe4d0d2c9ec409047a5989d6b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780976492, "uuid": "796b5f8e-dc41-4ca1-b1ec-91c8a16cbfda", "comment": "Malware payload (Formbook)", "value": "d033dea68104929b63fcbb271e71a88213a28c0859fffb7586f2aed596e669ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780976492, "uuid": "11e9dc79-899b-415b-9cd6-b3b2228f5f07", "comment": "Malware payload (Formbook)", "value": "73730e52656d9337b3158107de8519afab35703e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780976492, "uuid": "33d7628c-12b4-44d3-bd27-15eb2d9ad5f2", "comment": "Malware payload (Formbook)", "value": "5af44ff28bc6bb7e04ed1b4d3421e1126e3b68931f962df30f0c075471bbf13c2c7e78b66880cfd466fd3fcd61f1c351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780976492, "uuid": "2d447e29-9586-42af-8d2d-cc8b95e04aed", "value": "T19435026C2A59CB07C9555B385EB2F2B902AD6DEE7500E3179FE97DFBB936B004C00192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780976492, "uuid": "308d02ad-ed27-476c-a43b-2686074145f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780976492, "uuid": "48890742-586e-43bc-b7c6-f75cb851f3e6", "value": "24576:p1lzGX0kZb+NwZnhmM2LsI54wHXvrkAYN:pA16NwZnULjVYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780976492, "uuid": "f7ec1d6c-35c7-48bd-8296-ce84297d4cc7", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780976492, "uuid": "8e9c181a-d518-420a-be39-752028d6b832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780976492, "uuid": "19a72230-2745-4585-9d70-a8d9c843e51e", "value": "Vessel_Particulars_Appointment_Letterpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858d3420-6440-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781036370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036370, "uuid": "33bbcb28-9cc6-4aaf-b6a5-eeb245e94ec8", "comment": "Malware payload (Mirai)", "value": "e5ced51dac82aa2dad61614e6efc8bb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036370, "uuid": "c8da2183-fd6d-4747-af7d-c5433a279ce2", "comment": "Malware payload (Mirai)", "value": "d2178fa4591ca2e7c06059c2266564a3f89188886e490fba4694ba06b81477cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036370, "uuid": "7feabdc1-90d2-4a4f-aad1-e36da2deb7c4", "comment": "Malware payload (Mirai)", "value": "e7eb92e5fa4fd77b56cb3aacdb3a5e7a4ce01c3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036370, "uuid": "9a6e5b9c-b0ac-495b-b754-54913895c2bb", "comment": "Malware payload (Mirai)", "value": "3c501c046a132b496b79ebd901aaa973bc2cdc462722a2c7a3ad88a172745a875a0a62161911b78a92e9f4f0a6503a74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036370, "uuid": "1e038bc4-2053-4505-9072-6f5cb408615f", "value": "T197B32CA6B400DC7DF817D27780570B15F230A3E40F522B27B26BF963DA791B86867E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036370, "uuid": "e966b567-ea7c-449d-8468-4406e6e51555", "value": "1536:SNIwTp36Aq3EFJqJD+KyP4nRqa8/9cHAftAS8JSaLc9YOaFucujAfebd:SBTp3Zq3HJhnRqqYtl8QwJFuc+AfQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781036370, "uuid": "88a60119-4e1d-4be4-b935-a335a791b6c1", "value": 110820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781036370, "uuid": "bc1118b2-a78c-48ca-9530-aef2ab4dce1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036370, "uuid": "3eac273e-3446-4b47-ae17-2895b76edee3", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d503663-63fd-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781007607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781007607, "uuid": "4458f789-5339-4f21-814c-186e80e895e5", "comment": "Malware payload (NanoCore)", "value": "52a57f6e422c9f23cb31a0237957088d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781007607, "uuid": "a49db8c2-9052-434d-a08b-211d8f810f6f", "comment": "Malware payload (NanoCore)", "value": "d31fad07d10c0419ec6ad833dc57df08d673910a3cfa08dc17970dd13dac3e5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781007607, "uuid": "163a33d0-a369-4109-bc97-ea7cac7278b6", "comment": "Malware payload (NanoCore)", "value": "745473f816b9e2d1869af81758e269a52f2fe7ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781007607, "uuid": "ad487a18-bb27-43aa-a563-87a72022bc9b", "comment": "Malware payload (NanoCore)", "value": "cb1355ca946f4925c9a80681ffa9d827a59379c62213bdcfa5de633c1081a93f9f1c068a1a19d7ff127e1cae0a88685d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781007607, "uuid": "a75b4bca-57ba-49e5-82ed-cb4a9d8e6a23", "value": "T1BF14D0567BA88A2FE2CE8679712211429779C2E3D8D3F3DE28E455B75F163E4060B0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781007607, "uuid": "d389a82f-ac71-4a01-9913-dbd528983c8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781007607, "uuid": "d393bee2-2525-42e9-a41c-6e3db9606c7a", "value": "6144:ULV6Bta6dtJmakIM5w2B/XMekQlD/7W6Qyf0w:ULV6Btpmk8ZXxVpQyf0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781007607, "uuid": "9abfb6dd-6241-4bf4-b22a-4dfb6de5acb5", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781007607, "uuid": "8dcc2592-7b3e-4ca4-a759-d31379fe5846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781007607, "uuid": "b50c040e-2b10-4c04-b3d0-3c796b0a391a", "value": "u888hk.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f15a44-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985826, "uuid": "70cd948f-c552-4488-a386-61f7578cadc7", "comment": "Malware payload (ConnectWise)", "value": "5262ef080afd7a4e14d22cf5d647c55d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985826, "uuid": "58bf7e85-9611-405b-91ec-ccbb558f20ce", "comment": "Malware payload (ConnectWise)", "value": "d3707cde4df9985e5471ad6febc1c9eb53e42f9a8970b979949a4a47805bc2e8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985826, "uuid": "54050997-9bc8-4e3c-9e5d-bd54da388922", "comment": "Malware payload (ConnectWise)", "value": "26743b57aa8a0fabcba4d69a37f1a956544595d8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985826, "uuid": "14583878-a69c-42d5-93bd-2f542feefae8", "comment": "Malware payload (ConnectWise)", "value": "f1eb7beab27db91bd89503496ae7dd2302c22cf7a0572788d66f015f1f2d04d6b9c9ee2780c3b2240de3bc7a9b307c74", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985826, "uuid": "f5caa7fd-9ff4-45ee-b098-e2f3319b6c31", "value": "T124836C43B5D18476E9720E3118B1D9B4593FBD210E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985826, "uuid": "cfbb5304-b194-4a37-85e3-f89e97fb740f", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985826, "uuid": "a0c9d726-d625-421f-a33c-621ee9b26b6e", "value": "1536:qxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYv7nJ:4enkyfPAwiMq0RqRfbaWZJYYvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985826, "uuid": "da7b3308-4aaf-4ff5-b11d-5d151bcad8b7", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985826, "uuid": "e6454771-01b7-46f7-948e-f61a4c85f41b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985826, "uuid": "ae4b5315-b833-4f29-a3b0-3413a40af8d2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950fbe73-6430-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781029524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029524, "uuid": "770afa27-d1e2-477a-b05b-14665deb382e", "comment": "Malware payload (RemcosRAT)", "value": "46fa256c27be6fcd001ea475c76d5126", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029524, "uuid": "67463c9c-a58e-4ef2-a471-615a2d8d473d", "comment": "Malware payload (RemcosRAT)", "value": "d4020dace8c676003a00eec5225aa921d0edc522e6ffb3f0c5ece54fc119b9ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029524, "uuid": "76918de3-5652-4c42-b7de-f24a187397fa", "comment": "Malware payload (RemcosRAT)", "value": "c0b45edfa3fccc4064a115e122b38bc77492279b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029524, "uuid": "76749482-112c-46de-a4d3-da3d76936461", "comment": "Malware payload (RemcosRAT)", "value": "cb1b17b9bc44b03df3bbfce05a939a318aff4abc91ab86042d6a4ef74e3c15a14ae675a047954f87fe020c15163bed42", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029524, "uuid": "ac89890a-c140-4acd-8aa2-d85ed394842c", "value": "T1F5C57E10A046D9CC8F1470FAB7EF34489E58BDA53D400C6E3906BBA66E797C6B277934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029524, "uuid": "ae569ed8-a59b-4a85-ba4d-6533c303ea63", "value": "48:IzT7rcl7vkjvkZVLM3JvkMiVEmQWqikDed4T5VeeaVlUebikHJeEkHRJbFvtrBkB:IzTJ4wksWChij9nqcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029524, "uuid": "afe9bd04-c66d-4c02-9a9a-4e6f9d922b66", "value": 2697367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029524, "uuid": "758cce7d-0105-430e-a1c2-bc1b929f7f2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029524, "uuid": "eb3416d3-e4a4-46ba-a19d-3994c0c374e7", "value": "JSsde01_PaulingIndustries,pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa3aeb9-6428-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781026259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026259, "uuid": "529990fe-9c69-4866-897f-a0bc55bcf6b8", "comment": "Malware payload", "value": "56f2f488ae6739eb3cab62313f99b700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026259, "uuid": "999206b3-f38f-4c05-a221-7e11ad77df8d", "comment": "Malware payload", "value": "d47171cf3d26f453facd143e4cd7b496fcf75376a677633dc109f05ea2a91c73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026259, "uuid": "b8c3fa5e-9e78-4020-8b76-a7168885a3ff", "comment": "Malware payload", "value": "e8921a307de56db3889d6f2fba2fe06d2df644c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026259, "uuid": "c7df72f6-9289-43ab-8e5e-14bf4123cf77", "comment": "Malware payload", "value": "d8970696439a6e1ea9edff40ba8a43763ae2eef900259ac962e47b82d86c172c763c319acce134ece24efe78b13dd568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026259, "uuid": "fa0dae71-c6e9-4360-8b78-eadc83dfea95", "value": "T132D68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026259, "uuid": "be6e08d4-f11b-4c6f-b7de-b8a36d1bb6ec", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQI:cqYUQuVDt0TZE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781026259, "uuid": "4e0c1183-9adf-4799-9059-800d65f64b40", "value": 13697024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781026259, "uuid": "964a39eb-56aa-431a-96be-2944e1819ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026259, "uuid": "a3294120-7cae-4b16-aff9-af817dfc8067", "value": "d47171cf3d26f453facd143e4cd7b496fcf75376a677633dc109f05ea2a91c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6961e4-63e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997678, "uuid": "270cf9c6-fc67-4b03-992a-19ff32a6bb4a", "comment": "Malware payload (Mirai)", "value": "34571822da7178bdd111bca9c9b0faf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997678, "uuid": "fb38b54e-7b16-4c93-b6e7-bf72908b6f34", "comment": "Malware payload (Mirai)", "value": "d53ea6091d6771f9f0213e72c8c75b15ac09fc81aaa021a77e9a96d912df112f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997678, "uuid": "8339c6a4-705d-4caf-9e35-7b4b259a8c1c", "comment": "Malware payload (Mirai)", "value": "70703f1e96df39e1b5eed15366104832fcc04848", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997678, "uuid": "593c2ee2-a7c5-4c91-bced-8c7da4c50dc2", "comment": "Malware payload (Mirai)", "value": "f878ad05f270d9ee25bbcca49c18692dfb76be800f769750bae900acebfb6048e9a355aab10acaa11d59d03c19f3e479", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997678, "uuid": "273f591b-4923-472c-af41-30a51ae15690", "value": "T1B2937B8FF24B5490C46286F01BCB9FCE3E6322A19E1794E73D2D167A18B51DB1D06F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997678, "uuid": "56528fed-d621-4929-abcd-c3a0d191592e", "value": "1536:qohWGvSRNQN9S8fLauQMXMwNbgdR6T1RNuzghqt/LWe:3WGvSRNQN9S8fLaLKHp8R6pRNgghqtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997678, "uuid": "4b552041-b8b0-49fd-80ed-80dafbc75db4", "value": 91420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997678, "uuid": "e367ea9a-4f14-49ba-841f-9e1f09e7628f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997678, "uuid": "bd6f9625-f402-40cb-8701-3df1faaf3b85", "value": "CRY.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d03be0-6447-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781039248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039248, "uuid": "a9a99d00-6917-4e64-9035-b688082adf5a", "comment": "Malware payload (Mirai)", "value": "9233228747feba60a161fde6be0f4d45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039248, "uuid": "84cbc054-f207-413a-9125-7a4d4df8122b", "comment": "Malware payload (Mirai)", "value": "d82aa654aac887d8f21bfaa55a5818c6b9dac67a097c0ad7dbf51d94b27087c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039248, "uuid": "d3d0bdf7-7a31-4bc0-ab7d-f582a3d20177", "comment": "Malware payload (Mirai)", "value": "6afdccdb1a086ba952685e453ddea4d15f76dafd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039248, "uuid": "62618f7a-fae2-4888-9d5d-a394c1cc3ff1", "comment": "Malware payload (Mirai)", "value": "96ca75d6c14dfba3dfe20206155676f60a5a1ba005f2374b8d8ac313a5bfcdb94a563eed173433c4faa8343dc564fe32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039248, "uuid": "2a319c86-8194-4460-8abd-30f3de035cd1", "value": "T1D9D3190ABF711FFBE46FDD3306AA0709259C590622A53B353674D81CF61A28F5AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039248, "uuid": "61fd54ef-1451-4976-9898-66dba9c4c739", "value": "1536:qALzhOYLB6xAp9LD6BiBXSDlWXxLbQhyofDd8b8IXa5fMoO95aqyhAexR5NvN3Z9:q+zFXBXSDAlrW3F7bJizYp9b4PXf0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781039248, "uuid": "59b518ee-c525-4f24-b4bd-2fe18b5ec868", "value": 135364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781039248, "uuid": "ba144432-8639-49a3-bbb7-326aed00e7d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039248, "uuid": "fef78188-e8e8-4c47-81dd-5a34a218fd0c", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7836b9d-6444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781038172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781038172, "uuid": "b62cf31a-e01a-4168-9d8c-5908f9820f88", "comment": "Malware payload (Mirai)", "value": "009a881e1c4efbf2e626d4eb7408573d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781038172, "uuid": "48ec83bd-3baf-4048-8006-09e760cbefc1", "comment": "Malware payload (Mirai)", "value": "d942a886ed33cd8f71334f80f8027c9046f8a14d7a9af0d705d9a6b38a7c31aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781038172, "uuid": "37be08d3-701e-4389-9d23-e44661912102", "comment": "Malware payload (Mirai)", "value": "572d5443a1ab8ac7407c5f01934da7f982435d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781038172, "uuid": "e55c6550-d0e4-47e1-bae2-57ac1392d137", "comment": "Malware payload (Mirai)", "value": "6435fa3169b3caa2fb2ffd70db510c73cf09e7592d53749f9484f3d370130394aa6781065c8de6c3247e9ae86a00f2eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781038172, "uuid": "ecd1cd63-5775-4c20-888a-245e404f88c1", "value": "T1FBA33A41BC82561AC2D4637BB96E568C33A653F8C2DF7127D9128B21778A92F0E77F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781038172, "uuid": "df6a1253-5678-4f60-aff6-5c896b579f91", "value": "3072:T1WFR+jGexAgzWcKE/Xai49eMp1xyXQo6maz8:T1WFRbeLzVKE/m1xyAoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781038172, "uuid": "1cc80b7b-7510-4c0c-ac01-9dfc6ca629fd", "value": 102704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781038172, "uuid": "07e064db-56c7-4a5e-9bd6-ca4c7a8179a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781038172, "uuid": "b8408e43-ee49-4eb3-a946-1f7306ca1db6", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb913128-6411-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781016274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016274, "uuid": "12e9c215-b5c8-47ea-8b27-abf7b23cda56", "comment": "Malware payload", "value": "2837ea2a8a3a3590d46257ffe2074207", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016274, "uuid": "2c7493af-e3fc-44ef-b169-7af7e9ddc940", "comment": "Malware payload", "value": "d9438ca11e609be2045b683c3d9c428cc983801aa5bac2b26c74a1d47f951446", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016274, "uuid": "483a35dd-939e-4ace-bb6c-b8b5e8339216", "comment": "Malware payload", "value": "7a03d5a0b593ba07229ae9abf369453ab90e5196", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016274, "uuid": "71c24539-74e1-4c95-829d-353a0a7ebe20", "comment": "Malware payload", "value": "333ff53acdf348b425eed02a217ad7f1ffb63ddab62a850136281d2e4f9aa2bca23edd51feee68a95060d68a5ee84a7b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016274, "uuid": "21f4b6ad-42f6-4f34-bdcd-df441db27234", "value": "T1AE137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016274, "uuid": "39f81b3c-43fd-4e2f-adf8-1b82e86558c9", "value": "768:0+v9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:0+Ico", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016274, "uuid": "9cd8c3a4-88dd-47ec-9d25-9c4694bfbcd5", "value": 45497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016274, "uuid": "c2a53ccb-9fd5-4f5a-8db2-8a1ef9714618", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016274, "uuid": "abb68bcb-6e0a-4bf9-8543-19a2dac62641", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eede6d8-63af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780973948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973948, "uuid": "b2db7d78-1a2e-48fc-9dd2-84088d0a750f", "comment": "Malware payload", "value": "59cff3ae8dcb39b17fe48183bbcd5193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973948, "uuid": "582ca00c-667f-4fea-bc6d-fa1821ed0b7c", "comment": "Malware payload", "value": "d9c41a70124c5dfbd375ea84b51b573691b768ac9e79b9b29e9dc606d0ba71f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973948, "uuid": "ac9037eb-17a4-40c9-84d4-ccdf921b42a5", "comment": "Malware payload", "value": "4478dd918931865f8439163d1ea2e36e0f4cd242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780973948, "uuid": "dea9d01d-fbf7-4c94-814b-c8c7a3305b27", "comment": "Malware payload", "value": "76eff92a8d853762dcbe83479f70d61234ca1d8dd3475ee023810b94c5ca76ba640aa59db8fa030fb4a249be64adee2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973948, "uuid": "71ceba70-9a91-4a35-8cda-c599938df182", "value": "T1E9A3830F2E654F7DFB6E873847B79E329246239616D1C140D15CF9022F6424EB81FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973948, "uuid": "96dffcb1-d7e1-41b4-b9d8-d98adeeaadba", "value": "1536:FTHGGGWJhYVXn9AoR6UkkrWE6UiHD/+DWAJFc5RN7wk1DM91S6BBx7V3cmp:FHJhQ9CE6UiH7O1S6BBx71cmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780973948, "uuid": "af3e2503-cd19-400a-a362-6470c84b9b6c", "value": 97932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780973948, "uuid": "958032f5-b879-4a7c-8775-8ea1ebe1c1aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780973948, "uuid": "bc014f18-e8c3-4569-8033-f3843b69a973", "value": "azsxd.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fae5e87-643c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1781034642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034642, "uuid": "1ce28c6d-f0ad-4b0f-8e81-378a3aa30a27", "comment": "Malware payload (Gh0stRAT)", "value": "b0d543cc9e8af8a27ec8c929fd818a16", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034642, "uuid": "1b880c88-3790-42dc-9bbf-e37afa49bd1e", "comment": "Malware payload (Gh0stRAT)", "value": "d9d07a5ef476e789d4c7abadfa120bdfe55e11b529ead26492da3925d6399614", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034642, "uuid": "e7b66d43-ecd6-4131-b582-02b6301d2ef7", "comment": "Malware payload (Gh0stRAT)", "value": "9b9aba54edb04f4777ac17296cef435bced29bd3", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781034642, "uuid": "4fa753c3-db0c-4d3b-af9b-50d7a2043a8d", "comment": "Malware payload (Gh0stRAT)", "value": "0e77d59b7cd5d14f8ca46904d08d071b023c678005f9ee3d563cfac9384241003775a11d390e5cc31e8ccf30720df9e2", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034642, "uuid": "8835097e-4f4d-482e-932f-d9bc33544b86", "value": "T1F43733554E6F6A8E70FF678322DA334F411F91765C00E39BAD199EE5ECC88886C21D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034642, "uuid": "804cdd40-7313-4d71-8bb1-e5a55a520179", "value": "393216:sufJzgg+GHAYSRQBJdQAi/B8gZChW8594mJeS4cHNAfyezwSTjDK26mt:suR8g+GgYQQBLQA77v94wBA6ezwE3K4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781034642, "uuid": "e40c072b-700d-441e-a88a-bf661238e0e1", "value": 22929075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781034642, "uuid": "62886177-efac-4d23-bbb1-a8885c9b27ed", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781034642, "uuid": "46c956f9-2c3e-4372-8c97-5e2db571cd93", "value": "Government Announcement.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc26a713-63d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991821, "uuid": "d470dbcd-329e-4680-b44d-94f6f75241b2", "comment": "Malware payload (Mirai)", "value": "07e742b85658f13720c0c55f1edd13a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991821, "uuid": "9923804e-94a1-4c2c-b12b-9c0143fedf25", "comment": "Malware payload (Mirai)", "value": "d9fa6dc1c60449365123fb05a996f7a88418e2045ca00d66714616f4ef78b5dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991821, "uuid": "e1cfff8f-9ab2-4636-9420-f7e1b4128998", "comment": "Malware payload (Mirai)", "value": "0c683ebf8bef48a8ce1ab9858f5618dddf7b9e22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991821, "uuid": "fac7a5d7-c8dc-43e3-9546-093235675ad9", "comment": "Malware payload (Mirai)", "value": "c8dcf8c2e04f1ecd738c87b8c867a70028455cdb0679634fdd8d41eac35db92887a3461f02cfccc15ddb5c4c1147c89a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991821, "uuid": "a07e14ab-bd6c-4ca5-8004-e90dfb70562b", "value": "T192D3EA46F8819B15D5C111BAFE0E124E77231BB8E3DE72039D246B707B8B97B0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991821, "uuid": "0534fc93-3465-4692-8f91-3f7b27538723", "value": "1536:Wgn5PbPs8Cj15mxsZcIfcXyst7FiGaZhm+Ci5iMAUo1ZEeOBQ5XoyPU0m0QrUG2X:PP00sZFUXTPabAUo1ZEeftoy8CB+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991821, "uuid": "b8c5150a-add4-4570-9963-b469ad05acf7", "value": 132860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991821, "uuid": "8891121a-56fc-4156-bd50-ab4343bd6a32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991821, "uuid": "7b204320-db45-4049-910e-63f263627952", "value": "CRY.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433f70c7-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780985578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "37485275-b7ff-4c5b-839e-75858006c036", "comment": "Malware payload (Mirai)", "value": "08f691e6cd3995d8cc6171d9919d00b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "ce71d40a-115b-4372-86a3-c371fd774e9e", "comment": "Malware payload (Mirai)", "value": "da23ef1ce687133605375f7305d22d3f75d7f3f939ed2e7726c7878e33100a87", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "ede29ebf-bb8c-4a22-a325-e8b5ff79521a", "comment": "Malware payload (Mirai)", "value": "ac68621bdd33e9a85eb50be0cc98b4b4b4494945", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985578, "uuid": "94871056-adc9-47d9-bfab-2813c0281b5f", "comment": "Malware payload (Mirai)", "value": "62f54df1bc4d68b61e321f7d64718db33ff0287de7bb6bddb310b5b468a53a91e3ca6b59f478db57ed61d99a48073f17", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985578, "uuid": "10a4d8db-369b-47cf-93b4-61ec3ab98a89", "value": "T158E30A87FD01DFBBF40BA3B6449309057530BFA609920A3772677DAAAD3A0D51463F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985578, "uuid": "e9d3277a-0b2a-48c7-b424-92dead901aea", "value": "3072:yUxzTHjAlsXpcLeBVO6kA+AUFHVljbi1Lpds2oNyNw8aI:yUyYGLeBVXkiUFeLITNyNDaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985578, "uuid": "b2425ed3-0174-4ddf-8954-024344acc98a", "value": 155508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985578, "uuid": "54c921b8-d67c-4ce7-b7f1-b3bef57f111d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985578, "uuid": "23f74857-227a-405f-bbfb-3e2b840d2eb9", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9768cc-640c-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1781014208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014208, "uuid": "aa74b20a-98e0-4973-ad83-7d2aa20e0679", "comment": "Malware payload (KongTuke)", "value": "fbcab21321ab2cff2861dc98b934bd70", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014208, "uuid": "a9d74429-1099-4853-b409-42238e340c56", "comment": "Malware payload (KongTuke)", "value": "da44a1d78027819866e2190d1a7c9158a73fd7545e3522be291065f5c584c3e1", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014208, "uuid": "3a7b7aa6-2da1-4fca-a099-d098b04ccee4", "comment": "Malware payload (KongTuke)", "value": "101e23b8c061647d57b56614c0b2e2b216467fc5", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781014208, "uuid": "79f67526-e26d-4931-aeb8-a9a95cbea728", "comment": "Malware payload (KongTuke)", "value": "db6f192c7500bb270a0e1ace81a9fae2bf94a0400bfc8fc14b1204ab1c5ae56e39c2c3c479f168be916687eb6f2c6637", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781014208, "uuid": "521effbc-862e-4f88-be68-8a074a3b42e4", "value": "T1B7F19E04B701696DAC4C8E1A79916BB237A03297E04D7AC0B58CB9C68BD712FCF528D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781014208, "uuid": "4b539f61-19bc-49e9-a0fb-baee303b2fb9", "value": "192:JuUf2vua4ahhz8uBEYHv5duEsRHMLKmlVarozU+cMSHakWZy:jBalhhYqdg4luczJc/H/Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781014208, "uuid": "b47be7f1-b097-437c-811e-e58e30a46965", "value": 7803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781014208, "uuid": "f8528bca-2f2a-4c7d-87fa-b1e5eda8c2a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781014208, "uuid": "159e4f88-f8f4-48be-89a5-12f0b2f1175a", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059a06d7-6419-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1781019405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019405, "uuid": "ce941159-9f20-425c-9d16-c27a74f04fdf", "comment": "Malware payload (Joker)", "value": "e4cc8f11bac00efa806cc59017925161", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019405, "uuid": "bac1e03b-00e3-4ea7-8b7d-b2e8d1cfc609", "comment": "Malware payload (Joker)", "value": "db4af7701254339cacd6cea7f75af01867e52894a290b2d7ee97103e508321f7", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019405, "uuid": "8c3d774b-b7eb-4a2e-b89f-66aebc50e2ff", "comment": "Malware payload (Joker)", "value": "45f7313bba82c5d1060995ea1aceaff77fd965c6", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019405, "uuid": "57e422aa-8c28-4186-b0b3-637d0d58351c", "comment": "Malware payload (Joker)", "value": "a80016cf3e5cf51999b424e85283033955f8366c405c3c10c0100c2b401620ff3f8917c55070deaa08da381e0a6d61b1", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019405, "uuid": "23a29e66-e3da-494a-8014-cf35d8621281", "value": "T1AC47F14AF61CD52BD9E5B0BC8D8B17A3B4267D151A10C18B3822730DF9B37D49B26BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019405, "uuid": "44526de7-ca9e-4eca-a35c-36683b859933", "value": "393216:E1rBovPlP+TRZSP/WjphamEp2UBXqRE3JdcxZBserQxCuKrW701QCF1:ur61P+T7SPr2UkE3bcxZBsecFv41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781019405, "uuid": "e69df8d7-97ea-42c3-aa73-f04b0568f0bd", "value": 26419813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781019405, "uuid": "2254fc8b-efeb-4090-82e5-4bc714d64723", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019405, "uuid": "c038c6d7-291c-4fe2-b108-a55e3d65b4f1", "value": "Easy+SMS+Messages_29.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659e9bea-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780979623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979623, "uuid": "b6159e24-697d-45d0-825c-804a4cb80bd1", "comment": "Malware payload (Mirai)", "value": "fb8424937bf9b57f9f35586a9ed3bfcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979623, "uuid": "89bd646e-9af9-415d-9358-0c31efd54f50", "comment": "Malware payload (Mirai)", "value": "dbd8b88a151fa41a6ce2ba604398148fadaae8acb84d49a641b6d3025d78390f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979623, "uuid": "13c6255c-af42-4b00-9ed2-c106f31e2885", "comment": "Malware payload (Mirai)", "value": "f1da2632ae565a3af8aa8f9ff4abcfb2a6c5ec73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979623, "uuid": "f10e1cac-432c-44e7-9376-848f63ab3223", "comment": "Malware payload (Mirai)", "value": "e909822c91f0ebb2417f382a49e81debdc58ab266df3db94a50d6b2292d3ca5b0bbd607c10bbf477ac6edd6e11f224d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979623, "uuid": "2ee1ceb1-f943-4332-8629-c96849354023", "value": "T1FA431ADAF800EC7DFC1ED73B8453050AB171E39905821B362367B967AC7A2A44977F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979623, "uuid": "40de4db4-b111-406f-9b78-4aafbaa12d73", "value": "1536:+nSV8s6iUL3m8u+C8R6b+8kk7y+7PO920zSgU:wkUL32+C28D7xKegU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979623, "uuid": "96648e8b-72c3-42dc-b108-e23ea0fe7e4f", "value": 57264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979623, "uuid": "99731b39-0dd8-42a4-b776-056f9f92e5bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979623, "uuid": "08ed5eac-4fb0-48f6-bc30-08cc5d03aea5", "value": "10.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9432bc1-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985830, "uuid": "c886bcda-c316-437f-9050-be9b4d52dcbb", "comment": "Malware payload (ConnectWise)", "value": "11e7f296073ed5844bbdaab62097520d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985830, "uuid": "9d1164b5-0425-4195-adcc-d1f7de1cefaa", "comment": "Malware payload (ConnectWise)", "value": "dc3f22438088726b593a789843770bf2e828e67fb21793c9b725057dafcf9e23", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985830, "uuid": "bfb880e1-3fc0-4496-af67-c4acc38f4121", "comment": "Malware payload (ConnectWise)", "value": "6c5c9c1e8674b0b5dee0318e5a18911e5580cb27", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985830, "uuid": "0b9ff929-def2-420f-9054-f0fe5b12f3d6", "comment": "Malware payload (ConnectWise)", "value": "fdbaa25f14e2fe2216bf1cd0dc7540e18e479859fc01ce390530a81dff48bbbb40bf5528625fbc8ba758c5e092aec5b7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985830, "uuid": "fa84c1fd-29e6-447d-a367-37ccc2846bff", "value": "T11A46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985830, "uuid": "bc72aa89-d7d2-4bd3-a0dc-47c3432765cd", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985830, "uuid": "50098803-cc57-41b8-8d42-c5e47abaab10", "value": "98304:xzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:xhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985830, "uuid": "2c5f2dc6-03a2-4e9b-aad6-dcdfda9a6b77", "value": 5643448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985830, "uuid": "5630a067-aa92-47f0-9ff0-b64b1cd52e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985830, "uuid": "613c0d6b-b3dc-4a3f-b697-21ea8992c00d", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11320356-63da-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780992366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992366, "uuid": "d5e665e4-2f81-4ad4-bdb7-ff23f5d28427", "comment": "Malware payload (AgentTesla)", "value": "5512d3512550df8907620f92b88152dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992366, "uuid": "d89767bc-6a8f-4912-8b6a-be478a1a1c69", "comment": "Malware payload (AgentTesla)", "value": "dc7c80cecd3050d7a710b2a6795e2c8dc02031c70a36fd4bb892850192718c95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992366, "uuid": "68b5a027-84b1-472a-ba81-a97ae16fe0f2", "comment": "Malware payload (AgentTesla)", "value": "b2932e2b8e7d2f528686b5c4175a406fa05e0cf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992366, "uuid": "9e535696-6362-42a2-b18e-38ad45de2277", "comment": "Malware payload (AgentTesla)", "value": "62e9879eacd6c72daa1540cc7ff222b436edd63299756486801f698a26b6796dac8d61a6758b32d57e669b260cd3c0a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992366, "uuid": "890a4fa6-1c44-456d-97e3-231d85effbb7", "value": "T1EE53E0147C8AE9907B9ACD6E0C98E40CC3F6CAC0E9BAE14F6007681B4C75DA745BF579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992366, "uuid": "b49d8daa-f5d0-433f-9b28-d92ef928b985", "value": "768:XZVBg89lsoyBYmpJYTDo/GJVbQC/ACx3c2OSD+ltFmreICoR7vttHtavACb2bcun:uQl2/4DwGJ9T2SDSe6ICSvt3PR11jX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992366, "uuid": "dddfb375-dfa9-4a5c-b1a5-24db6fddda88", "value": 61829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992366, "uuid": "4c03530a-a643-4b4a-b675-add130c3d514", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992366, "uuid": "089875e7-bfd3-4534-98ef-a677f2a16772", "value": "Product list, HS Codes & EUR1_pdf.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83cae83-63c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780981990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780981990, "uuid": "cbc0089f-cf00-4d56-b70a-00e72dae635a", "comment": "Malware payload", "value": "bcd84e2e901543f73eb053ddf1955dac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780981990, "uuid": "6db9e6e8-fa5e-43e3-aa1a-64959710f162", "comment": "Malware payload", "value": "dc8c531660820b6786fe630b52d570984d0307d5c195508ffe5696ef5c3e83f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780981990, "uuid": "280ac50e-7c18-4b5a-a6a7-f9b73b20fb56", "comment": "Malware payload", "value": "3c4f7f9ce5322fc664428fde835336080c8d9fae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780981990, "uuid": "13a5e649-7d75-4c22-86e8-1904f9ad4c2e", "comment": "Malware payload", "value": "c030bc70b9dab96a8cc38b49519b2a495fbe71f7c7c5a18a921d091c42a4eacb8179b09aa10ba20af2883c9ebb2274d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780981990, "uuid": "ae2d285a-8be0-4083-8ad4-77ab854749a9", "value": "T1DAF036F50335AE556456BD577063159F738B7FB814DCAF8CB46942611D48CE0B010B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780981990, "uuid": "e13245b7-decb-4a06-b350-a5b537577d59", "value": "6:B282GLD3kgzk8nJ0eFK0KvWk0+uBA82GLDlggzrJ0eFK0KvWk0+f:B28n7kB8nGewat+0A8nhgQGewat+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780981990, "uuid": "d16f1086-6156-4b4f-952c-3103d20dfaea", "value": 532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780981990, "uuid": "3e59c2ba-45c1-4948-ac52-e3a36d7d9a59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780981990, "uuid": "a7aa1375-b45a-47b6-85ad-603f3d6c14e1", "value": "teleport", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96a7c87-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "d87f768a-f0c4-4494-9a1b-80d877eeeaf3", "comment": "Malware payload (Mirai)", "value": "e29df29bce052372f4710e992478835b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "a0a91f43-cad3-44b2-b5eb-71b4c70bcfae", "comment": "Malware payload (Mirai)", "value": "dcfe5f3e03e2c24993a7b6dacb18954f2ed7db5def583ffa189555e8f2cd52d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "1c1ee7a5-b34a-45d1-ad10-a134dfc719dc", "comment": "Malware payload (Mirai)", "value": "3d95e7589d6e1765ad739400f2000adbdf306dd6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003010, "uuid": "79ae2aa6-bb6d-4087-b684-d8ffcedc89da", "comment": "Malware payload (Mirai)", "value": "36ff8011ecc8fc50d559a3fb1283dc25767de75aa237885973b2e9146289e217d75dbb0613add6e65aed293620773837", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003010, "uuid": "821b8790-9d70-47fa-91f7-daa1d08e448f", "value": "T181542201C4A407DFDA9DC8F5464FA382276829678977AF8E104875DFC78332DE867C6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003010, "uuid": "e0c35f9f-fc52-43f8-9b28-80f4a25dfed3", "value": "6144:SASmSWyWcMwbu1w5RTuUF7aZfAVan4ZxYW1bqkrNLpshO:SASZWyL9N8e4n4nBbqkrNLpUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003010, "uuid": "6cb1d0bd-c284-4f1c-8fda-bc99e5fbd334", "value": 291576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003010, "uuid": "f5d32f25-83c8-40f5-ac9f-284ce58edc46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003010, "uuid": "7d0e1bbb-6b9b-4e81-a72d-3edb55704737", "value": "5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6018d5-642d-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781028038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028038, "uuid": "95402f49-7a80-4e5b-939e-9a64b04b7a69", "comment": "Malware payload (Amadey)", "value": "95a083049831608cc89df71343b64cea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028038, "uuid": "2974248c-1fa5-4bce-9c4b-4e8497123d07", "comment": "Malware payload (Amadey)", "value": "ddc9c0cb55dc2a75b46a07ae1bd26d2aed8d3982ab039f4e9dbeab67721aff8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028038, "uuid": "0966d29a-16df-4d54-b0ab-8b5fa6652787", "comment": "Malware payload (Amadey)", "value": "91b8aeadc7a3c6526897ea430622cd4af32b9322", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781028038, "uuid": "e26978f1-b3c6-4c8d-88f4-b9bf81362d78", "comment": "Malware payload (Amadey)", "value": "b66f8d222e5bf2f8d9e3aa7852dffbdc02710715e7060d67795c9023c1577a7a7d8b849ea73e540113c5f2595fa9c153", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028038, "uuid": "5c3a8c41-ab37-4588-a6f6-c1440952a966", "value": "T1E2359D16B941C071D49401706269BFF2593CAA35672145DBFBD02EB2AD305F3BE3AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028038, "uuid": "0617c7e1-5ef1-4c20-bf01-92eb5a830d10", "value": "a252cd53ebc44617e8418747345d10c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028038, "uuid": "05dd65c0-a073-4dde-bfc5-b1beae2a207c", "value": "24576:KLCrua2InCFeiwzFJEUoBmx4I1bzNEhzcJZjF:K+ruaRnC0iwzFgI4oJZjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781028038, "uuid": "aeb58830-d673-4409-9dc1-764ead85e256", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781028038, "uuid": "6252bff0-a4d1-452c-bbb0-ae7f1fca685f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781028038, "uuid": "2132c417-d58e-486b-ac88-b30b73faa890", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bc8fe6-642f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781029168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029168, "uuid": "70d00285-f3ef-4913-9d4f-e99d0587476f", "comment": "Malware payload (Amadey)", "value": "851002f48a6dd00c41532bcc749bfd6a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029168, "uuid": "132207fa-7f2e-4d3c-8c68-53af355904d6", "comment": "Malware payload (Amadey)", "value": "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029168, "uuid": "27b97663-0ad0-4e9e-9503-c178dc1ab7c5", "comment": "Malware payload (Amadey)", "value": "48b9c278d131df429c1aed74d7a4f20c372712e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029168, "uuid": "b7817a47-6418-4e52-af75-4e078a72e0ba", "comment": "Malware payload (Amadey)", "value": "6b9da8817784a666ddecb337575fb1937e5d4df9a0f140eaae1ad5865867071e27daffcfecfbcc6cb452ce07164ff505", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029168, "uuid": "21922bd4-2316-47e4-8827-5c98939907e5", "value": "T1A5B44A5AA25943FDE07BA17CD9535E42F639744703B18AEF039005772E532E2AF3AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029168, "uuid": "a295f22f-ca81-4bc2-ba97-750acde8346b", "value": "8db30f7f23140d78d7f34e827c0f7dbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029168, "uuid": "9b35a492-1023-4820-a916-f446356ccfa5", "value": "6144:LyB4DWmxd3DH+SOe3I3qEQ1kRtFlHvNzubRDePTRBhUCaraPOlfj1ohPVL8On:Lyi5h+SU3VQ1kRDhv0ibRQnolVLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029168, "uuid": "b85dc653-4748-4d7c-8da2-8aafae283ac5", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029168, "uuid": "d6442f36-4753-45c0-9bd8-ec7ce26197b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029168, "uuid": "f163125d-150f-4731-806a-91a30493bb82", "value": "SecuriteInfo.com.Trojan.MulDrop36.42412.29255.11986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1d9109-63ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780972275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972275, "uuid": "351fa37a-0996-4cf8-bf90-d6233faa4cb0", "comment": "Malware payload (Mirai)", "value": "75a75ced04888696cb6b72cdebb62c4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972275, "uuid": "ff6353c3-7c9b-4d84-b8ca-0fda51c19736", "comment": "Malware payload (Mirai)", "value": "de0f2a0970f5f1de898a379138aafb429eef4375c25587cff1b3f3daa170b0cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972275, "uuid": "968d7a56-7a6d-4270-a17d-2957a0f4d96f", "comment": "Malware payload (Mirai)", "value": "4334d33d4e7985650eb18fe85f9058e90953f319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780972275, "uuid": "997a24da-8595-4bd0-ac88-8f6bbbbeeb1e", "comment": "Malware payload (Mirai)", "value": "e5ed8a8df02d69d004d7de8f6fc6fcb915fa66c35dffefafb89aa270b20c4d8774018d6e4e09d7678c1b4a2967c99a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972275, "uuid": "142dc18c-f941-49a5-8cd3-a7961783d029", "value": "T188635C89F6C3D0F2FC5751F6A5BBE3628773D02A2099EA41C31D9832DD628119B1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972275, "uuid": "c4eaec89-fd26-4285-aa80-5aaaaac8cd98", "value": "768:w+Mr+tqvYEvO+mW3j/NnAvxtEw3HrA8hfd0NLJS3a9E+Ny22pIr:9qFvO+jz/KnEw3LBF6tSuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780972275, "uuid": "15b7b025-5420-4b27-88ee-c9dd5daded5d", "value": 67624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780972275, "uuid": "3163d3a3-dff9-4abf-aed2-f8b976abf119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780972275, "uuid": "fc01e2b8-e0e2-4c70-8461-ec0d706773bb", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b940ad-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003058, "uuid": "b0f3873e-4f68-431a-8162-720d2ac89737", "comment": "Malware payload (Mirai)", "value": "29177a55a690a977189d53d492769af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003058, "uuid": "d73fd83a-c093-4730-9f2c-595df65e4f7b", "comment": "Malware payload (Mirai)", "value": "de1733fa9e993bd7cd54e0e1998ef2024f593592cb6be7a370120ba6d625c796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003058, "uuid": "922a75fd-9a01-4f76-a876-19e7be32fb97", "comment": "Malware payload (Mirai)", "value": "ed56c9ff8c2aa934416000d0c46cf55583f64c2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003058, "uuid": "f8297041-628d-48fb-b770-1da7a7422821", "comment": "Malware payload (Mirai)", "value": "af884443da6015eac370d899ae835803d82220f0e7969cae3df7fb40dd56584feed59d8c6768cbc755aa3700931d93c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003058, "uuid": "f13a96bc-a314-4854-be08-d52ac5b90c89", "value": "T1A6F46C03EF941FDBC4ABCE35862E835715EE8DC702C2B63561BCC96CBA4925A4BC7548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003058, "uuid": "ea6bc932-c3fe-41d3-b92f-8bd44d1c44a9", "value": "24576:EUsDFDL9mBCDbqSpfeHtJWej2aK2xkCl:EpFDUGmrjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003058, "uuid": "94f33522-f270-42a8-9254-84093d35f1dc", "value": 793192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003058, "uuid": "54e73890-91e9-4edd-902c-f53b3774202c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003058, "uuid": "a6c81128-df69-497f-8cdb-4961bd58c03e", "value": "6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6ff759-63d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991209, "uuid": "0a7e1dc0-c70e-4634-bae6-52c340cd0875", "comment": "Malware payload (Mirai)", "value": "376f3f8f5c7a3f82e3b0600405fe0639", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991209, "uuid": "262bfa60-eaa7-459f-9929-b45d0560d2ee", "comment": "Malware payload (Mirai)", "value": "de4eb067327144e422dbaf4e25169a68c8c4ab6327fcb23d125a0ba937195aaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991209, "uuid": "446c6054-87c2-41bb-89a8-8110efec54f1", "comment": "Malware payload (Mirai)", "value": "4b250ceda3e0a7619f6763046adbd4fb893e3805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991209, "uuid": "a5b00584-6d3c-438c-8cd3-98d7cd49a6d0", "comment": "Malware payload (Mirai)", "value": "d8cbab9003f43cd1f81bf84256bb9df60ac946c5439dadfe019cc25d19e684ebe0abe375744368c02f9cf9827f4a0f41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991209, "uuid": "3ee06b24-186f-477c-a452-e027df28c922", "value": "T155C328027B0D0F03D1232CF02B7B1BE0879ABEA519F5E985B51DBEC65275DB62142EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991209, "uuid": "f10031d4-7283-48ef-8a26-e4f2836bf004", "value": "1536:EkW7y2Qv1qDdFqobCl1Uh0oeG3xNid3wYMawb2ObcEKCLHv1/GB3T+Bu6Jqkg5n4:G7Bs1mClYUGBshwJ/51+BjargJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991209, "uuid": "0475c5b1-2892-4a8b-ae37-a5287877cb84", "value": 125460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991209, "uuid": "f2c717bd-f964-4111-8dfb-d36fa97282c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991209, "uuid": "830a331f-097e-4b27-b676-4d79e2b29f45", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f2fa65-63a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780971651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971651, "uuid": "4bbaa70a-8eeb-4100-a349-0fdec4a3a966", "comment": "Malware payload", "value": "dbf20416ddeeb05b319744b68447deae", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971651, "uuid": "3adb4aaf-c1bd-486d-802e-ff7a6c4ec4ac", "comment": "Malware payload", "value": "defc9f096378d5b4270832a60bb2d76c988b1e3cc4a734f00ba15a8c519aec28", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971651, "uuid": "787585e9-59f2-476f-a996-8efcdd765ebc", "comment": "Malware payload", "value": "7d13fee80fdc95549a3e74c3f33bac53ad54f67e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971651, "uuid": "3cf262b1-884a-41b2-ba83-1b96c7470eed", "comment": "Malware payload", "value": "234672f1e679158f998cd26af17a3a47a9339c3870b42db1d9a9a81aafa246ce18753a6060c6d1111da0b429e645c31b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971651, "uuid": "f7777132-0918-4b3f-8405-924213c48680", "value": "T1E6B423779CEDFF8A4C8BF7ADA12B55A5D8EC8B73BF018445063916C48816384CFC2666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971651, "uuid": "e04fe132-95d3-48b9-bdc2-1643106685a8", "value": "6144:d9OiNN+KPY1C0jXFA7tUM6dXRj5J+YJVPHQlMB/MhCNOlljcHbps/MI1bn/ketao:im4YYPVEtUVdRwlMB/Be4Hb+/1bBtsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971651, "uuid": "43a33978-3791-4f60-bd7c-e54386184d8f", "value": 506810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971651, "uuid": "04b023ad-07fb-4df2-a398-9c4e734ef8c4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971651, "uuid": "ef8261ed-b4f2-4d01-b75a-91b14db0b265", "value": "Inv.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b18851-63d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780992297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992297, "uuid": "d7c97a83-8e5a-4829-a82b-f1511a9965ca", "comment": "Malware payload (Mirai)", "value": "475a26776348ec240145c18eee41d1d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992297, "uuid": "7a79ce84-4fdc-4f5a-890d-1c7a1dca19cd", "comment": "Malware payload (Mirai)", "value": "e08217cda5e50260aaffda6141c98f723d983e4302ddadda71e9f6eaab7620a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992297, "uuid": "a30d59a5-9428-4659-bd29-51fb7620ce0f", "comment": "Malware payload (Mirai)", "value": "28c2908c0c61411aebd55230e2f64519ffb4373f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992297, "uuid": "2c3c1b7d-d9e4-4b25-a404-9bf5ea28fc3d", "comment": "Malware payload (Mirai)", "value": "ce62de8eb807ad954677ea3d595d9994ca342057db7d307f129887b2ac65449b9ebd73f2dae5dd3645adef96d504530c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992297, "uuid": "9c93569b-8c0b-483b-878f-ef24c2eb8387", "value": "T196A3F785FC514B17C6C765BBFF4E428D7B2A1758D3EE320399256F20379B95A0E3A102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992297, "uuid": "cde8c2ee-ca2f-4bcc-8245-6da10dd26b8f", "value": "1536:T6sT3U1KAhix7a4VAYz73+9kTLO0AMJ/D+99ZOlorywywiznPub5tPslbBU:T1Tk1Krw4Fzb+u5+vHAZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992297, "uuid": "14b7cdae-39c7-44a5-ba4e-e4b9ee2f5542", "value": 100812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992297, "uuid": "b7c0d6e0-b5ee-4630-9b9e-02c9fa3003e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992297, "uuid": "74ba803a-c75a-4817-b56c-155dad783678", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4b9bf5-63d6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780990962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990962, "uuid": "db5e81a3-3978-443a-85b0-0192bb97b21e", "comment": "Malware payload (AgentTesla)", "value": "f39a616469254c04bfacffef89f7137f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990962, "uuid": "6f81b06a-5216-42e5-bab0-f5bef8ab1df9", "comment": "Malware payload (AgentTesla)", "value": "e28fd6808318372522dcb8a7961c38b4ec81db38893d4a098b21b0a7fc90e244", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990962, "uuid": "8b149e8a-58db-43b3-b994-41fbccebad5b", "comment": "Malware payload (AgentTesla)", "value": "029e9d4ddb75ad90ba1ad5889b20b22a80b1182b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990962, "uuid": "d78d58be-79d3-4ddb-a141-e27e729ef42a", "comment": "Malware payload (AgentTesla)", "value": "eec0ff178008abed2dc5de85b0796c5d16b7740e1d44913980512a41f6fdecf03d73ad9677468529049f47bf4174f2a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990962, "uuid": "9b51f55e-a32b-498c-8c43-8f93697b66b3", "value": "T131165DB12C6DF161CEB33B2D19EB7782F599B419C8251326707ADCC5E65700702ABAB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990962, "uuid": "66f19dbe-1fb1-497b-9ba2-78fd513d0ea3", "value": "192:2pTTdRFr8fPgrQBma0wHX7WC4ox5zG0dSzVyJB2Nqvnxlh+vNEDoTcmdQjUlclbZ:2xc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780990962, "uuid": "934f31d3-3f49-4750-ad7d-c9d20ff2a720", "value": 4025887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780990962, "uuid": "9642a51c-5e7a-4be2-94c0-d44c6c3b8d46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990962, "uuid": "5b315486-397f-4ec0-b4bc-087cadd43588", "value": "Product list, HS Codes & EUR1_pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0527e6-6424-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781024276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781024276, "uuid": "f18a8408-a43c-4bc7-b8f9-74ca7b8de4f2", "comment": "Malware payload", "value": "61cbad3b22a3cfba7bf3b0e6b242ad05", "object_relation": "md5", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "SteamHijacker", "colour": "#228109", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781024276, "uuid": "97df4212-8a45-4291-a38a-fc5f3e2680f0", "comment": "Malware payload", "value": "e2e5f2dff7f4b9c5b8535e82af54abc58d5eb762d56250d93c9501f23ba152e4", "object_relation": "sha256", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "SteamHijacker", "colour": "#228109", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781024276, "uuid": "1789c88b-0b25-40cb-b045-f176beadbba4", "comment": "Malware payload", "value": "5559b10982f61fcaa8fe8c012b008cd0d8b3bf2e", "object_relation": "sha1", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "SteamHijacker", "colour": "#228109", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781024276, "uuid": "495b75fe-5335-49f8-9a2a-5adf7f168308", "comment": "Malware payload", "value": "6fbdf3d20f5c9569a010849822bf7a65077c8aa53bcef951ccca691fa35eb5e18b95968cac4e38800f6df620a91723e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "SteamHijacker", "colour": "#228109", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781024276, "uuid": "805cab87-b019-4f00-bff6-66450d2f24ef", "value": "T16F059E008654B1D7C8C895FF06DAC1F515BBA69913F8AE8A0A8B741B0BE67DCFC5DD80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781024276, "uuid": "419e6b02-abae-4c1c-83ad-a8d0d4325146", "value": "a732bd497ebe2cc049fb99b8843e5212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781024276, "uuid": "7ab38897-f31b-4e72-b326-92c70d95b0f2", "value": "12288:/6/z8X/n9zpbkwHsoNVAKhfR6Ij9qCFvhrZUgF1hYnCy7+:/6/z8X/jNHK3GgCBhrJDCv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781024276, "uuid": "7a4861f4-7eba-4617-93d2-d906a3948403", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781024276, "uuid": "ff95ae89-984b-4ae8-ad4e-42ca1a59a7fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781024276, "uuid": "009dd125-0f73-4d84-b8c4-91e47a3082db", "value": "wso.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8b317e-6448-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781039761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039761, "uuid": "639e2554-f9ef-4f1a-9738-78040ef0a646", "comment": "Malware payload (Mirai)", "value": "f295cca2765b95b5324ea76fdbe8332e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039761, "uuid": "3536c172-1add-400e-aa5d-63188a40aa08", "comment": "Malware payload (Mirai)", "value": "e31baaf0b4c81494cbc21047b396cfe0f8ad8d83592c28a829a55a2090f3c0e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039761, "uuid": "5910b060-242e-4c19-a68d-52331772098a", "comment": "Malware payload (Mirai)", "value": "8d346384f23932479ad60a102f4d8d088a989727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781039761, "uuid": "d1c6d964-8035-46c1-a45d-7a1f0d9a467b", "comment": "Malware payload (Mirai)", "value": "2dbc756c3f9c68f43b823930d8bff92e0f08a4618855b4f3be3673837b13692c3cd646f92bd56a3b3f8d8e11ca0838e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039761, "uuid": "66b479ca-cfd1-421f-8249-6610e7a4817f", "value": "T153048E23D8746EE8D66498B4B0F1DEB81B53A55082475FBE7AA6C57440C7E8CF90C3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039761, "uuid": "333daba0-0496-4405-b162-741413732157", "value": "3072:D+1lKnCIq/mHKwbF13J9QXMPTL0PWjX+JPHSa:ivP/mXL3J9OXejQPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781039761, "uuid": "96d18cfb-73ae-4307-a6ec-c7d6e78a35f1", "value": 185508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781039761, "uuid": "e74fa627-9d92-404f-beba-83c87771448b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781039761, "uuid": "770a1d71-3082-4037-9632-9ff1139be47f", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7a05d7-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781016600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016600, "uuid": "83365054-c6b6-4cdd-9d08-4ccdd20850ec", "comment": "Malware payload (Mirai)", "value": "2013ae50f45671c832e8516da67f2882", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016600, "uuid": "a40e3bd2-940a-4d9d-99b1-30d06dd50e53", "comment": "Malware payload (Mirai)", "value": "e36e40cfdd57ce91c7d349f42b0e7768aa233337166c15e7f215d081df9c0ba9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016600, "uuid": "97ca26f5-7efb-4d58-a285-beba9fbdae07", "comment": "Malware payload (Mirai)", "value": "584afc6757404a3d445402232dc19d1ae9ee1aab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016600, "uuid": "f449093a-0ca1-490f-b0d8-bbbbb81d3ad4", "comment": "Malware payload (Mirai)", "value": "fa632816317319436705a929374fdb16fd8f5a059fbf16998e496ab8d25a95350842d6cbac14b8863746cd99545c66e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016600, "uuid": "bffb024c-7690-4899-be04-4962a3ef2318", "value": "T1D8E3AE71C4786E99C16196B4F0F0CFBC0B23A550818B1E7666E7C9A950C3F9CF20A3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016600, "uuid": "9807bbba-f358-4327-a179-852d853fae5f", "value": "3072:f5k4+y6CxBNfTfIdULzfYePeZNgUrz6A0x:fe4+KxPfTfIiLzfYh9CA0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016600, "uuid": "20972575-c740-4a2c-97a9-a43f61cc8b6e", "value": 144976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016600, "uuid": "fef06b6c-56c9-4207-a59b-d18bf2a7464d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016600, "uuid": "3e7b09cb-2833-4ff2-85c8-63ba71f12161", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4123dc-63d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780990373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990373, "uuid": "6ce85858-f5f3-449c-a5cf-b5df45fa4730", "comment": "Malware payload", "value": "00fadb2d65c4ceb91cc60a9638b597db", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990373, "uuid": "7a97caf2-f2cf-448b-9994-d68bec7489f6", "comment": "Malware payload", "value": "e3b90a92cebb18aea3755a3818efcda1475519933409698aa4b95df5092c6611", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990373, "uuid": "9951d093-1aba-4b1c-9296-79af0aa7ade4", "comment": "Malware payload", "value": "4021ed348e04385abc5f989eeadabe5af4736016", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780990373, "uuid": "edc42fd4-0f5a-4ae1-ad9d-8e6d70e1fd8d", "comment": "Malware payload", "value": "98a5caa0cf7334d8eaa01243bcc25d029200acc25fbf60b471f03695f79e0bf5edf6bb0a6929dfda2aa28655d216fab5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990373, "uuid": "831fa820-4ae4-457a-ad7e-55593e878490", "value": "T18E0112DEC015D7200199EC9E22AB52A07820C3CB59454FE47F9C443E87BD308B255F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990373, "uuid": "c5a1391a-3e96-42fb-b62e-f808954badb3", "value": "24:kXCKysE2hi0ziQvZohaMbX+2FvtVse+uDA7:e9Qp+MsMj+2F1ae+uDA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780990373, "uuid": "1d1a933f-1455-4ebe-95bc-68343c71b0c9", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780990373, "uuid": "ef907e47-424a-4098-bcd9-2efb11982b53", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780990373, "uuid": "3294039e-7b16-49be-a811-b32d90500c6b", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b81284-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003036, "uuid": "b8469a53-fe98-4048-8d25-d183682b7fa1", "comment": "Malware payload (Mirai)", "value": "106d852266a4486972c983514763033d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003036, "uuid": "eee677fa-6c79-465c-8e14-cc201c366816", "comment": "Malware payload (Mirai)", "value": "e42600814a209a9fa44b9f7bc2fbaaebdb69949e7be666b82f6dbf29d490ab64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003036, "uuid": "867287da-83e9-45fc-aef5-1e871b9b578d", "comment": "Malware payload (Mirai)", "value": "1a9a9ce313db3d9d71a76d0b53498de339a9c082", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003036, "uuid": "ec510e70-621f-4193-900f-56dff59fdf3e", "comment": "Malware payload (Mirai)", "value": "df538f9c638336f4e2856cb0d4a0ec187b280728277a5e1c2db1b6714e9cf2e6510220894d56ffb1857c062fd6f78557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003036, "uuid": "1cdc37c0-1243-49a9-8796-e072137070dd", "value": "T113C4BE63FA561D43C8E39B3E556B82745337D24A23929306A70EF57C3ED63294F1A2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003036, "uuid": "17e06915-bd17-488b-8c05-b60cd40648b7", "value": "12288:0nlu/ZGGHDyhXu/BhK3na2AKENnjdYgp1MmVDqIUlF1u:0n4b0u/nZJxqXlF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003036, "uuid": "b910b289-e09a-40b5-983f-9fa260db821b", "value": 557048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003036, "uuid": "8d3b0826-8a51-433f-afb7-1b4b67091a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003036, "uuid": "1256f6bf-c2b4-45f5-ae4e-59ba21fa3468", "value": "3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e96f8ce-63d2-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780989033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989033, "uuid": "4866f774-36d5-49fb-bdd3-de1cbcd4855f", "comment": "Malware payload (XWorm)", "value": "e57f9b482a30f5a296d43355f5021d86", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989033, "uuid": "435f3fe1-117d-4fb2-8f28-047fd2eeef6a", "comment": "Malware payload (XWorm)", "value": "e48a6900e9c2dd61a0fca3e618a61ea1e6c1dbe3cbd114e3d6f8a333348e77a4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989033, "uuid": "9eaa2c39-e68c-4288-9ef2-5d557b83c667", "comment": "Malware payload (XWorm)", "value": "556af770239ee27045435af1134680954fb0e694", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989033, "uuid": "f0b9a22d-826a-4f74-b4ae-04d1fe5110f9", "comment": "Malware payload (XWorm)", "value": "a5fd1b7359e45c48b83c383c5ace9542dbff2f134b1132d6fbace1a2278a37ca0b396ef672d61811c110506a990f76d9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989033, "uuid": "60ab1d37-d6d8-4ad4-a9c9-11b148f3ee63", "value": "T173E5A170013B12AAB2143D70B5CCAA614DE807D337B0DA1A37BAD675B911F94E760ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989033, "uuid": "f1c4d178-446d-4a46-a700-8f070f4ff747", "value": "384:+GbUIXf2GPfmNzgGo2GjXFmGGnuGGMmGGwvoGvBQpj2GIPbZbE1n63jEkjSpCrCO:lVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780989033, "uuid": "effe0643-e8b6-42bf-9385-1d1588b3d6a8", "value": 3067400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780989033, "uuid": "a50b9609-3ce4-4783-8f37-92c54e29d085", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989033, "uuid": "5290140c-4c53-4121-8e27-64c09548a457", "value": "cotizaci\u00f3n 240145.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65377b9a-6423-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781023860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023860, "uuid": "1cab3543-06e1-4c22-a6e2-60147aea6b46", "comment": "Malware payload (NanoCore)", "value": "fbd24f741931f2cbcc8e3e0a4291e647", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023860, "uuid": "6b5e7d43-7a00-4ccc-871e-36297cbe3f3d", "comment": "Malware payload (NanoCore)", "value": "e4e8c40f00dac9520f1c773359c7d5d51f07282e7b3500bef466697b80c38212", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023860, "uuid": "cf2eba89-d887-4850-9c40-b3d5db31125d", "comment": "Malware payload (NanoCore)", "value": "200c370b6ec5245ec20900d2dfb77935d6f4aee8", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781023860, "uuid": "f325d850-79b3-4e5b-9ee2-a07231f12623", "comment": "Malware payload (NanoCore)", "value": "569e7be7a02b4110fa108939929ac6c974dc3edb4fd32747615ab333a7c2a5f616870f684e87f5da80ac5eb2e70d8f15", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023860, "uuid": "c1b9be1a-f9fe-49e8-a8db-2d5248ac8b65", "value": "T107946B307917D032DA6091711E6AFFF684AD6C259B3105DBBBC40E779E242D26A31F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023860, "uuid": "9b5149c2-0d89-4215-a4d9-237ab2e2772d", "value": "5a282f0b621c44aabe5e9f6b1dc31d22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023860, "uuid": "8c18a8e7-ea65-4eea-8841-eb6314de645e", "value": "6144:dOg7rfAJJqbj5mCI+zmY0da01PhBQNYt8YV0hqX+IPcFzIOd+aXgLAOWbU7wxPt:dOg7rfAJJqb8lRhBQNK4MOd+migtxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781023860, "uuid": "281bd47b-6636-40ba-95dd-038fe517c2d1", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781023860, "uuid": "f26e39d2-3232-432f-baa2-b6a741e69767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781023860, "uuid": "b19a68f3-531e-4de9-9d06-3adc258faecc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3e6028-6408-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781012412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781012412, "uuid": "c0fe8d9f-28e6-436f-be37-f194b5131010", "comment": "Malware payload (Formbook)", "value": "c4c8f61d46432d172c33f568be5b2dc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781012412, "uuid": "36d646d7-1183-49fc-af60-ec93b37d85e2", "comment": "Malware payload (Formbook)", "value": "e50e2fd4c61ba461a322f1d5a0e902983af962b3937e12c285e0e2c14c8319ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781012412, "uuid": "f607d78a-185c-4d8e-b526-b18ad5a74437", "comment": "Malware payload (Formbook)", "value": "15f64204fe9c230c504859b536598ef3a63c6cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781012412, "uuid": "58556477-847c-437d-ae26-1f6962d635b6", "comment": "Malware payload (Formbook)", "value": "4ed01667cdbc967aafad710579f09be7b69410dad85efdfaf203fcc6b07247dfff5f700a5d2bb7a02117ecf45ef6b0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781012412, "uuid": "0f4ddb7f-b1ad-461b-97e1-9fe572ae8c03", "value": "T1F604CF41BE8B34443505AABE44AF13B9FA039E9E0030C53A1BD977BD0F0DA55BBE7816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781012412, "uuid": "6d349788-f790-4a70-9182-6a87d8e6aea6", "value": "3072:vlzIoUql7vEu9iRp4kWmv151y7nULZn+NHXdonSS89YQFCp4iCJjh:vlzR7BSgmvuULINHNonSS894Svh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781012412, "uuid": "995f3f34-3e5d-4439-9e4c-5c2c3e541038", "value": 182458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781012412, "uuid": "9981a6ae-4a54-46e4-b28e-d6122dc250de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781012412, "uuid": "973ba07f-f2fe-4381-8ced-d5c0e1bec40f", "value": "567187.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2e2c5e-6443-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781037641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037641, "uuid": "fe0ed716-6465-4a4e-bdf3-15dcdad40a07", "comment": "Malware payload", "value": "e4ae9c1e9e62bed65867ead59be36fbb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037641, "uuid": "45908520-551f-48a1-9d90-787e60cd358a", "comment": "Malware payload", "value": "e5493e88fb7092b0901a08153447e43e52d8053ec5484e48b9f3ba09c4a4841f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037641, "uuid": "deb64529-3e50-4c0f-9d13-822af9968a08", "comment": "Malware payload", "value": "89aceaafdb182a0434d7e7eb5011728831105a51", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781037641, "uuid": "34a765c5-b32f-4588-a2d0-5c8b0146b067", "comment": "Malware payload", "value": "0a66f010d9c1f4e21583e9bc84b57cb91eb8bdf9c90ef7319fb264fa7e78c5803169f6e1547254e8c766986dcb30634c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037641, "uuid": "34461480-f743-4726-9b84-8ffeafc74070", "value": "T10831B6AB4B193D9D5401E979376124D8E464E7CE205FE3D4FF980CBB96C91483249B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037641, "uuid": "619d05a1-00da-4ce6-827b-6e57c0a58c89", "value": "12:5sLrsxItpfr1bJefJB1BP7r1Bg6TIZXrZ+btXRyIrRy08hR42pSrpCVyarozlYg2:U4Dgfd+/R+nk8azvPNjiXyA0oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781037641, "uuid": "ade74d24-971e-4923-bef8-4a6781f093b0", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781037641, "uuid": "b5a7d34e-2b22-4fac-9f89-d9250a0a7c00", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781037641, "uuid": "0ab1c42c-b82d-406c-84fe-e2c2eea77c13", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52c8ba1-63a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780971650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971650, "uuid": "ab7e572c-9176-47de-ba70-f468a4ba5ee6", "comment": "Malware payload (Mirai)", "value": "dedaeb897617ad4d8beb2b60289a6d69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971650, "uuid": "e4b3f9ab-5c38-4e62-a303-63cb08df69e5", "comment": "Malware payload (Mirai)", "value": "e7c299e0cc1dddaddae30572983c0d1fdf3b1b9f4fba6d8ad3d46299038d2405", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971650, "uuid": "a0c38dea-85e0-4845-93d6-b295ab42300a", "comment": "Malware payload (Mirai)", "value": "a816205ad4767f35ddef806b821d29136e755196", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780971650, "uuid": "2517f8b7-9fd6-4d9e-a048-189fa8cd07cd", "comment": "Malware payload (Mirai)", "value": "deeac837a3c447ae487369d1fe9552e24b87f3596b1a52986f78f8e0c39ffb32062d836955477ac8fcebfe9c3ec1e6d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971650, "uuid": "a1b60ab3-de85-4cd4-ba6f-bd38b8dfafbd", "value": "T119D35B17B5D0D0FDC8E9C1B84BEAF126DA72B0295238B21E27C46E672E5DE205F6D710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971650, "uuid": "747d807c-b9e7-4441-b8c6-b4e0d41102fc", "value": "3072:4yE75oxStAzq+cA+n1PxbSaAyezqZnfhIPXhuPd1pM:l/0pb+mZnjvpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780971650, "uuid": "f2f1aed3-1472-4570-a4a1-54e0eae66ae2", "value": 140648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780971650, "uuid": "96eda894-e95e-4ed0-aa26-09389aa63309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780971650, "uuid": "3f7c6528-7148-449c-b4af-08d8cf75b7f2", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3ea78b-63d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991823, "uuid": "82752f90-2d6b-419b-bcb7-1354b74a3423", "comment": "Malware payload (Mirai)", "value": "ac2aeaf1f3bde121bb3041526814c382", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991823, "uuid": "fc45b6d6-bcc7-4a03-b9c2-9b6f222bb591", "comment": "Malware payload (Mirai)", "value": "e7c2eff2d9f2e76a1cd48d4920c499d057b1b28f1fe7c43ec1c78b11af15d033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991823, "uuid": "24c29ff4-f63b-4dd4-9840-c508a3a8bc2e", "comment": "Malware payload (Mirai)", "value": "e5a34c46b1a40ab6acbf476e6060e02f97fe345e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991823, "uuid": "b8b3bcee-2e74-4e19-b16e-3ae85f8227a2", "comment": "Malware payload (Mirai)", "value": "47d68019f4a2421580e70205dbe266eadb43a7ea6338a0649ecb46cd49bb5781c931df1774ee3286e42175645ed0d6e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991823, "uuid": "b4a65c5d-3836-459a-9cb2-7c1489eaf3a4", "value": "T14C43F11C8685AB89C97FBEBFB15D97E03551E382705B1B8E8B0488CCA53634F3B54855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991823, "uuid": "7d38f6c2-ff06-4d30-88b1-a61d7a3ad59a", "value": "1536:OGrtZgGR/1r5KmMq9jXEQzTRu9Q3hvNmPX:kGR9r5KwTfqQxNAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991823, "uuid": "5ae07c76-8f15-424e-aed5-f3d2ae4cade9", "value": 58012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991823, "uuid": "758a633d-d96e-4ed7-bac3-dc4071500aa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991823, "uuid": "e3be8790-3391-4aa9-ae64-d76039eb5331", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b630280-6428-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781026018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026018, "uuid": "446c33f5-c5fa-4ef2-8d9c-cb6bc7e60305", "comment": "Malware payload (Mirai)", "value": "083359b648b212654c3882658248acb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026018, "uuid": "75f4e3c6-9ad3-4b13-99d9-8c9c287c37a0", "comment": "Malware payload (Mirai)", "value": "e7cb98c6f957abec76a6dbae912d31a0cfb4b49e2fecd82a0caa03cdf8ba5e1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026018, "uuid": "01a4f4f8-a901-4eb8-931f-7587a6910179", "comment": "Malware payload (Mirai)", "value": "323b433e6f1d4ebee6301b74ee1b70ffbf94e363", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781026018, "uuid": "3f256d6a-6f88-4307-a221-16b64c4a0f4d", "comment": "Malware payload (Mirai)", "value": "20dd75f492e750fc9358863ec623f913aef3d9e01aa00a4d848046c515293754925bd0af961449a4b0d54bf25e153665", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026018, "uuid": "3dc642b1-0326-492a-9b19-e8bab01f4a83", "value": "T1EE7302A3D0446CE6FB3339700E92E8DA4FF56B0E77EEA5858431FE0506B558A5A342F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026018, "uuid": "b56e2b3a-1bf2-4d35-a88f-704a2db88d17", "value": "1536:wlr4bEl3IF8tx8HEzphc8ocha1UEvb2rAjuxCGZUgHj4u+qgw09q:cEE+GtS2c8Ns3v8AjuCGZUgD4u+qgwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781026018, "uuid": "bafb8c99-848a-4c83-b719-d3bb456b4580", "value": 76660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781026018, "uuid": "4eb4eb33-939b-40db-a31c-31b3fdbe862d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781026018, "uuid": "68b74a5c-0e1d-4fed-aed4-d6dbf2438e44", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45b0623-6410-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1781015806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015806, "uuid": "215b4b9a-af06-48cb-862b-a7c8896c5abd", "comment": "Malware payload (Efimer)", "value": "ec0984630399621074fd2c09e69f6d08", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015806, "uuid": "d2b4b1e5-9e52-40e2-8871-c2192125692e", "comment": "Malware payload (Efimer)", "value": "e8555c6d5ebd12a270de0fc4a68624ca5e157efc14c309c11677c3e3ab8780f3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015806, "uuid": "3fa9f071-9793-4751-bd8d-96789be10075", "comment": "Malware payload (Efimer)", "value": "53a1815aa950a32defa71c40103bb99a41fc805b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015806, "uuid": "f1ce273b-67f6-4a2f-ae7f-9dbaab0dae1e", "comment": "Malware payload (Efimer)", "value": "038a1aa0a3a2f76e7334524420e84a18cf546ccb43fd9975bf54bd397f9bf7a871b61fcd505bbe5bc7e91966d3290b57", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015806, "uuid": "c6e99aa2-3e7b-4bcf-a690-85b0e5d0d474", "value": "T1DAE633088BE246EEFA73813CADF15485D164743607F1C6DF27688B929E6B2F1483E617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015806, "uuid": "b7e53db2-9aed-4922-8cc6-e417370d0a98", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015806, "uuid": "845c3b3f-a632-4cca-a11d-24acda04f201", "value": "393216:HdIN71xXwG3kCxoETXMCHWUjXocuI3/PGTAI:Hd0AGTvTXMb8XdH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015806, "uuid": "b0c9240b-8c76-474b-864d-a8101f7e25a6", "value": 14325115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015806, "uuid": "09efc5e6-be26-47c0-8aea-6a2ace6430c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015806, "uuid": "9c19ea9c-fdc9-4d5a-85a0-812ec2e814c1", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c10710-63c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780984108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984108, "uuid": "40fc4812-5dcc-4487-910d-9ffe68132332", "comment": "Malware payload (Stealc)", "value": "f7d98010fe4082bbbbe438e5c20ad301", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984108, "uuid": "9c096dd3-b30d-435b-a78c-ea9e18bd934a", "comment": "Malware payload (Stealc)", "value": "e87d7657d94bffca01fd03659c7725f1b09e6e0abb3128509cf20e3d8a465159", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984108, "uuid": "6632b0ec-9bea-47e2-9a50-a48af11130fb", "comment": "Malware payload (Stealc)", "value": "8217e07efdfd48ca9c20e9b9f7f8195560d3739b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780984108, "uuid": "7d5b7ca3-44cb-4a60-a20a-625dc25e04f5", "comment": "Malware payload (Stealc)", "value": "04516eec0e4ed20d93ccc24fda382cb5a9a5dd1d658888acc10a309d56f3af31524db97e2c3a628bb4785a1b8a3bed58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984108, "uuid": "e72d3d5c-0501-4cca-bf14-426a82a472cd", "value": "T1B747238A7CD188BFC09B733248F62195773DF408073667E72A61AE7A2D62BD05D7A704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984108, "uuid": "4fc43e9e-5b7e-41c6-982e-ac17e8ade0da", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984108, "uuid": "305ad8a9-fe1d-444d-96dc-702077f6e0af", "value": "786432:taKQGlrWV2yyeLb9x5BK7Cct3181qiOSid4sYXEnn7N:tQGlrWxhs84nxdnYUn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780984108, "uuid": "6eea4ae0-be55-4a5f-a477-0d2ae401badf", "value": 25726512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780984108, "uuid": "eeafcca7-dbfd-4bc1-8777-941cecd68861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780984108, "uuid": "be1bdb49-6d10-433b-9f44-22b97229d85a", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd43fa3-642c-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1781027605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781027605, "uuid": "f21d9acf-a661-4f1a-bb1f-bfa126c14139", "comment": "Malware payload (DonutLoader)", "value": "9d2ba4f284012d69332a1eb6fce71b0e", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781027605, "uuid": "ef916f35-693e-4915-81d5-6ea20e90bfc3", "comment": "Malware payload (DonutLoader)", "value": "ead1094d3fc0254ad64d8b6b16f287882a4a08099646967942ad6deb72885f06", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781027605, "uuid": "a7e0f189-c2dd-4b7f-8d62-71bb5cfa10ce", "comment": "Malware payload (DonutLoader)", "value": "b48eb3a598deecac62bdb1d8943849afa5c14d89", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781027605, "uuid": "5a65b92f-820a-40ed-917b-78109907de29", "comment": "Malware payload (DonutLoader)", "value": "b119564c546f1e1a00a6d92e48a7ff2a40793fdafb68685de0b93aac2cb442bcb08d19bf2f624369a9a88b531906d4e3", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781027605, "uuid": "c4d3a43a-62d6-4383-8ccb-104f2cdf4e37", "value": "T17AF7338A6F22F07FF813D473E11856E9625AE154D7338FA7122E90DEF8E27106B441A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781027605, "uuid": "ab994716-5b42-487b-a2fd-c0ac50eaaca7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781027605, "uuid": "a1a73e56-446f-4430-b5c5-4e024027bec7", "value": "1572864:dq2um44Hidzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXyR:dqTm4vq9NYJo+sUifljLcs22/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781027605, "uuid": "cfbee12d-23cc-4c34-acd7-820feb6701e3", "value": 76668395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781027605, "uuid": "2c7bf7a1-2684-413f-bdbe-139734c01e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781027605, "uuid": "9efbd2e2-ed71-48f6-8aad-1f6db5df13f1", "value": "GithubProject.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80fb204-643e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781035676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035676, "uuid": "44a6a8cc-b6fd-45b6-9002-12ac1d796d61", "comment": "Malware payload", "value": "f2aa688cca37f0389a5943437b6fb2e6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035676, "uuid": "e7d3d420-0bd5-490c-8112-84a03bac6665", "comment": "Malware payload", "value": "eb3f5b3d6037feb5d12bc542aeae18970ad06991a8b953e34e4c7af2581df342", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035676, "uuid": "bdf23b92-578b-4c93-8c8d-c684d4af336d", "comment": "Malware payload", "value": "bd0804f868c02fbdfbc3c85b985d0fb24318d4f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035676, "uuid": "d8240002-06ba-4622-8e46-0567ba64fadb", "comment": "Malware payload", "value": "e683fe9b67a392a74231dbe6db1dd9a32a8a8a3d2637e75ea93ad79e7a56733a92b29d7ecb2b93a4820b22f9aa1684fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035676, "uuid": "879777f4-d416-44d2-9671-d60767808773", "value": "T1770182CEC405DB9041D5E89D21EB5448B825C3DB29458FB5FF6C583D8BB96187016F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035676, "uuid": "baf716fe-0102-4ff2-b28d-3977677e9fed", "value": "24:kXCKysE2hi0ziQvZohaDMF8cMIvGeE5n/sGJX:e9Qp+MsDEMIuN5/JX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035676, "uuid": "7d424f17-c23c-46ff-83f1-43a47e6d3449", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035676, "uuid": "3c69351c-4e6b-4004-8037-6fa9db1d15fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035676, "uuid": "fe398125-5a2b-4dfa-be80-e71b5387e801", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427bdbf9-63d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991160, "uuid": "60c8e373-a85b-45d5-9e9f-98b213c13bb1", "comment": "Malware payload (Mirai)", "value": "fb62294cfffaffed1a8e85d82c9a27d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991160, "uuid": "faca88d6-fb92-42d0-a35a-203309ddd2ac", "comment": "Malware payload (Mirai)", "value": "eb623e32330bb53d9f33884972f07200471599f1dd2ae28ba7fc605b664d8c7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991160, "uuid": "acc8ce8f-471c-4699-b326-43cc10e311e6", "comment": "Malware payload (Mirai)", "value": "640cbfa47c8e0da2d1f9bf9167a75f1f703b8ff6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991160, "uuid": "ab891501-4487-4e7b-9b61-50004026e73e", "comment": "Malware payload (Mirai)", "value": "a2eeb63a29511ceb12e88e5bc88e6b19acf7262822811b1ce95a3664d3f9b4c2c417c616b8b12fd1d61e67f29b0c9a73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991160, "uuid": "b55a9dba-c67f-45ec-afed-77e982ec62a4", "value": "T18DB30849FC415B11D5DB32BAFA5E028D335357ACE3EAB1029E211F2133CAA5F0F62916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991160, "uuid": "2779415b-b1c0-410d-9e09-06e86348bd05", "value": "3072:Zc9jewGT2qGbMVd+SadsXnaWhUu7jPerUPJbE:+9yw+2JMVdradUnaWhUu7S8bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991160, "uuid": "124db021-1640-4b80-bfdb-476b024da12a", "value": 116768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991160, "uuid": "bf9e2489-1623-437a-bfde-a3a2aaec3a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991160, "uuid": "12d7b159-e903-4cd0-889f-cd29579faafb", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ae0db9-6418-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1781019107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019107, "uuid": "59a363cc-ded8-4c6a-9832-63724d222f8c", "comment": "Malware payload (Joker)", "value": "2db5146b2b91cf4531da467c5a7c1387", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019107, "uuid": "fbfe74b6-5a24-4b64-9e55-af069105bfaf", "comment": "Malware payload (Joker)", "value": "ec231b380b07bea7e1b2baec665bbac490e03c8172c7e73884697dc5fb9c54bb", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019107, "uuid": "bb8c7a97-5d1c-4c01-b871-81046ecdedc7", "comment": "Malware payload (Joker)", "value": "a9c637aa820e34fdef7eadfc0e231383ddb9576c", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019107, "uuid": "5e87b028-2066-44cd-a73a-a59352268879", "comment": "Malware payload (Joker)", "value": "98c0658338905fbedbf581a8c8fc00728cf66c5e770a1e74b8d0043943ad9fef27ed1c216fca99c2f6a342b371ac549d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019107, "uuid": "74453f99-10e1-4448-8d6f-53dce309feb6", "value": "T127E7025EF50CD927DDDBF1BD7E5D06936026381847A1C14A2826820DFA83AE45B36FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019107, "uuid": "f9a6a7b2-a4d6-4173-a248-f8b9d378e0af", "value": "1572864:lJQtDEfYlPrEl9JnknsTOaqUaYbESzz8/:laCMMfcYbV3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781019107, "uuid": "d78bba32-c316-4f40-8fa0-1a8dd509495e", "value": 69023047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781019107, "uuid": "82212ea3-f797-420d-89e2-111e7c962de4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019107, "uuid": "8aece489-81e6-4339-86db-3822857a7301", "value": "Phone+PDF+Scanner_2.15.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d480c9-63d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780992028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992028, "uuid": "c530006f-98ce-42d1-9d17-b21f6dfb41a4", "comment": "Malware payload (Mirai)", "value": "d2f0ceb44b503a898b49818bf815f8cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992028, "uuid": "505d87a2-bd5a-4d63-9d68-53d4092c600d", "comment": "Malware payload (Mirai)", "value": "ec38f0c03b320b8858f0aadfd63e31633e878a7fb913307e0db0d2d02e92193b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992028, "uuid": "9ffbbcf0-dc66-4e50-9328-78567dded52e", "comment": "Malware payload (Mirai)", "value": "fc850f78f24838ceff5fae1bb84358267ba8fafa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780992028, "uuid": "e528f554-78ac-4668-b713-aac6e3f61785", "comment": "Malware payload (Mirai)", "value": "30b3245285f1dc90864cc3058f4494e0722fcd0aa21832398ee550ca0a2b4933253a5bd6cffa11886058327922c05789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992028, "uuid": "7227bdca-495a-41a3-9247-3dd4365fa857", "value": "T1CDF3A91E6E224FAEF268C73447F78D25A76823C622E1D644D2ACD1145F6039E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992028, "uuid": "dff89242-9608-4432-a727-0195b587a8de", "value": "1536:rxN7hjMXRdQtKL0u86/vTm1jSeEE15hdFFTFYiYMuPDIOzd+dJUC:9MXk9u8kvTm1+E1LETM+D9d+dWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780992028, "uuid": "db256d3c-695e-416b-83d2-af9864602ea8", "value": 161144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780992028, "uuid": "b1dd1413-596d-429f-96dd-42ee56da46e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780992028, "uuid": "b7d3d4f4-99e1-4493-b287-c6c8b042bf0a", "value": "CRY.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b05626-6413-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781016900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016900, "uuid": "6afe1690-2ef9-4245-b550-f122fc136f69", "comment": "Malware payload (ACRStealer)", "value": "e2fb5a016473dfbfeb2333cc12b3118c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016900, "uuid": "f60862cb-252c-4151-ba5f-1d165f9aa3de", "comment": "Malware payload (ACRStealer)", "value": "ed617bb7ec4a23a73cbe8807547737856b5905d671ac9acb286052c6f9706697", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016900, "uuid": "dd53c600-9a54-4eed-a900-f75a06435af5", "comment": "Malware payload (ACRStealer)", "value": "0c1f2463dd2097601e6e7574b4b071aefc1558ba", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016900, "uuid": "3f68cb37-8e51-40be-98d3-359cb1d4088e", "comment": "Malware payload (ACRStealer)", "value": "4ab7f36c871ac6bea92baaacc197165799fe4bac1cb0db9e85e599ee50be352926313b9e71ccae34a311d673fe39ce78", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kuilfgfd-cc", "colour": "#7F8191", "exportable": true, "hide_tag": false }, { "name": "NeuraLoader", "colour": "#5FFB97", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016900, "uuid": "cda09249-41df-4b9b-aea1-e873496275e2", "value": "T13AC55B46BCD109EDC49A633288F16696BB24BC884F3617D32FA1BB782E72BD41C75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016900, "uuid": "0165de7d-4003-4e52-91e1-e8333034e8f5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016900, "uuid": "fa227ba2-a038-4c93-9420-512b2b00e0a4", "value": "49152:KdLc7ihczWj1wTzD+7TSXGPFFPMvYxUmN4ne:KIEUO7TSXGPFFPgmN4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016900, "uuid": "b8dc1a90-d3ea-4c67-b325-77bbee3ba9f4", "value": 2728072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016900, "uuid": "106e7014-2181-4042-a0b4-9f88f987b611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016900, "uuid": "563a1bb4-d72e-4288-830b-85722d44d183", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2646d6-6427-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781025724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025724, "uuid": "5a90825b-86a2-427e-a61a-2086b58b300c", "comment": "Malware payload", "value": "1e46e3a0106af0eaa06ed3aad4084f82", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025724, "uuid": "b53d541f-d811-4cc8-87a7-95b6a0a3c34d", "comment": "Malware payload", "value": "efc5f3ea8226c1a5e0f855220fc3f0eab170ad05290bf59d1f1278c0c6a54ecc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025724, "uuid": "cfa3079b-a801-440c-91b8-5dc52f7bac30", "comment": "Malware payload", "value": "10631f3901f02c3d88c26cbc2eae178dd22fd279", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781025724, "uuid": "998b2f25-9b45-40cb-84e9-3a353ec939be", "comment": "Malware payload", "value": "7139b319a66bf4b874c23973f74af8d0ee905262ee4b02de96b38d9f758285530d32fa3788fcfe9e094080bd147d75c3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025724, "uuid": "724f14c9-71b7-4793-b883-93d78f51a26b", "value": "T122033856B2009336C14747B2862FD7E64F72FC54AF671117329AB34D1E33AA44A77AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025724, "uuid": "c0129f62-e9d7-4349-b590-fd0ec5e1b443", "value": "384:CcvD6UZ6f9yhyxoR1PUsuvvCOZCvPkWFm71XEBsC5lQ771XEBsClWztcq5wi:cK6FyheoR1PUFtMHkJRC3OJRCQ6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781025724, "uuid": "3d5dca3c-bbf0-4da7-aa0d-3b918cb289e9", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781025724, "uuid": "5dd09865-ca04-45f0-90d1-fb5cbc52ef55", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781025724, "uuid": "45ea1f2f-a106-44b9-8621-e92e61cbdee6", "value": "movie_data.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc83e896-6418-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1781019336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019336, "uuid": "a77dccf4-fd56-4c4c-a202-4bc1a816d8cf", "comment": "Malware payload (Joker)", "value": "45027edcaa96445c1205dce6bacf1c98", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019336, "uuid": "685fb0c7-1c46-41f6-b214-895c053500cf", "comment": "Malware payload (Joker)", "value": "f0299694398efa79cb1693b6056a14a3a01eac58ec6529c128295696e63763a2", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019336, "uuid": "143e9808-0aff-42d7-88df-a61f359789cd", "comment": "Malware payload (Joker)", "value": "b724255cf23464e7ef3404a3bdff38b51bed998e", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781019336, "uuid": "d753f12a-32b6-4641-9d09-6b1d3abc4b8b", "comment": "Malware payload (Joker)", "value": "7df3198ccc2dd50184760f5255f81e93abb9dd0b6e4e8b78aa69000a94e4957ae28a98c5b3880faafaf8f4c7d41de9a6", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019336, "uuid": "1fa8cf7c-5a10-44a4-87b1-c66c83ebbf35", "value": "T1FE77220EE30DA91FD9B3F178894A222178562C55F7019BF75926F26C6E739E48F0A3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019336, "uuid": "42e10fe9-90d6-4634-9946-bf5744e66c74", "value": "393216:bH+V6KaS38SS9ZkSUy49+tZpviToQB96EZWwOFPFpHbS2/BWLI5t4CZY+fXD5/PH:j+cKaSMSSQOY89SkE4P7lduCZwttQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781019336, "uuid": "649eaea6-8ab5-4a67-99e2-548727a0d2ce", "value": 33817344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781019336, "uuid": "d9cc6c62-5c19-4af3-ab41-a61de26e88e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781019336, "uuid": "2ee58fd6-8517-435a-92fc-36c9cdbd483d", "value": "Cache+Master+Clean_1.2.36.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f181a72-6430-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781029541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029541, "uuid": "de0af1c9-1ff0-492e-8f7b-77de90251a27", "comment": "Malware payload", "value": "0997122a59535af1055f5b582a1042aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029541, "uuid": "fffc029f-8b6a-4a92-b12e-b43d81bbd70b", "comment": "Malware payload", "value": "f1c7d246482af5e1100cf72da30858e48f51d63550ef7023cfa99cb8602a688e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029541, "uuid": "9eb57549-31ce-4e9a-9905-57afe27d4382", "comment": "Malware payload", "value": "0192ebc00af78dab5a53222665db110d79c38796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781029541, "uuid": "f23d2d12-b0bb-4845-97d3-c0fa7bc3b9ba", "comment": "Malware payload", "value": "4b0b00e0fe3c1930984112a137ef05509065bcbfab805490d045d4382eec842a1d1607cfa75fd836ab4d271c3b706ca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029541, "uuid": "0cfcf5c8-b5bd-4ad6-9f7c-8138f186ccd7", "value": "T101E58D2766E881DCD07BD1BCAE1A4E12DEB2780903756DEF079089711EB7DA05A373E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029541, "uuid": "fb8ffacd-a2c2-4f4b-b4d0-28b7cbd4fde4", "value": "f7e5d034e36f476a819c46df5fe2e4af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029541, "uuid": "c3bcf01c-d039-4657-b61a-570ac1dbf6d1", "value": "49152:5l9wmdbJHnFMNGQXr93RluRltyjeOPAbQUL5DGDR5XxfIr8KumN:9wACPFjjqBGV5Xe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781029541, "uuid": "f89b57fd-d228-4f91-98a0-cfac8c436eaa", "value": 3236880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781029541, "uuid": "8c595762-a8e9-49ba-9e8c-be6b3de79d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781029541, "uuid": "bc124c74-4fd0-4e5d-ba93-afa680912fb7", "value": "0997122a59535af1055f5b582a1042aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de61a8ec-63e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997435, "uuid": "afb1b1bc-c02e-4e86-b913-98ce68b3275d", "comment": "Malware payload (Mirai)", "value": "48ab61b0f72da593ee1c67630d66a0a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997435, "uuid": "a375c020-94e0-42cc-8abf-cea8b9813e6d", "comment": "Malware payload (Mirai)", "value": "f2ad29c69261ff249699ba62d4ddf812e1b90cefc29757b19f67b03abcc8686a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997435, "uuid": "d5263914-f3d1-4dcf-ad99-7fabff3005d6", "comment": "Malware payload (Mirai)", "value": "8639fea32795657a703fb45a6574df402054ed65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997435, "uuid": "50233a20-c6bf-4156-b7c2-f66e699ba790", "comment": "Malware payload (Mirai)", "value": "29f2db3673e270e516b374ced3fcdd1fe8b1a9f95113c8e87541e3181edd2ab2e463c6f98dc356e51f73662626fb24dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997435, "uuid": "84f6b21c-90e4-4502-9f38-25ed1060efea", "value": "T1F2156D4BA2B374BDC157C43443ABDAB2A935B43502226EBB65C4D7303E27E701B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997435, "uuid": "4188ab66-5cf2-488e-8f72-06154df5ef46", "value": "24576:eRxpF4suk1MFfwpkFinwNuVZChyhotY++:e7X4sukyDgPLytY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997435, "uuid": "0285fe0d-0468-4223-9df7-0653abbb0257", "value": 901960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997435, "uuid": "e92123c0-6667-4039-9998-10d1f4bd20de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997435, "uuid": "25b44bcc-3a1a-46bf-b5ff-685c1453d929", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96f938a-640f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781015412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015412, "uuid": "4af38911-d48e-480a-ac25-dca20d0f542c", "comment": "Malware payload (ACRStealer)", "value": "3b15ec2a18377c89ab3d3c9813043a20", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "pw-3859", "colour": "#620A7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015412, "uuid": "12ba963b-c1d1-41ed-8f69-0b13488bf950", "comment": "Malware payload (ACRStealer)", "value": "f32362278cdba4fc59ef0bfb1eba883accfffdae0b1513f887ca6ca7d14d177a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "pw-3859", "colour": "#620A7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015412, "uuid": "c2ce3812-3e56-4f56-bf8d-44bc0b23fc39", "comment": "Malware payload (ACRStealer)", "value": "d393b95768a3337fd250795ec90251f2fd9ee610", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "pw-3859", "colour": "#620A7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015412, "uuid": "decba24a-1330-437a-a66f-7fa2aca52e87", "comment": "Malware payload (ACRStealer)", "value": "6006326e5bc74f363d39ce1e3a1270f377604dfb9c50b1b7b125dcdcbaffedef775103c662876991ea77961cfb6ee2cf", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "globe-cachefoundry-cc", "colour": "#DF01F6", "exportable": true, "hide_tag": false }, { "name": "pw-3859", "colour": "#620A7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015412, "uuid": "2f4b167d-dd8d-4b47-9d37-5e3e3e978fae", "value": "T14A07336383F19C65F62B1221714E917D371EE9A2E884BED3CF1C3D1CC2D61A474A692E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015412, "uuid": "1c4403ac-4b7f-4980-8e7e-f3195e3b932c", "value": "393216:qJ1YdAxo/3jS4ux0qhXZNXm+xVejZ72SX+jEBNZ3sAyC:Xdn3jMxLXDW+xVejZ7+4sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015412, "uuid": "2f0bf1ba-7628-4a0b-94fd-e56254ef69ff", "value": 18221539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015412, "uuid": "7ff126ce-cd09-4f17-89e3-94796b7c8fb0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015412, "uuid": "ef2bc6c6-ced0-4042-904a-a54aec87a34c", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac423d5-63d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780991872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991872, "uuid": "238e9e5b-bc0a-4c7c-b5c2-3a5df2d9c005", "comment": "Malware payload", "value": "b67babf14abe065df4f0ea2523814b49", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991872, "uuid": "02b738a4-86fc-49c6-96b4-d312fd0ac817", "comment": "Malware payload", "value": "f3cbb8ed8891e5068021dfc3a945405548c69d6798f6f972055a63950454e310", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991872, "uuid": "dafe4879-d88d-424c-a206-b4e67f770b58", "comment": "Malware payload", "value": "2afc136990187bc38aaf308f267210888862a949", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991872, "uuid": "e3a86dd2-ceb8-44bb-9d68-fc9e1027d7e2", "comment": "Malware payload", "value": "4f0a3695ed9aa35d21740515f3bbef3560f0473c74e5c2bef81b2f118251982b1fce57b1ef868404888005cb1e2727ef", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991872, "uuid": "635c1454-afd2-46bf-ac24-436d5e4fdb2f", "value": "T1DC74C66A9296B484EC4381B037D9B6F3DE10F5BFB0F9D45C6693B415E8B33786A2011B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991872, "uuid": "09e1bcd6-02f1-41f6-80f1-a65a0a50f8ba", "value": "6144:2LQflMFGo73MpgfDCSFU6v3x6I45ATKWtkcqURQZcwRtxDChqyq96:2UoLDfDCf5ATJthqgQZcotxO4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991872, "uuid": "b904cd91-8ec4-4268-9ba4-f3487aa5f2a6", "value": 342624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991872, "uuid": "73a543a7-acfb-4f63-a4d9-cb2753a6dcb2", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991872, "uuid": "318b1464-19fb-43e1-a91b-3881bb270e25", "value": "GITHUBCODE~.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01eeade2-63f3-11f1-a769-42010a9c0008", "comment": "Malware payload (SeroWorms)", "timestamp": 1781003078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003078, "uuid": "5c0ab24f-ed0c-4560-b795-63c0dcc3b867", "comment": "Malware payload (SeroWorms)", "value": "cf5e5e04acc355366270d5d054ac4aed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SeroWorms", "colour": "#88FE5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003078, "uuid": "59aea787-fe77-4434-8598-bbdc01605ebf", "comment": "Malware payload (SeroWorms)", "value": "f40263a7c787f3a4c997bad18c4e81548ae87303a95048ea301d35478961f524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SeroWorms", "colour": "#88FE5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003078, "uuid": "776b512d-620d-4418-8979-2b6ea7f41f8a", "comment": "Malware payload (SeroWorms)", "value": "dbb00bda039344c76b53ad22f58d1615facb047a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SeroWorms", "colour": "#88FE5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003078, "uuid": "785ad755-72cb-431f-8756-e6a8e136cac9", "comment": "Malware payload (SeroWorms)", "value": "787fbf0860b19f5169331679350b1313a4d9b6b751c1c5f46a09d43d770a1d6a58819a900a36e6612241b5bd631322d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SeroWorms", "colour": "#88FE5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003078, "uuid": "009089cc-a241-4967-b2c6-c3d2bd526468", "value": "T19AF4B019B7B406F9E9AB857CCD434905E7B2BC5247A1E78F03A00A961F277E05E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003078, "uuid": "72ef3531-091d-4240-b18e-8193ff69324a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003078, "uuid": "a33ffe18-69e7-4465-9204-b1625c6ebec6", "value": "12288:AdCftr81gYuV3uRh2SMMlTkHnVCVs3WO4rgkMGLOk:mOCHRMSMETUisN4sp0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003078, "uuid": "e0e1c8ae-2f06-481a-b563-2f247b737632", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003078, "uuid": "c3994b80-63fd-454c-9502-343ecc13b83a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003078, "uuid": "54a16875-3ca7-4e9a-a676-1d7b3658c968", "value": "f40263a7c787f3a4c997bad18c4e81548ae87303a95048ea301d35478961f524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5e8cb3-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985867, "uuid": "8735e08f-d9db-4255-acf8-ef85656dc2f9", "comment": "Malware payload (ConnectWise)", "value": "d9a6a7a17b8672dc78f91cb1a4927aeb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985867, "uuid": "72e36eaf-a129-4626-b832-6d2c0e72838b", "comment": "Malware payload (ConnectWise)", "value": "f47c380e1f1c4ae5608054a5d7d30f60927fb25de61d92c9fecddf17ef1dde54", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985867, "uuid": "c7f4c07c-4e6f-411f-89ce-d32e630f76d2", "comment": "Malware payload (ConnectWise)", "value": "d6511f8c01c064de943b4c410dfc8c9f95bdcada", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985867, "uuid": "7d14f765-94c2-4e7b-8cc4-6ea00ce401be", "comment": "Malware payload (ConnectWise)", "value": "4d8f6dbfcbd28cb4aa085113923ea6451c73ea5d5115cb2758820d0bc2ded0e4ebdb119f7a48bc93c0b6c3b89a777596", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985867, "uuid": "49f22b9e-4720-491a-bf65-52e938b5e377", "value": "T15B46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985867, "uuid": "0a2990ce-6ab7-4943-a315-9286bc79349f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985867, "uuid": "5d14dc0a-c52f-440a-bd81-cb3c77f6c386", "value": "98304:azIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ahfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985867, "uuid": "eabf1e49-1508-463a-96fb-9956aab8d9b8", "value": 5641512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985867, "uuid": "c239becb-9e33-4552-8f9d-a0b62137665a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985867, "uuid": "17fdaf3b-4918-465e-b65b-16ef715e8558", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609b52b4-63d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991211, "uuid": "743018a5-64a0-4278-b77c-4b4be9f98521", "comment": "Malware payload (Mirai)", "value": "955a7af3b52051bb76b88ee37cfd39d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991211, "uuid": "7e673398-6098-45de-8f1f-0876f8cf4832", "comment": "Malware payload (Mirai)", "value": "f4b76b768173be955736065e18db9ee838e08540fe82a53dc3a240f8e821bb1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991211, "uuid": "29dabb76-ad88-4c6e-bd26-fc20e0259803", "comment": "Malware payload (Mirai)", "value": "1403315595b4f8098d45386195770d1375711a58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991211, "uuid": "1005c712-f233-4e89-8659-115c5d8a68e6", "comment": "Malware payload (Mirai)", "value": "1a51249088cb2ed5ca175e3226672871f8495f2c4c0fd5db10a0fecef153a24fbb5cc46a06cbeb4ea199286a992cf635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991211, "uuid": "8180cb55-8aea-469b-af88-e549b97200fb", "value": "T1EC144D0377224FA1D715D17207B38B5A6AEB11821EE298D5936CCB143B20BE9685FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991211, "uuid": "334dcf23-1f9c-41c2-8fe5-d5a113a24695", "value": "3072:Q+G1HcAEl+ajZHs2Guub+Z/P+k72Za+bFrCU6gULlV8OqzOVepZn:s8z4WRsM7PGa+p2xRV8POVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991211, "uuid": "97a8b15e-bafa-4134-901a-510d021e693d", "value": 208892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991211, "uuid": "a73f9a0a-48d9-40bb-afd3-2b71561e7134", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991211, "uuid": "337323b4-2dda-41a4-b466-e8d847160d80", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c91f9d-63cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780985896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985896, "uuid": "77004356-f54f-462c-a871-2b543eb9c5d4", "comment": "Malware payload", "value": "2f52b9dfc52feeddaead2f63dfff1988", "object_relation": "md5", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985896, "uuid": "7d199160-0dd9-4a08-88ad-9f19b2fb7773", "comment": "Malware payload", "value": "f50a40770cdd9460f06a036db3e8adf734a689b728a4111b73a20f0f127befbd", "object_relation": "sha256", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985896, "uuid": "15add294-027e-4a8b-b5a9-d41023b143b9", "comment": "Malware payload", "value": "de04996d4de0f5452ab8662282a275409dfb491a", "object_relation": "sha1", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985896, "uuid": "f5fa29c4-bcff-4457-9990-5a1234255212", "comment": "Malware payload", "value": "4f6fed7b9280c3cda3eb4b76b7aef23e541e610cc4e43a5142f096a6762079e1102d5f8b28d853de2e6033612bb6b6c6", "object_relation": "sha3-384", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985896, "uuid": "b9c9dbe7-369c-45ea-a1ad-7b180931525d", "value": "T1EFF4BF2B72564E13D2889633C1CB5905A3E4D6827633EB0F7585139A5E073FBDE0A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985896, "uuid": "f9fbf8b7-e572-4730-939a-14c019f3f1e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985896, "uuid": "69f59e19-1ce7-4f14-9910-dec0f4b4e877", "value": "12288:tDtn4B7jfyou4Ma2lVv37p4mYlxJkufAjPows0Akhc5lEn+4v:0BvyhXa2b3ikuYzo70AkC5lEnDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985896, "uuid": "0f17598c-7d79-4cc4-ab38-59eb364e7486", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985896, "uuid": "03620443-c1f1-4db1-b3a1-f55e0c47e492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985896, "uuid": "77f9b99c-3ac8-4c19-b4c7-a15004eb056c", "value": "f50a40770cdd9460f06a036db3e8adf734a689b728a4111b73a20f0f127befbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e744ce-63bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780979617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979617, "uuid": "3bd90446-fbf5-4a9d-98e5-a427deb96e9c", "comment": "Malware payload", "value": "f7149665e6d1eae2b91c69226e9f1f31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979617, "uuid": "4a362e88-2b43-428e-9967-fe9c46e14e92", "comment": "Malware payload", "value": "f620d1d954324c095e1ba90928b80f72c0f2de2b56d62fd5412de02ea15145d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979617, "uuid": "d1494155-e8f0-4f4e-a582-13550f506641", "comment": "Malware payload", "value": "8cbd5872462ee86748438b6a7e922c20f562a958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780979617, "uuid": "7ed69c9a-c03c-497f-8971-3ec804ada5ae", "comment": "Malware payload", "value": "70a12b8d06f5460f369ad9664ef2402b86f5a50fd8423878f9c7937a28b0f309109235f2eb900a016bbac19c5d408024", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979617, "uuid": "4dcd5eaa-f2e3-46b0-b70e-c6236039ffdf", "value": "T1C8432A31BAB11D2BC8C4987A72F34725F2F5478A20B88A1F3D711E8DBF6498036572B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979617, "uuid": "a9e2fda2-5fe8-40eb-903a-12d173131382", "value": "768:sS7zOtva3YgFk2Vr5FzfZHRuMbdO+YmG5V+VWvrplVU1tVyIg:sS7/3fNVr5FzfWiYP5sVWvstVyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780979617, "uuid": "54c7763f-bec8-4c5c-8682-4ca339759121", "value": 55760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780979617, "uuid": "2fca1c9b-d7cd-4150-b1c2-64f4a318bffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780979617, "uuid": "ec4a26fe-8fbe-44b2-bcda-dc86fee40e84", "value": "9.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1da7e1-63e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780996623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996623, "uuid": "ff147704-1806-4acf-b657-7c8bf5b0e919", "comment": "Malware payload (Mirai)", "value": "6c217dda191921a4ac1c1ec580e6e993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996623, "uuid": "07beda52-11d5-4795-a1bc-d27b493879d7", "comment": "Malware payload (Mirai)", "value": "f7b8d2a3f67ef497ddad5c498f93079c74a3261a1176496d30dc9c33928cf689", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996623, "uuid": "5ae4ff41-d600-4439-b95e-e4e1572e5c3f", "comment": "Malware payload (Mirai)", "value": "17dc7154442c3c5049e140c1ec9482e107a84acd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780996623, "uuid": "4e5cf6e6-ad35-49b1-89e8-fb7aa7e8d61e", "comment": "Malware payload (Mirai)", "value": "6d19ffa861c75f0d0121532c628bddb88ddcaee8719067ea1c38153a5c6ae4af15c0484f48dda6da0848503bbb674b47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996623, "uuid": "683cebf6-6145-439a-8223-24c0d5afd574", "value": "T163A3710EBFA01EF7F86BCD3B05E81B0524CC651A21A93FB5B934D418FA5A10F15E38A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996623, "uuid": "22247ec7-39a6-48a6-889b-be405b75b20b", "value": "1536:xuhAg5M7Ghwk2V0WrLKlaZzNUvIi1j1zB5cZMqHZyT8uyDL:xql5QGhwkXWrLKIRNUfyjHmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780996623, "uuid": "b850b42d-6d78-442a-93b2-0ed1430c365e", "value": 101804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780996623, "uuid": "54828e27-19b6-41ac-bead-ad71ff808dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780996623, "uuid": "358009f8-2653-4a47-88b8-c7787eaf2eca", "value": "azsxd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86623dcc-6440-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781036372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036372, "uuid": "e828b9c1-71cc-4ea1-b4e6-f03d5615fb0f", "comment": "Malware payload (Mirai)", "value": "ef8a500433f6f2758df2a7e4b3136e3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036372, "uuid": "f35bd8f7-f176-40f8-a787-a65c0d5b9830", "comment": "Malware payload (Mirai)", "value": "f8ab3ea192f76674ee80b18a803b93b9f3287758d6744e2f20517a470b260210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036372, "uuid": "1de6fb43-9b03-45fe-aac4-044484e3c73d", "comment": "Malware payload (Mirai)", "value": "caa83e64c706aab3deeacc8845b1798e79a4f1b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781036372, "uuid": "9e3682d5-39c6-4575-ac52-4e92a26dcd6e", "comment": "Malware payload (Mirai)", "value": "a1b77ebe511208ad48b746651235422c1ee54171de0abd6368184225dcc4c43116be1290f22cd555e1d8bccdac4e8d17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036372, "uuid": "1681709e-0bb6-41b6-9a3c-00d417c98c7c", "value": "T16953013AF1EA4E05C6EE51FDC89E793FCF10F58E2592992B198E7911B921723B5102C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036372, "uuid": "349c7f4a-9603-4d14-8e78-e93c1f84caaf", "value": "1536:mcotGDZqk7ioTH3Tr1isKZLS/k5MQ/eJa4wRCuixekNzrnouy8ry9z:VotKZ7eoTHtqL+k5MDJ2EEkNzzoutO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781036372, "uuid": "b9b5aea8-6c36-4279-8677-1c1f354744ae", "value": 64844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781036372, "uuid": "db15822d-7353-4a4b-8360-a9eec053d1e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781036372, "uuid": "e98d11ce-49d1-4e7d-bebb-b5e82133294d", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ee8788-63f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781003011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003011, "uuid": "e8bdf328-8a90-4b05-bb1d-9e17bbdb2eae", "comment": "Malware payload (Mirai)", "value": "fadc5995e6dffcacaea438236ae92773", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003011, "uuid": "c037032b-6a2c-4232-be84-0a3416f2a30d", "comment": "Malware payload (Mirai)", "value": "f91ba0370249b1806cc2d48caf74487d5808ff7e3694db4b2db41a6e0a0d58f1", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003011, "uuid": "2413665f-5fe8-4fab-86f2-4140cd8ff891", "comment": "Malware payload (Mirai)", "value": "0b6468d239c82f1ea621181b490d87e607590d20", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003011, "uuid": "28f587c0-c7a9-4b5a-8ad4-41216a6c8d4c", "comment": "Malware payload (Mirai)", "value": "c4380304bde24e6b620383e33c3e04bbc2c943749b4be91a6fde97eed430acde1fd4c1e38474cb539ad445358a5d966e", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003011, "uuid": "03224a95-93e7-41b3-9026-d7cc23d14569", "value": "T10064233B5439ACC0E7CFBE6F97655D6C8FE2E90F18A3FA5A5C155A94790C400073A98C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003011, "uuid": "9a46c6d0-80ca-419e-914d-8a9b4597d344", "value": "6144:3pG1JwVx8EKylmruCyU2zBPunr8cDoc6ZVTMHeP1ACGtlrOI:UXwDcEGJy1FuL6ZuH2Wvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003011, "uuid": "fb3925f7-f235-4452-8ba5-b8777ee7ab9f", "value": 310108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003011, "uuid": "68ff9899-1eed-4f3b-bf1b-bb86242e3e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003011, "uuid": "f8a25c5d-55ca-47ae-8527-4ba9e22cfd0b", "value": "7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e69db6b-6412-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781016574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016574, "uuid": "aacb131a-7e15-4ce9-beba-6644ea41ac3d", "comment": "Malware payload (Mirai)", "value": "617e7699c4b9a0ca965bb389803901e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016574, "uuid": "8a914b60-ecd8-4622-a07b-a42e8b80b69f", "comment": "Malware payload (Mirai)", "value": "f94418e8ecfdcad93d3aa574be085c5f38289e0f2fb92128acdea5a9e5add5f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016574, "uuid": "f08f7ff4-94c6-4db5-b811-0fb91c45e443", "comment": "Malware payload (Mirai)", "value": "f77cf2fe48cdf5e069b94ab9473394bc16bc2b3f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781016574, "uuid": "cc2e53bc-ef97-4d6e-8551-cf0de0072ce7", "comment": "Malware payload (Mirai)", "value": "08dd687c85e3c09f7c61a34f80fd31d28f57adea0566ca6d1ec74eebec54bbc91b8e08fe2d329feb6e7eff16bfa158f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016574, "uuid": "5cdfc9f4-dcae-4dd0-a98e-b182e31eff47", "value": "T146F36CD6F400CE7DFC4AE77A80A34A25B531A36131531B33A297BD53BD761A6092EF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016574, "uuid": "8529b875-a7fc-4aae-9f78-16420f57e243", "value": "3072:F2HCapL4uYVGpB6po/tNphoweCE/H6Yy6PfHTVB9IAFPDlNzT:EH4uY8pB2OtDXGPy6HHTb9vDnzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781016574, "uuid": "35502f5c-02ce-4192-902b-90f379a2608f", "value": 158304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781016574, "uuid": "bb61e27a-c7a3-49a9-82a2-5e16710b409b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781016574, "uuid": "06e2cc5e-c120-4fb9-affa-ad42be38c765", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3d8d6a-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985867, "uuid": "d282088a-ff64-4762-8ed3-8412e7fc5ae4", "comment": "Malware payload (ConnectWise)", "value": "aad4095f4ae5f843f40eb3286c0909b4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985867, "uuid": "bb31e886-d982-44d9-b28c-6e0fbe8b3510", "comment": "Malware payload (ConnectWise)", "value": "f9741dcb99aee9a22f63291974657f2782a0b0ee7b67faff9e2d341604ae5e53", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985867, "uuid": "f4a71b1c-3ac2-4bf1-87da-2d774df15be4", "comment": "Malware payload (ConnectWise)", "value": "6272d8fb53f4d52efb2c19c2c8d816eacca85491", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985867, "uuid": "81553cee-7a62-4949-b4bc-63aa110d636f", "comment": "Malware payload (ConnectWise)", "value": "e6e95e70560aba4514105ee19391204bf7310f5ad0b4cb31467a51268d5946619209faf472f1c61d1c8f23bf90b09e30", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985867, "uuid": "1d524854-6d8e-4b05-b920-1792eda9cab5", "value": "T130647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985867, "uuid": "7e94ea90-e377-43bc-9460-6b7cdeb3f531", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985867, "uuid": "4c769f0b-95f1-4255-bf46-4c49df8ca065", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985867, "uuid": "9cba5e53-5be9-4f3f-b0fe-7938a604aec5", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985867, "uuid": "851c0999-95a6-46f4-a2b2-8940f5631f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985867, "uuid": "1b09f8cd-3f7a-46ad-9c5a-da49c011071f", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025f725c-63d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780991912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991912, "uuid": "e82c62fb-f21e-4216-9b0f-49116b8a7493", "comment": "Malware payload", "value": "326d09a0de3f864d9ed0865e2dba6aa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991912, "uuid": "98ebdaee-56a5-41cf-a9a9-f9ca539c8ad3", "comment": "Malware payload", "value": "fa190db01fcb238a0da3e113cc71980bba56f237524621b0e291bf6e6a9de8fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991912, "uuid": "d5d862da-d3c5-4e3a-8b92-1f0507e7014d", "comment": "Malware payload", "value": "1c74c5822da039df098619cb4178d4fb165600c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991912, "uuid": "9c34691e-0c50-4aca-80c3-4be0f8b8c52a", "comment": "Malware payload", "value": "600e094cb5412c6fcc7110acd43069e0d155749e017ff2b9d1681178b9945811b99bafefeda97a8d9780c2cde9fd8c7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991912, "uuid": "40a27b80-47b9-4d8e-8e46-c1af46c162ff", "value": "T166F307C7FD00D9B6F809E3374853080AB130BBA254925A777257357FED3A199187BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991912, "uuid": "1a1a64ea-9657-418d-9d48-a79256cbb9ce", "value": "3072:LoL8mzY3id9IgP4HoJryp0ABOgG/iVHoHw0KegWVEjbiaLpVUbxdcOD:LojIsIbHsyptBOgGKVPJegBLwAOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991912, "uuid": "5e58740d-72be-4a28-bcd2-052398573f77", "value": 162456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991912, "uuid": "d56ae6d7-4e27-46b3-88ec-6c49b571a76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991912, "uuid": "07a2da81-c163-4ee3-b110-7f144eb3d0a1", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e1b94e-63d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780991512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991512, "uuid": "8b19e59b-17e1-4937-bbcb-83b81d394e54", "comment": "Malware payload (Mirai)", "value": "345e7414e7a754f68f47fe5c602ffde2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991512, "uuid": "2c1370e6-ea38-498e-b2f1-b429b4060d15", "comment": "Malware payload (Mirai)", "value": "fa7ad8e284647673323e2ebc990f1039b7e8b57de2a52e5020017419eba4f286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991512, "uuid": "9329ee3f-c422-4632-a012-659c814bb2a1", "comment": "Malware payload (Mirai)", "value": "531c5c7ef1c983bcb35e50c8f31135a4477b4f2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780991512, "uuid": "7605bfd6-3963-4354-96e1-ab9ea2877a0d", "comment": "Malware payload (Mirai)", "value": "c1c96108bfe1312ed54376b3b10c1a241aa8050ef44dd2809e5ac481e4985403ce891be7cb7f2f637ff693cddbc86dae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991512, "uuid": "957c6910-f814-42df-84f0-92ceb5aebedc", "value": "T123D30845FC514A23C6C652BBFB5E428D3B2627E9D3EE72039D216F24378685B0D3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991512, "uuid": "db319d04-0ba3-4004-8669-90aeefe4a237", "value": "1536:ryEjC/Yudy9RsOuhigwD5R/AnFz4VUiAFTNjw9xqk9fr1olv2wywf9SjgDU7bpiX:ryEjC/QIigwdR/K4zkRjw+kpk4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780991512, "uuid": "6d8b9bb0-e471-4046-a8f2-8f8e0cbf0f14", "value": 141888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780991512, "uuid": "fbf59b3e-6fc2-4c5e-92e7-a2a0f4e4d520", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780991512, "uuid": "6a10806e-f8e9-4fbd-849e-64ec60b085d7", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b19b4e-63cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780986712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986712, "uuid": "cd336546-8749-483b-bb7a-a06fd538de8f", "comment": "Malware payload (Gafgyt)", "value": "9c56883471a8aa43d50756aa9a785423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986712, "uuid": "c7c3a138-3b2b-45ac-bf5b-4c97125ddbbe", "comment": "Malware payload (Gafgyt)", "value": "fb079b90e00e2f1a9005aaad64bfc2bc7695e5d2a3cad1a74c745199be57666b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986712, "uuid": "e13ae0e1-19eb-4b5d-9d98-87a5d86df9b8", "comment": "Malware payload (Gafgyt)", "value": "a4c6c8c9f26e5cabc010c5ca1b5f0b93c2be2794", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780986712, "uuid": "22c1d92f-6d41-4950-9994-9c7453603d36", "comment": "Malware payload (Gafgyt)", "value": "f50e05c2d0605c1cff0270b2adaf34b375669e54396b3d2fc31ffdcd1d9f26a81e2140a58f9af36a35b7d480578ff920", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986712, "uuid": "eb277e42-6d01-426e-bf3f-60bd7f0ca308", "value": "T1EA4474347E63DA73C45BEEB69AE96942964CE2C30B85970771F0C05C9BF684E14DBC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986712, "uuid": "fc57d5b8-a942-441c-9037-764c0ba94484", "value": "3072:/EgKihYGlEx0mL3z7HfcCnMdQbG0OOrVTHmKZkFMsKfyZ9:/EgykmLPAdKHVLmKZkFMsKfyZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780986712, "uuid": "dce2aeb4-f5e6-4a3f-b828-ec416a14cb47", "value": 276142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780986712, "uuid": "0058b6f2-f1b5-4ea0-a50d-ef11668984dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780986712, "uuid": "f2aa059c-7404-4285-ab47-c5f611e9540b", "value": "dissmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a4f08a-6410-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781015535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015535, "uuid": "7ebb455e-0323-47a3-b759-628e83716c1b", "comment": "Malware payload (ACRStealer)", "value": "5f2ad33e32f09edb92d48d19190f6a71", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "scr-proxycascade-cc", "colour": "#A780EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015535, "uuid": "f04a974c-297a-4e9b-8b9b-57108e461676", "comment": "Malware payload (ACRStealer)", "value": "fb1b7f255edf13dbf28bf7ec544738b409fc06f11bee20cbcd44af9581b759e7", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "scr-proxycascade-cc", "colour": "#A780EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015535, "uuid": "d7ac9f13-158c-43cc-ba31-b99be994d0b1", "comment": "Malware payload (ACRStealer)", "value": "d3173cda704d1def32c12e06ad2078d6db7f6402", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "scr-proxycascade-cc", "colour": "#A780EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781015535, "uuid": "0daabea7-e1df-4d68-be2c-babab9cdbc1c", "comment": "Malware payload (ACRStealer)", "value": "c7a6cb542c02a3a53ffc3e6e8610d6de844568815aa92b32264ee1d9df78d909bb0503643d238f5c19f542dd21cb6659", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "scr-proxycascade-cc", "colour": "#A780EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015535, "uuid": "4544f5c7-7dfa-41cc-86c4-c8fd6bcc9117", "value": "T1EA673399A95EDE42D82ACE3784570B8790F78F7D4857E00B239CDAC73CD6EE8524190D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015535, "uuid": "46975f26-0e02-4926-a6a9-cf1a271cefaa", "value": "786432:j3ZE2k7xM4P8AJpAJhlQmRbWYZmo0bcrdDmJ6Zs+r+aWZcn+uTOg:jpBgNAJfRSRbyDkOs+SbZc+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781015535, "uuid": "3d57f629-2477-4053-8f98-bba7f605173c", "value": 31590308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781015535, "uuid": "38f24bbc-7484-42eb-b32f-8736a27e35c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781015535, "uuid": "1581461f-94ff-4935-a903-322309a8e818", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1b9d68-63dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780993483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993483, "uuid": "f32d923f-1f2e-42aa-938a-13b43ead77fe", "comment": "Malware payload (Mirai)", "value": "3a3dc5ad648ef791a605449a1c7cb3f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993483, "uuid": "852cbad6-adcf-4743-863c-3d0ea6c11603", "comment": "Malware payload (Mirai)", "value": "fbd3f0376a827e88ee4a883f4f8aa761a00fa7679d760ed1efa2961bd1be925a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993483, "uuid": "cdb6bc8a-f199-4fb4-a6f0-a76f34d125b2", "comment": "Malware payload (Mirai)", "value": "48c78dfd81030640c6809a62fc5d78e07816dc07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780993483, "uuid": "801c32b5-36e8-48fb-9561-f24885069f94", "comment": "Malware payload (Mirai)", "value": "774503fd7fa9546bbbe8b30d5bec0748e55fbc62c90b820050702580c093f7d4b53183fac3781060d78c91e277b90ff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993483, "uuid": "ec473b87-a45c-42d9-b345-d2bfa631c679", "value": "T161430141D1233278DBBDA437CD0F0028FB2D744D65AB074B014D2B6E5CBA6826F62EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993483, "uuid": "79049fc1-7984-43ab-864a-64f437407340", "value": "1536:XMDLe+hAb9rJJ9VoNueek7FmB5ZZLEAbdW34crz:FRrJbVoNE6AI9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780993483, "uuid": "8eed99d9-edd0-4142-859c-624f50620621", "value": 55308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780993483, "uuid": "dc9d4dc1-4473-4578-a009-b396a4454e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780993483, "uuid": "c3cd2699-9516-4270-a95e-5942a8e99c4a", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651cb8b0-63d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780989071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989071, "uuid": "2f52bf44-7998-4a92-9f79-a32fc2832eda", "comment": "Malware payload", "value": "d9d914c35c5547d9c0833bc136448267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989071, "uuid": "4ceb6f8c-1604-44b4-b6a1-dfd022885f90", "comment": "Malware payload", "value": "fc1fa82e346529832b79fcba0be87d11d3f522aed1235682ad91d2684bf7796f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989071, "uuid": "6094892f-e154-4469-9c7b-06a469e42366", "comment": "Malware payload", "value": "b476d1d14c65a6c2c03ca28d20cf52b711432271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780989071, "uuid": "35457c6e-c574-4492-a3fb-578a33bd956e", "comment": "Malware payload", "value": "f6af3b26fb2330a554da309c80be6ce1f0a34f2f3058122c1334351fb7ad40b6146135a4d234e5e0967a2bd43ae36525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989071, "uuid": "fc3d6669-5b90-4f3a-9dc0-9529bbeb78c5", "value": "T18A15DF216E462F46CAFD5BB8C017185863F4DC9393A6E78B7FED01E96AA3B80CD17450", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989071, "uuid": "45863c0a-f310-484b-b7bf-e6f045cc80c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989071, "uuid": "b87d5fcc-e18e-4494-a57d-c028735c6a71", "value": "12288:WbcGRWA7GvS/eihr6SxehAezvByY7AkHBrvs2Vjz+8m/TaBR:OMva/tXeT5ySthrvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780989071, "uuid": "01416ffb-5bc8-49e3-91f6-1cdfd3037217", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780989071, "uuid": "c9bd123b-73b6-4073-8591-b9636c03d670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780989071, "uuid": "0b6be000-6f83-4024-9621-973d87bbfc0b", "value": "nuevo pedido de producto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ba67b1-6438-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781033040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781033040, "uuid": "32e41718-7472-46c2-b8e4-0550672748fa", "comment": "Malware payload", "value": "2fb2db449d2c71c2f1791f413b9ec50d", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781033040, "uuid": "81f0540c-67be-4d48-9acc-327f75416f64", "comment": "Malware payload", "value": "fc21359a3192b0c3cac7a192626e4d219dccc34c1b182955d87545ebc3a397a7", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781033040, "uuid": "873d81ba-a7e9-45c5-97bd-2333de6e8944", "comment": "Malware payload", "value": "6cdaf9e742c36548da26e49ff99c9394b891038c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781033040, "uuid": "086ce9a1-cfa3-45e6-908d-3d135afb8197", "comment": "Malware payload", "value": "07118ab538cf380656a27bfff8506052ade450a0407e3b2f7da1da73cff83dea676167ac59d22e8ef5de759661528c90", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781033040, "uuid": "aa8013e8-1237-48e0-a249-4db939d82b66", "value": "T19C067C07B8B009FDC065B23089A367667B757C494B3223D72B51BA782E73BE16D7A314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781033040, "uuid": "17448002-e2c8-49ad-8fd9-b4c291f9961f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781033040, "uuid": "89e9b4f1-c9f6-4679-8fe1-03cb1b34ab94", "value": "49152:TZbZE07UgSfm63q+SyN7RZXln/z6hi1JAVhud8c:TTMeI7Rf/z6hi1WV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781033040, "uuid": "67badf87-4d6c-4ef7-acd5-acdda1b30584", "value": 3896200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781033040, "uuid": "62771470-124c-430e-a1fb-28a0372d1acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781033040, "uuid": "f147671d-00fb-41ec-9a32-1cd737aa58ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9581f37-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780985803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985803, "uuid": "97879b25-c963-47cb-8410-d5ab5f69357c", "comment": "Malware payload (ConnectWise)", "value": "f2c561097d0b0af30915fffd813b2200", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985803, "uuid": "36c47532-4f44-4155-9584-555a2d3ab374", "comment": "Malware payload (ConnectWise)", "value": "fc7bcc7ed1f749d8acd095b8ed605b479beb05cfabe44b7837ad429476eb4f40", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985803, "uuid": "22813ac7-6a08-4f38-bc12-c6c0dc278e44", "comment": "Malware payload (ConnectWise)", "value": "4cbbfc04f2c974985bafceaf7b89911ca0aab9e0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985803, "uuid": "71e0c792-5c01-467d-af3a-1574edcee21b", "comment": "Malware payload (ConnectWise)", "value": "9354bc6897132fface749945f59d2292780646b3301f0635fbb0ec166c4b8c49c9f76f4e8d99490b26e766106d97a88c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985803, "uuid": "21905b20-c58a-4ff2-9961-8ab43151c3dd", "value": "T1EB646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985803, "uuid": "966a3915-abac-4f32-ace4-1070e7f60765", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985803, "uuid": "05661fd2-3c7c-4ef4-ab16-1f55fab4c351", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9Sf:A1iw7gryNkSV1hy1Z1u2JLu9Sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985803, "uuid": "9598e5a1-857f-4411-b0b0-985befd12da6", "value": 313928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985803, "uuid": "d5b68661-27aa-43c1-a0e8-d821dde22767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985803, "uuid": "ae877cad-744c-4e7b-a83c-2e96d2f99378", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d18c78-6449-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781040048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040048, "uuid": "355f8ba1-1778-4e19-96eb-db953011a92b", "comment": "Malware payload (Mirai)", "value": "4b888cc656b4f9d32d859a01127b95c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040048, "uuid": "def0df6e-5260-44c9-b8de-51e16e3073d7", "comment": "Malware payload (Mirai)", "value": "fc9b9e7f0f0a4df76fc9106b8d62565bbb8b03c7e00083c1db917bf463b6fd1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040048, "uuid": "64426a2b-ffe0-4f82-9f38-916b78798135", "comment": "Malware payload (Mirai)", "value": "653757c4e603cafaabf8c5dd0b1e21e9e4524850", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781040048, "uuid": "613dd19e-aa20-4a82-8d91-6f7560493090", "comment": "Malware payload (Mirai)", "value": "c6dc1c1b09fc2e82185c602e44e33728424b1bf8f9b189ffaca23482bcffe21dfdd7444ced561962275ab27142fec2b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040048, "uuid": "24e5f14e-048e-4f6c-83c6-b2aa91dac5fd", "value": "T12E242B46B9819F11C6D016BEFE1D128E332717B8D2DF72129D205F647B8A96F0E3BA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040048, "uuid": "33e4c592-0051-4b0d-8b1f-b23e1f00c6ba", "value": "3072:eaD8aZxcSZcIWgXdl5zvsdUtXUim9lzX+lHqCaDwgYZWeJJSBCrmZ28IJGL:X4aZ5KIFxf18zXgHBagFJJB6ZJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781040048, "uuid": "6de52f91-227e-4bd3-bbad-3e8b1ae435fb", "value": 216188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781040048, "uuid": "c34dc69d-79e7-4998-8a0d-6d562fdd12ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781040048, "uuid": "8ceab259-4739-4c03-95ce-a8921b9596da", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed9e292-63f3-11f1-a769-42010a9c0008", "comment": "Malware payload (JhnamRAT)", "timestamp": 1781003100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003100, "uuid": "4cf9d220-a14a-4070-b68c-746043291438", "comment": "Malware payload (JhnamRAT)", "value": "1570c5d37ff80e72da4436fa9a67c490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JhnamRAT", "colour": "#B48395", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003100, "uuid": "6f57546e-1b61-458d-9eb8-6c1ecd823b12", "comment": "Malware payload (JhnamRAT)", "value": "fc9ddd332188f2e256d155c4d4d9f5d819f034fd6e0b63f978f8ea8b60c86f40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JhnamRAT", "colour": "#B48395", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003100, "uuid": "3c16af29-e724-4116-ae61-e9257073afb3", "comment": "Malware payload (JhnamRAT)", "value": "6fc7d5e3ebf90a5b3d3814e2a1ee4fa9a75ee4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JhnamRAT", "colour": "#B48395", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781003100, "uuid": "b8cf09f4-260f-4975-9de0-c4426f51c227", "comment": "Malware payload (JhnamRAT)", "value": "a11029aec56bf1ea635b86ce974447544dc5635baf80cd17470bf3b0052b7ec20b9f742d38399e01b2cdf131f6f6ffb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JhnamRAT", "colour": "#B48395", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003100, "uuid": "82f31c84-b115-40d8-8766-4db2f258a00b", "value": "T1FD63184977F8C154E2FF9A7878B156504A32F49B5E22D74F0CC3549E0EB27A08A14BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003100, "uuid": "b6b0bb3c-bcaf-4d9a-aaf4-1acbc4318c87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003100, "uuid": "0581f91d-51f3-4c6a-abfa-bc03a132519d", "value": "1536:bgJ3S6ixpqgVl3E1JwnQS8jnoiQ2C9yAwmTjO77uXTjEMM:b63eVVISkK19yGTW7QEMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781003100, "uuid": "fff9802b-cd2d-406d-8db4-12b7cf740f23", "value": 70447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781003100, "uuid": "44eb4948-9368-4ffc-92d3-e5d629c1b063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781003100, "uuid": "ce12b217-1765-4431-ac1d-857a1758f771", "value": "fc9ddd332188f2e256d155c4d4d9f5d819f034fd6e0b63f978f8ea8b60c86f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d4d4ef-63ce-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780987549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987549, "uuid": "946e6733-4606-4a8b-a71e-beaa13591e5f", "comment": "Malware payload (PureLogsStealer)", "value": "3975a07be7e6725b4f49e687208f738d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987549, "uuid": "363672e5-48d7-49c5-91de-41a38ea5ef78", "comment": "Malware payload (PureLogsStealer)", "value": "fcf0dc8ac4514016c2a03850a1012b9d9fc4932d03624e77c03609f696dd5f4e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987549, "uuid": "57c31dc8-2f27-491a-81ab-1cc811b764cb", "comment": "Malware payload (PureLogsStealer)", "value": "3be7bf7107fd30546e3ac1d2d2692a3e892c21f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780987549, "uuid": "8153175f-f71d-490a-8324-01c8eac5c4a7", "comment": "Malware payload (PureLogsStealer)", "value": "d14b3806710d2760c896495cb324d2361fd128cc624282d84a247da48cea64a1a74651f9a6e0bff55a28242a827ddb5d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987549, "uuid": "11b8609b-0034-49e1-88ae-95f13d921595", "value": "T1C505F93DD924422EE172C21CC59A081FF8A2699B532CED5720C2275F5EA384777D27AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987549, "uuid": "26457115-101f-434a-843a-13db58315dd7", "value": "3072:2Z/R5mCqMTGUgzkk/ZjNDFnTyKOSfx0M23FTBitSUnyGSjm+GOIZ0votM/pagsGj:l9Xwgd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780987549, "uuid": "8e6f70f8-1969-46d9-9b40-b7300b8e6dcd", "value": 851996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780987549, "uuid": "73e499c0-ea2f-4316-b4b2-3d3a46fef524", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780987549, "uuid": "3b059459-91e0-4a3d-b255-4b3ed13f88f2", "value": "shipping docs 3432891094.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ffa1fb-6403-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781010088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781010088, "uuid": "6636145b-5568-4b1b-8a00-0e7984e3e1a4", "comment": "Malware payload", "value": "8449281307fb2b174aa28aec01e34f51", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781010088, "uuid": "95a28b9a-9771-40db-ab59-bc538894abb6", "comment": "Malware payload", "value": "fdad4d873574148a8922eefa156a2906b2e6737e4a3da56d09581acafe18aa2a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781010088, "uuid": "becb400c-e948-44d4-b42b-5afd940e867f", "comment": "Malware payload", "value": "f38849d9a1737a09e31adec19acf60d6a5227ae7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781010088, "uuid": "adf2c4ce-973d-40e6-a225-57cabfd3d3dd", "comment": "Malware payload", "value": "5576505254e07f49191b761c0066781226ab459456d428f94e4ef3d34eda58513f8582ab18382b86fd2d6d7cdcfb5265", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781010088, "uuid": "3acbcfa3-3e1c-4f52-bf4a-1f1b505395f4", "value": "T100D4238FE765868780208F7F9665866842DD94196B7DFAA7C0BC44F413C2FC7A486FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781010088, "uuid": "ceda6d17-a7b9-4a1f-9824-94bcf6b83b0d", "value": "12288:EnbeWS5kYukBQTdpGarSqlTk/ptOImJkAp8GqFsvGK53shkMNNV2D:b+/6QTdpXSqWTmXCWvGo34kMt2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781010088, "uuid": "45092c5b-178a-41de-979b-92c370d82c0d", "value": 637891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781010088, "uuid": "611ca5f4-646c-4ee5-a8a5-ab453363aaf4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781010088, "uuid": "f6532184-8243-43ee-85ec-0fa7c08a13b9", "value": "Update.js_pw_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d161e8-63ec-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781000484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000484, "uuid": "917f8503-04c0-4c7a-ba72-bd5da69e8059", "comment": "Malware payload (PureLogsStealer)", "value": "055a3198c4095bacbcc3096a6b37db67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000484, "uuid": "19c669fe-62fe-4889-adde-3f159074fecc", "comment": "Malware payload (PureLogsStealer)", "value": "fe7e8c845a0dd067aede7ab14cb46a27a11967601bc65f00015a7e14449617c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000484, "uuid": "346d47ff-ea0b-4808-8c17-001d927e33de", "comment": "Malware payload (PureLogsStealer)", "value": "a229381d048f9a681af0cb27a28aaf9969799f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781000484, "uuid": "5051ce0b-9579-43c7-9b12-6bd458b28c28", "comment": "Malware payload (PureLogsStealer)", "value": "dd7c17d6cb8e29712140cd241609fb17cd52a50dd0744f52d5458a562e203f25acd86b39044000e14c402227c26d5e98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000484, "uuid": "22750aba-152e-4ef8-b399-1b1db93ccb02", "value": "T166F4CE1B77668E21D2882233C5DB150183F56547B637E70E7981239B2D033BAEE4B79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000484, "uuid": "0085fd41-f17f-4d14-837e-c55bde80f6ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000484, "uuid": "f24850fd-e694-4202-9fa6-091531587775", "value": "12288:KPx1VR05kBY+/AaeihkIWbPhV1uM3RXLtsrjNdIrmZ:IektYae6kfPhVAMpOrjMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781000484, "uuid": "816b1a47-8981-4d9e-9a9a-552db6d949b8", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781000484, "uuid": "8f88559c-9ac6-469f-932f-c23958c95c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781000484, "uuid": "ca51ae5b-c80c-468f-a062-6591d07e41ba", "value": "SecuriteInfo.com.Trojan.Mardom.MN.9.92136217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b318186-63e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780997269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997269, "uuid": "01aea23c-f070-4fc2-9050-b63611480a5a", "comment": "Malware payload (Mirai)", "value": "ca3e1bb1ae783a02a8aa70e28b662325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997269, "uuid": "8348bc64-3c8d-4950-baca-4862ea9593b3", "comment": "Malware payload (Mirai)", "value": "fe7fa34fb798f6c5a393dedba2bd93f116e3d4ed2a31b1c19cbd8aef93e3600f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997269, "uuid": "371d5f69-b6c1-42e6-a5d3-8a8c3a1a8f03", "comment": "Malware payload (Mirai)", "value": "9a46b0a4689353491cd267df5e1cf1d96b744389", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780997269, "uuid": "8b154c10-6109-4007-bbf1-d842d658a3b8", "comment": "Malware payload (Mirai)", "value": "10f4797beda5a9baf956ae16504e183a211f368093b88c86ba42e15c878beed9791d4854395ba067dc708312e979c0f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997269, "uuid": "6cbdd63b-616f-4fb8-bbb1-fd8dee26fef9", "value": "T143D30985F8514B63C6D612BBFB5E428D3B2617E9D3EE72039D216F20378685B0D3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997269, "uuid": "0d02c892-99c2-4151-baa6-f4bcdd7cce94", "value": "3072:R6RbVZyXci8bgBgx4LD81M9oS461/6h2Yb:R6Rb6si88Kx4LDYM9tZYh2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780997269, "uuid": "76bb6563-4fcd-4025-b477-8843ad7e905f", "value": 141888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780997269, "uuid": "56a62497-ec3f-4a13-b508-099950be1422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780997269, "uuid": "e084e1be-ba74-4de8-aedd-235a3ec546ce", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8d4991-643d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781035011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035011, "uuid": "2a930aad-1899-493d-9daf-24c417a39aa0", "comment": "Malware payload (Mirai)", "value": "1c8adcd3afb54936a4b2fcc9b758e85d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035011, "uuid": "48a9797d-a017-427f-9010-bbfcb84a653c", "comment": "Malware payload (Mirai)", "value": "fe881b113553bc326ea71db1d6d853f2a6ac386c984ae6e0d7b92cf38dea12cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035011, "uuid": "d57bf178-26fc-4652-a7ba-9fbec0689f39", "comment": "Malware payload (Mirai)", "value": "0c5a7813bf0467cce215950e9c887987e9c15368", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781035011, "uuid": "d7ab7ac3-642f-4dfd-82ed-3f0492787c35", "comment": "Malware payload (Mirai)", "value": "f19a5c84ef9bf450b41a493547f5fdbe85f13fcc7a3d9577c3e6da6dbcab365a4ca8f4452da256f5603d845ae3d9e082", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035011, "uuid": "4f12cb8c-4fb9-459d-8998-545b5b8ce981", "value": "T1F1432A31BAB11D2BC8C4987A72F34725F2F5478A20B88A1F3D711E8DBF6498036572B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035011, "uuid": "1061970a-2877-4b67-98a0-85f9a3c3d92d", "value": "768:sS7zOtva3YgFk2Vr5FzfZHRuMbdO+YmG5V+VWvrplVU1tWyIg:sS7/3fNVr5FzfWiYP5sVWvstWyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781035011, "uuid": "a5e40594-6608-4d32-9e50-fd541ca97f2e", "value": 55760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781035011, "uuid": "a64a4a2d-5487-43e8-be16-a7d9ebe286cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781035011, "uuid": "ecaa126f-8ecb-4bf2-803b-995a4fbdd8e1", "value": "godisdead.9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ed1442-63f5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781004153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004153, "uuid": "e6e5276f-34ab-457b-94fb-c2d11b4e26ff", "comment": "Malware payload (ValleyRAT)", "value": "1dd50444b4a4757997e45c27dcff2da5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.q", "colour": "#CDA9C9", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004153, "uuid": "931ce02a-f04e-4e41-9a16-5555253bed2a", "comment": "Malware payload (ValleyRAT)", "value": "ff1f5951d79e751c14aa0783f819f861f2e7f105b66bf485bef85874dac3b41f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.q", "colour": "#CDA9C9", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004153, "uuid": "bd0d3562-59cd-469f-9eb9-a1c553527316", "comment": "Malware payload (ValleyRAT)", "value": "fc154d07e28dc7eec471ff22cc435c671b3877a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.q", "colour": "#CDA9C9", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781004153, "uuid": "1e465311-80a4-463e-9e51-96cd900ca034", "comment": "Malware payload (ValleyRAT)", "value": "5c4df24219ebb3e1fa430ec277a4ec140ff46edc3b6370c997a8dd361866cf517060fe8c17a42d2b9010b2297b78630a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.q", "colour": "#CDA9C9", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004153, "uuid": "8ce070b2-0c1e-4653-a063-852892d80db2", "value": "T1BAD7BE23F4424039D6D302F19ABEBA2A96FD9A35033855E757C89C494FB05E2B73A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004153, "uuid": "4e1e365b-cc32-439b-991f-394454307164", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004153, "uuid": "c4157ee8-3c1f-45d4-adcf-9ec5271a9839", "value": "1572864:FfCriBYeujdTMWh+5QjyTezIQH+i1N9qdADiU9P:CDjdTMWhaQjyl6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781004153, "uuid": "a6f699c4-8d00-4928-83fa-0a479042ae6f", "value": 58201264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781004153, "uuid": "597c2904-a16c-4a26-b24e-9fcac8db7db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781004153, "uuid": "91387867-cfe6-4da6-b743-ad83dae675c9", "value": "BaiduNetdisk_8.4.0.103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dbd859-63ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780985802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985802, "uuid": "ddae9d6e-2db5-458f-931f-67686933000e", "comment": "Malware payload", "value": "cd0e9c3553a4db320e04ce656956a0eb", "object_relation": "md5", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985802, "uuid": "5485305f-8d73-44b9-8273-042c70abc5f6", "comment": "Malware payload", "value": "ff6bc22eb4abe070bf83a80f53e42fffe709de1b58d54a5a31e27656001e46ae", "object_relation": "sha256", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985802, "uuid": "263016c1-c6f7-4e44-9ef1-a22833632aa2", "comment": "Malware payload", "value": "faee3fe96e9e08b974e5f938b6147526fcb5b983", "object_relation": "sha1", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780985802, "uuid": "9b783fba-2266-400b-9b79-43ee6781b86a", "comment": "Malware payload", "value": "580640e2996b44a8e452ef54bc41152f2e15219c45b95ad98aa8fb0ae7625cd576727c839d7e2550b01ba2953c824839", "object_relation": "sha3-384", "Tag": [ { "name": "80-66-84-51", "colour": "#F186B3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sergiotrabuccocineasta-com", "colour": "#D72D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985802, "uuid": "16c71206-1621-4b3a-b561-0bad950ef4c1", "value": "T11705E93DDC24822EE132C618C59A085FF896294B522CE95760C3375F5EA3847B7D37AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985802, "uuid": "01fd245c-8d08-4aed-b1b0-7f1510189425", "value": "3072:uqHZIoLYsbA5Ij+JcS2gGJsdvbkDpyzonNFXh0AumWdS+uXROQgT0SYf8lVxa74z:rTAmSRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780985802, "uuid": "64c255a3-8c89-4226-880e-0ac049c2cdf6", "value": 801684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780985802, "uuid": "f42467e9-217d-446f-a5a0-509fe3ca553b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780985802, "uuid": "07c52562-8921-4a15-98ae-018ec229519d", "value": "PROFORMA INV RAFEEQ TRADING #270427.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }