{ "Event": { "published": true, "date": "2025-04-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-04-07", "timestamp": 1744070582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "99dd5820-4743-4331-98bc-aee15645b443", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d037c95-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (PureCrypter)", "timestamp": 1744017201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017201, "uuid": "6eceefbf-a621-4ba5-867a-471ebaff70fb", "comment": "Malware payload (PureCrypter)", "value": "385bd46ece889fd71d99f24ed5cc04ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017201, "uuid": "5ecdbc93-499c-48ec-bcad-1ea8468ad53f", "comment": "Malware payload (PureCrypter)", "value": "00fca9198cff344d892b0bdbc5c196349e0917847fdcb19f26f10455298393a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017201, "uuid": "254902ae-4f95-41b9-b527-b6f1ec558587", "comment": "Malware payload (PureCrypter)", "value": "e661c243843cbf4d17df03b3300a15ff3f5089e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017201, "uuid": "cc86a897-cb71-42b3-ae83-f2738eeeadf1", "comment": "Malware payload (PureCrypter)", "value": "6c61014722cc16fde69c2e50ed19527bcc3b6d37d05391a57f617f67e99cac067b78259e37bb4788f9e8cba5035571c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017201, "uuid": "ea0562a1-8c49-4891-8ac5-87f34d8409fd", "value": "T1AEA3D807BA4EC9A1C641D77BE9DB0B8413A8E581B283D73E344E275E09077BB984DE17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017201, "uuid": "90890359-7caa-45b0-a75a-a728a8a83492", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017201, "uuid": "cbbe2ce9-3aba-43cb-b2e3-1a68e156db1f", "value": "1536:bhvk3IXOY9iksg1sYxqwGuYvBIGQmDLRnvAFn+80AbIFa/:bbOY/1sYgz53LRnIFf1bIFa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017201, "uuid": "6244289c-734b-4771-a76b-eb1c35f4c682", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017201, "uuid": "48c17199-4276-4141-8042-19dd0e31c206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017201, "uuid": "5575b7b1-26f7-4c70-9dce-eb64d43d8366", "value": "SecuriteInfo.com.Win32.MalwareX-gen.8036.23335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91bf9ba-13af-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744030669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030669, "uuid": "312af57a-cae1-4477-9292-b62b7c569eb1", "comment": "Malware payload (Prometei)", "value": "643dee100de37125ab76aae3216a3260", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030669, "uuid": "a8048832-1aad-4c66-a21c-59db3c83b6ac", "comment": "Malware payload (Prometei)", "value": "01643abb842f21aa7adbe515d79828163409db6dd264b0533b3ea5f384e0f2cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030669, "uuid": "f599ab52-c638-4906-b4bb-cadcc028c396", "comment": "Malware payload (Prometei)", "value": "db67dd066869a8450e8151b2439d5dca48b3d5f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030669, "uuid": "60357666-ed1e-4f84-afe1-8ebdf6df279a", "comment": "Malware payload (Prometei)", "value": "4521f2e42eb0de3037f402e5fed23dbb41e884422a383b124df9c87f64291a5648b86d6dd1e4c55fceb2cffd51ea97a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030669, "uuid": "0449ae9b-f8dc-4553-a68c-5faca7485b6d", "value": "T1829423F8C87D2E30D8169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030669, "uuid": "cf1a6f1b-8f27-4056-ac91-30b4d6b235ef", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgn:25WOSACZSV6eKRH5EPiamb4DsDwwc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744030669, "uuid": "8fdbf251-52d1-44c4-a7ad-fff299939a68", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744030669, "uuid": "829610a2-ccef-4e2b-b378-c91320388505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030669, "uuid": "9388d275-5f01-4f63-b98c-8d5c32cb3cf7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fca6e0-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034441, "uuid": "184df118-9e72-4d39-8150-84efd3a34e4a", "comment": "Malware payload (Formbook)", "value": "7b3f1ba4aea7ddf469a6aa70c1b12ac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034441, "uuid": "b4e0885e-38f9-43ba-a32c-f3243534dc5d", "comment": "Malware payload (Formbook)", "value": "01b99e0d35462bb3802d64c1ce918fe78bed30c77ddcf2e9f734abd8f14fc6e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034441, "uuid": "59ba5531-d8a4-40e8-af47-0f09d7363732", "comment": "Malware payload (Formbook)", "value": "e81937aee541439426a97a9b5344d8e00fab2c30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034441, "uuid": "9a62c542-da7a-46d7-a747-02821fcadcd1", "comment": "Malware payload (Formbook)", "value": "bff27ac17ccb0a04103afa7a859ec7bbb9e3f02a60c5f773ed1b8988f1e2d15d0935bfa5890a3961b72ab322b801b35b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034441, "uuid": "69fe8d1e-38e7-43f7-b5d9-5aae98e01d1d", "value": "T10545BE2273DD8360CB769173BF69B3012EBB7C654630B85B2F883D79A970161162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034441, "uuid": "7735a761-5096-4ab9-8b61-640f5752ace1", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034441, "uuid": "8d45b297-753a-421c-b6a9-085fd70b73f3", "value": "24576:Cu6J33O0c+JY5UZ+XC0kGso6FaWDwttEnsHV9HL6ctWY:ku0c++OCvkGs9FaWDwgnWDrcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034441, "uuid": "a6fc0bac-bf8f-444e-96a7-d4ae709814bc", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034441, "uuid": "2b084709-3fb1-4882-8c8f-0e0b9a2732a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034441, "uuid": "1c885e62-2651-42a4-963a-02e2055b75b7", "value": "01b99e0d35462bb3802d64c1ce918fe78bed30c77ddcf2e9f734abd8f14fc6e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11349a95-13dd-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744050064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050064, "uuid": "fbe67f77-7259-401c-8ea1-81aa73c031e5", "comment": "Malware payload", "value": "20418ce7d39839b06adc0e185d13b008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050064, "uuid": "903a800b-e544-4c03-8deb-94bed0e6697b", "comment": "Malware payload", "value": "033fc3fc30442f41b2ade8d0830b3a08ab3036210dfcebf909401e342de46b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050064, "uuid": "9eabc43a-e195-4936-a78e-07fa33081e6f", "comment": "Malware payload", "value": "afe1082a49a9a7e1de768d87eda4ac92bddd907a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050064, "uuid": "4ac7e0b9-4713-4b0b-88dd-1182d0277589", "comment": "Malware payload", "value": "3ae9b257be774396386b9bc43fd78b82d2eb41ae0e3377fbd5903c76c2da4e277397d95e2560461d71ceb62f67e41d0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050064, "uuid": "821c0a91-c193-409a-ab6c-7b9c111fc733", "value": "T17795CF23F2CBE03EE05E0B3705B2A15494FBAA256523AD5786ECB49CCF751601E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050064, "uuid": "f0fc11b4-172e-43fe-b137-f62f80629074", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050064, "uuid": "e1963749-7f18-4117-8441-b9617f6bb541", "value": "24576:waE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH1sNf+MH5JaFMWHIta3+8Fk86Y1ol8:0+MRvHS14Ju+ekQoEcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050064, "uuid": "f97d5b38-0991-4375-986a-62b23d5b628b", "value": 1914651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050064, "uuid": "39958a73-4535-4831-8ce4-1986e3da25bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050064, "uuid": "0514a28e-162e-4b7e-ba1c-c769bf99aa0a", "value": "20418ce7d39839b06adc0e185d13b008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd736c85-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028476, "uuid": "88aad069-40b9-46bc-b2a4-129d9b54d385", "comment": "Malware payload (Arechclient2)", "value": "1d670753e89d61c11933975a5909676a", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028476, "uuid": "98eae954-c0c8-43d7-85aa-232b4e8eebae", "comment": "Malware payload (Arechclient2)", "value": "039a96ae63d12777c79f84242b1b6687c557ff5aa063f8de414ab9d5c9ff9d04", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028476, "uuid": "3c3eefa2-ed34-4f9a-b17c-2c00cf2a7b14", "comment": "Malware payload (Arechclient2)", "value": "42f0862ddb4ce57c6eb9a56e4c8f9422d6a3fb65", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028476, "uuid": "05fae0a1-b7d8-49b1-ae07-17d5cbbdc17b", "comment": "Malware payload (Arechclient2)", "value": "fffcf7e4ddfd79da065a48edc8e55bc9fde119f2210e546a4e196b9d1291de14c03587578e149c7623fd760ffad43839", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028476, "uuid": "95e3bc7b-8dd7-4f65-98a3-cd9800e8ab83", "value": "T1BB27BF11FA82C135E99F017299BEA7BE953DAE20033485D7E3C869691D71AC33B3135B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028476, "uuid": "acc6a763-0e1a-4e9e-9277-9b232dc5e761", "value": "393216:D+SX8B1Ph7xmLySZGqM/RrIKo9MGRJ7S4Ul0:D+NPh7xMo/RQRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028476, "uuid": "18db5db1-9026-49bc-bc90-1230def88456", "value": 22247084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028476, "uuid": "e6608e17-2af0-41c5-a8c5-1b14a4456c3f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028476, "uuid": "b5f4c829-7296-485a-97f1-ea6d8b463075", "value": "msi (2).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7a2dcd-134b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743987428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987428, "uuid": "454d7696-cdf4-431e-a7e8-01cb5f29365a", "comment": "Malware payload (Prometei)", "value": "b07607865fbddf4e010a6e0ff2b6ec45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987428, "uuid": "d566dde6-8919-4077-928f-5ac1eeb960f1", "comment": "Malware payload (Prometei)", "value": "0418b0ae5d26f283a1aca13e8cf29f7e2f9d7aa9e97b08bc5ade7d871ca8991a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987428, "uuid": "15e0aba2-597c-4873-aa5d-ffd632171cf2", "comment": "Malware payload (Prometei)", "value": "185786bece50616408904e31a94574a3986d6803", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987428, "uuid": "0bf2e71d-35c2-4c97-be80-087df7149f7b", "comment": "Malware payload (Prometei)", "value": "e0bcf124dfef8de572829c9e52a494359d0359cf34626bba547ee436e88891bed285829f376b4b48b043e038d3b256fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987428, "uuid": "b7feb48e-2e6f-4702-89b1-2fea05848ac3", "value": "T1649423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987428, "uuid": "227ac43e-9f88-4d92-826c-fbfbe0cf7f2b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgh:25WOSACZSV6eKRH5EPiamb4DsDwwcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743987428, "uuid": "8ad46525-2398-460e-99d7-6fbb73d97e3f", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743987428, "uuid": "27bff344-77c1-4484-976b-8b5602dd1633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987428, "uuid": "010dc3c0-db3d-42ab-b1ce-1643b8023a92", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ce0303-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload (NetSupport)", "timestamp": 1744050766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050766, "uuid": "73a72c90-924f-4cb9-808c-c1145152b21c", "comment": "Malware payload (NetSupport)", "value": "1b1521f76dc2d1a101e430d465bf5959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050766, "uuid": "3afafa2e-9093-413e-aaa6-6dff1c151827", "comment": "Malware payload (NetSupport)", "value": "044363ef24d3eee654758490d6370fd1fbe211d8f508db31986a3a23dd4fa8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050766, "uuid": "6d1b3ecf-160f-447b-8c22-47044af583af", "comment": "Malware payload (NetSupport)", "value": "7ebdca7a5e1a43e5506155636f5b1c182898eeb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050766, "uuid": "6fb09211-0e52-4e50-bd83-0a15552b2b93", "comment": "Malware payload (NetSupport)", "value": "d964bda94c716e645f6053bf7c202a43d5e14ca4d37f5976579b011412b90cbbd38b8ffc1ad92913fb98875b4b46e523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050766, "uuid": "8c7e641f-afbf-411c-9858-5245337aebf9", "value": "T1CB35BF037381D072FF9B95334B9AF6115BBC6A260123A51F13A82D79FE701B1563E6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050766, "uuid": "2d7976fd-ce11-47a1-8fd2-359803b04c63", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050766, "uuid": "55bbcb2b-78a8-48d8-8d0c-0656f621765a", "value": "24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8a+IWIjCLeYomVU:ATvC/MTQYxsWR7a1mLBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050766, "uuid": "457cc649-e4ae-47f1-8a51-7fd4c98bed7e", "value": 1059744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050766, "uuid": "2a2b76d5-a9b7-425a-95af-71be09f0b5ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050766, "uuid": "6999b600-4b23-4d29-98c2-0d6ba6713c23", "value": "1b1521f76dc2d1a101e430d465bf5959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2d3b0a-13bf-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744037548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037548, "uuid": "25d68b14-548b-45bb-bfad-3a2be8601710", "comment": "Malware payload (LummaStealer)", "value": "d70ded23e2ac6c1bc0c91f6cbcbc3357", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-140714", "colour": "#F281B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037548, "uuid": "a5882990-1a9a-430c-90fc-2b7c8af430ea", "comment": "Malware payload (LummaStealer)", "value": "04a6a10ff7c8e4cf0ab5d28910ca3e96a2bfd5080e60e08f95f19c22371f88ec", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-140714", "colour": "#F281B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037548, "uuid": "bd881d73-5fc6-44aa-a031-48ca9926c8bf", "comment": "Malware payload (LummaStealer)", "value": "f903fc9c7aac6992bc4ea0cf20457d09dbebf841", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-140714", "colour": "#F281B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037548, "uuid": "b287ab4b-7c2d-4f4b-8639-7ab2b33c995a", "comment": "Malware payload (LummaStealer)", "value": "62dec76f1bffb7527ccf819e7b841acec7f532560e896fcd271703e1cb24326fd5bc89c7cc87138ec288b343d53800ea", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-140714", "colour": "#F281B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037548, "uuid": "7c1123b0-5336-442b-8456-1843c30705e9", "value": "T1DEA63389217E04FB7B2911A5AF9705E06DCFF44472D321BF9ABCF690250BDB1C8AA50D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037548, "uuid": "99d6b0b0-71be-4ac2-b46f-3fad8f910b8a", "value": "196608:S1f23vZswjEHfjwwzvy6357pxMJoh2kv/weE+gYES0hkQnJcGt:SF22rH7wwzvB35TMeh2kv/wcx0htnJc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744037548, "uuid": "918500fc-0a17-4f77-921c-b8eb70cfc9bd", "value": 10263467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744037548, "uuid": "b0443333-a9c4-43d4-8f44-f47b3f45c692", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037548, "uuid": "e5691b0f-bee2-415d-90e5-2dd6745bccb3", "value": "\u00abF\u00eeleReadyPassW\u00d6rdIs__140714\u00bb.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee53e40-135e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743995541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995541, "uuid": "5f0b07d7-025f-4dd5-a756-e564c37aa749", "comment": "Malware payload (Mirai)", "value": "a9d5f1eb5f9ee995f3e4575617a4c300", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995541, "uuid": "d5afb702-32a1-4123-addd-aa344f391d84", "comment": "Malware payload (Mirai)", "value": "05bb60d449ad9d849e3303ac5c01e6766cb9fcfdb2b07e4bb1bd1f3b41bb3950", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995541, "uuid": "a87023f2-3ef4-4c71-80d3-d8f79eb5fa7f", "comment": "Malware payload (Mirai)", "value": "1e2f79e32fc00797e53b4f03fae98265e1ad73ff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995541, "uuid": "5b05bbbf-7051-44be-a60e-5a2e470aebf4", "comment": "Malware payload (Mirai)", "value": "de47ecd7cc4d57f85e404f1fae9b1256f1813afc94083aff75b80f1956734d9ae89e412f88662251d5c13f7ad48603da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995541, "uuid": "4bf19b77-f763-41f8-a191-4ecd7b1bd1a0", "value": "T15E01FCCE0158CE7624854DEE7193591968CEC4CA1BCD8FC520DE08B9E4CDF0C7467E66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995541, "uuid": "cf0126be-2812-455e-a1eb-8e0ac72962f3", "value": "12:3rWKIw+u5ZMoOF7+MB05whPO+hPNDNkQNYhIyT+hIygDNkQN8Tvn:yRk5zOt+MB0OhDhDkAYhYh0kA8jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743995541, "uuid": "96bee362-e6ec-46cd-821b-7e100d42cefa", "value": 700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743995541, "uuid": "77f52619-78e7-45bd-aea9-1359ecb56c95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995541, "uuid": "b2790a38-f1f9-4c65-8a03-53bdd752f2e6", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a8051a-137f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744009967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009967, "uuid": "fb44fabe-97bf-4783-86ad-98c9d5ad3141", "comment": "Malware payload (Prometei)", "value": "02573390f4fd85b3166efc2549220237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009967, "uuid": "9d185f8d-e70c-4492-a891-95756ac5989d", "comment": "Malware payload (Prometei)", "value": "05bf49e36152ad6da1c237c11e03a1f145124e4c211ee7fa4e81045f42387554", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009967, "uuid": "59b344f0-492c-4d55-ba28-59dd7013ddb6", "comment": "Malware payload (Prometei)", "value": "1a750fd15683d1b7918ba137a20daf1f75db50aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009967, "uuid": "9cc81e36-79eb-4643-88be-bae871a5e27a", "comment": "Malware payload (Prometei)", "value": "8ee80ef384bbc83d40bf8f739665c68976eaca57f2f0a7442f9e28aee1384ebbfcab42ffc6ecb132330aa2c36314798f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009967, "uuid": "78892dce-c535-4ef4-b1dc-68b566e941a2", "value": "T1489423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009967, "uuid": "1e8c0f89-e6c1-4d46-9691-1cfa575d6323", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744009967, "uuid": "dd112e69-8209-4958-acf2-7bc24495b594", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744009967, "uuid": "3b46e9b1-4320-4e4a-abb7-ce02789f7736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009967, "uuid": "9811d795-1e9a-408b-a834-394232e95eb3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dc2258-13bb-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744035815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035815, "uuid": "e75ef870-42b0-41e0-a6f5-fd9daf8f4558", "comment": "Malware payload", "value": "9c698bc65874403e5061a07a1a555c30", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035815, "uuid": "e7a06cf2-f462-49b4-8103-947a17abbc5a", "comment": "Malware payload", "value": "0631696f484633f4aeb8f817af2a668806ab4dca70f006dc56fc9cd9dcda4dbe", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035815, "uuid": "89401f3a-06b9-4e68-a314-8226f272c7ba", "comment": "Malware payload", "value": "bbac780a1c333dcc06b613b5f811209f6e211ba5", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035815, "uuid": "b374cd6b-8247-496b-abf4-bf45143bf536", "comment": "Malware payload", "value": "fca9cb15a8e95aa2270eba9e2d1dde72f486f9880a6767d60cd26381edc351c379e300319563441d48dfbe44d5385966", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035815, "uuid": "60d37247-8d13-4dff-b47d-0d4b196b982d", "value": "T110542371B2064397C134BFFC63CA13E46100A779D2BA6A6C620DDCB0BAF7A4805E5775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035815, "uuid": "c26d8aa2-d9b9-4a48-85bc-73caa70e86ca", "value": "6144:IP25HSAhmWDY6GAzL1cDU4hWbO9lzE1r0ZB7PMM4upQXmRzMTIk0rBcNd+COEQHF:VHSn/6GwLi4wWKa0Zx14DXWMT90rBcPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744035815, "uuid": "fdf9b8b0-24f8-47b0-8983-80948ac03115", "value": 302912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744035815, "uuid": "56bf3aa0-f810-42ad-9bd1-66642eab71d8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035815, "uuid": "2b7df81d-bdfb-49d2-b62a-1e31da444c96", "value": "dowod.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5ac53b-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744034462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034462, "uuid": "6068169d-d162-4d51-a152-429f1a59d0e7", "comment": "Malware payload", "value": "5e3d92bc89daf148684410bd62fb76b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034462, "uuid": "5b54a27f-d58c-41ef-b0e2-5de827904e22", "comment": "Malware payload", "value": "063f0a0250ec1d8b0bde7c998dcb849df074380859bbf6814d1e72d95fa5ecf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034462, "uuid": "433bbefc-9f15-4ac6-95f6-7ae6b6015d5f", "comment": "Malware payload", "value": "ca1b8dc624d808846b9211a024049d61787d5eee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034462, "uuid": "1dcf9ea8-13c4-49a6-a00a-7a69561327ff", "comment": "Malware payload", "value": "d59db7b4d7b165c32c1a20984892ed584a872001eaa18243d7c0034a4b1efa40ec9c3096607a018b242f055d3c340105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034462, "uuid": "30abda85-38b7-49db-ab98-beafa017ca39", "value": "T1B26523072B8A8960DA84437BEEDF412073A4E0979713E71D39CA237ABC477FE994115B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034462, "uuid": "2bc9a7ea-878d-4610-8e73-cdee5f17d684", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034462, "uuid": "af5dbebd-17c2-4583-87ba-760c4de22d4d", "value": "24576:t40e/hW/Zbj7EETRdv/ECpZSgV0gl5j91WEfsuWcMAfPcCLWpOHL5orp6lXUw:t4LZW5MaPr0ijvWEfxPZWpQqpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034462, "uuid": "222b6cd2-a421-4967-b51f-a204ea5550cf", "value": 1522688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034462, "uuid": "a05c69c0-33c1-415b-adc6-49ee51448684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034462, "uuid": "3c25c37a-15aa-4473-8f4a-2a2ac0137086", "value": "063f0a0250ec1d8b0bde7c998dcb849df074380859bbf6814d1e72d95fa5ecf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2946652-1371-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744003949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003949, "uuid": "a955985a-9ed0-452d-a48d-56de545acbea", "comment": "Malware payload (Prometei)", "value": "8f792a11e47996905ace1a5d30679fc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003949, "uuid": "f6677ab3-fe2f-40cb-9702-6587ac6612bd", "comment": "Malware payload (Prometei)", "value": "06a53f39ccbb4a25a2820227ba764f187065d89678692aa1da278fb3bddfd7d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003949, "uuid": "903f1350-845b-4342-b680-d7acc01d334a", "comment": "Malware payload (Prometei)", "value": "2924c5d4ead05da3b87e5e3e0330bf8a0146a277", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003949, "uuid": "cf605dc7-8475-4003-9991-4506bdec5596", "comment": "Malware payload (Prometei)", "value": "fab9a6507acd4d6f107f2f4db815378ece028bd2546d27ab421d9a94275ea20bea2328269cfa0f714d6a612450323ab8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003949, "uuid": "d737d6b8-3d31-42f4-9b79-b8f1b2032bff", "value": "T1919423F8C83D2E30D8169B3CBB5A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003949, "uuid": "775e3d92-2785-4430-a19b-7ae98e60185d", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgI:25WOSACZSV6eKRH5EPiamb4DsDwwcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744003949, "uuid": "de82a2df-c71f-44c3-8bac-252a5d7205ce", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744003949, "uuid": "2f5bc330-7523-47b9-96bc-2c1de5b35556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003949, "uuid": "f54ad15a-4235-4bb4-95b9-b2b15dfca842", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767da19c-13ac-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744029189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029189, "uuid": "6795573d-5f91-4ca8-b905-a981e952baec", "comment": "Malware payload (Prometei)", "value": "9f78b415a670cabef9fcecf0fd168af7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029189, "uuid": "d0e0169c-31da-42a6-89c7-3004aaa59c30", "comment": "Malware payload (Prometei)", "value": "0718c2577c009e805b0f2584f406f0f5abadec96ec54fc4017617bb3809197c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029189, "uuid": "577e2183-0b0e-4494-8f43-253e7ea4abd1", "comment": "Malware payload (Prometei)", "value": "5643c30437e78615697cb6c9867f5d723549735a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029189, "uuid": "a03da5a2-9f30-4597-a200-56b38ee93330", "comment": "Malware payload (Prometei)", "value": "ec35e77a343168767a41739898589a3d918cb5655cca0a126b45b37b700e750fdcebc3410b215a45e35272746de942cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029189, "uuid": "64592bf0-6872-4bb6-9829-2c14e32306c5", "value": "T1BC9423F8C87D2E3098169B3CBB1A826CF0A15772D9562B7EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029189, "uuid": "fc14a2d4-ff99-4c22-98ba-376d69b63b5b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgd:25WOSACZSV6eKRH5EPiamb4DsDwwct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744029189, "uuid": "38000a9f-c3c9-4630-90e0-27db7e098555", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744029189, "uuid": "eeee8e38-7661-495b-ae79-4dcf428151dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029189, "uuid": "ee73ffa4-7ecc-4dd5-a968-316125a4cb8e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21688984-13a6-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744026469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026469, "uuid": "4c0cf170-5aa5-4212-9fdb-15cbeff05b01", "comment": "Malware payload (Prometei)", "value": "be3fef5af27221f8268f651198a78ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026469, "uuid": "511fe18f-318c-4042-ab7a-ffdeabd2f4bc", "comment": "Malware payload (Prometei)", "value": "07ff063a3cd27fed2160581297418ad7e4d2e465538cc559f32b01aa79cd10f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026469, "uuid": "08c0080f-4f71-4eae-abaf-0f4ad7f00077", "comment": "Malware payload (Prometei)", "value": "a7f9494465f9ca44c1915646597d7f203898e22b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026469, "uuid": "de182564-3828-45e3-8140-5ac8c3a54779", "comment": "Malware payload (Prometei)", "value": "0621f6e4ba9de7fbaea5b52169ffa44c4d7be67390d4be4805673c7c0af051ae4186582520ab3101e28a9b0e6fd38862", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026469, "uuid": "f7bb5291-43f4-4b1e-8031-e8e83ed6d784", "value": "T1919423F8C83D2E3098169F3CBB5A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026469, "uuid": "14fe2012-439c-4add-895b-9b5b5e130e6c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg2:25WOSACZSV6eKRH5EPiamb4DsDwwcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026469, "uuid": "5a4d5ed4-aeb3-4fb7-8209-589abbd278d5", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026469, "uuid": "da96c709-517b-47a3-ac2c-7bed6bfb729a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026469, "uuid": "acfb0f81-e557-4c03-adb9-47062fac4d44", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a95a577-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744011130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011130, "uuid": "c8fd1048-2f57-474b-becc-301f7b5f843e", "comment": "Malware payload", "value": "1f02a3a3f523336a94bd6b5fd66c4b71", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011130, "uuid": "87241682-2266-4609-8cb2-9aa4edc5b1af", "comment": "Malware payload", "value": "08ca4a8862c3ed65df4a548ef1bdcbf8baa49b1243f754da4c68a843edcf008a", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011130, "uuid": "56a88900-e933-4c35-a87f-7992ebfdcb77", "comment": "Malware payload", "value": "cb1c8a6b388058754affd60fb8761fc1a1d399d5", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011130, "uuid": "7cefb316-3a25-4700-ae5a-fdabe742184c", "comment": "Malware payload", "value": "cee547de740e5df165e4a580f601066f977dc4f6668a3b567d67c4ea343fa786096670a77f28aa34da40f63990dc3af6", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011130, "uuid": "cc57aa6d-d153-4b27-96f3-d7dea488c30b", "value": "T17AC08018E642C187D650740592B4B825794D785508D3F4DCA343DA9F5D830D1C0096A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011130, "uuid": "a62c7c34-0d0c-47e5-bc27-6805235330fc", "value": "3:HRAbABGQYmtK2IqKxS18PKgVK2sWHKs7V25YdimVVG/VClAWHyn:HRYFVmtK2OxS2ygVK9zs7A54vVG/4xHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011130, "uuid": "598eb705-db46-49ed-952a-bbd89f1cd6f7", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011130, "uuid": "b0d79849-2766-4999-ba4a-bb7543f2037f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011130, "uuid": "740930ab-7383-48ae-bc17-529f8315f8e6", "value": "1ZT6830487493.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb00511-13c5-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744040072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040072, "uuid": "df2fbe28-b33f-4ff1-b1c7-b4f8ac9bc094", "comment": "Malware payload (LummaStealer)", "value": "67d6bb4de69c44b296aac22dd87513d2", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040072, "uuid": "5e3f5b09-5b60-4ae5-95d4-724bb484d519", "comment": "Malware payload (LummaStealer)", "value": "096103be60d25ea47f0240b5cacf3b7c7dd6a751ac283a0dbdaf2075e5e52724", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040072, "uuid": "c30c4e72-34e2-4f2d-a8ae-04da18dab0d6", "comment": "Malware payload (LummaStealer)", "value": "363739567ed65f88287af64f775ccc529177cc02", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040072, "uuid": "3f175ad0-ed54-4c59-9c00-d0fbf5743c0d", "comment": "Malware payload (LummaStealer)", "value": "e7238e00675733f5846ef68fbf8d4804e568fc3632665acb2d8d09d83cf12e99ddef123703f8df53471abe28dc9034ef", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040072, "uuid": "d06bde3d-6220-4ee0-85fe-0011d3841c03", "value": "T111D58C537AE2C2F4ECA56BB2D7BC29FB5815DF20D77800D7A695BC8936308E3563401A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040072, "uuid": "4d4ee4f3-90b0-49ab-93d1-ee71785ca2be", "value": "f3795cbabe5b17ca0ff8bab74bf7bda9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040072, "uuid": "294b7432-54b7-49d3-9e2a-3c95b1a4c853", "value": "49152:k34CrAQwp9kDrib8qbdDtshgX4z1TyGMe1M7d53VUFDKi6SqCa+nl76+JN:kxAvkSshgX0DKi6SqCa27l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040072, "uuid": "1386e005-9807-442c-8ff9-92b4de10f649", "value": 2834432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040072, "uuid": "d7f78602-4f41-44e7-9d87-d22afd87044f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040072, "uuid": "e7980fbf-670c-4fdd-bd7b-fe900d89c4c5", "value": "n8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78ed203-13eb-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744056464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744056464, "uuid": "9ad5338e-c79a-4a05-88dc-9448efa97266", "comment": "Malware payload (Prometei)", "value": "71d6347e3f45ec61f0c5296e46b2aaf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744056464, "uuid": "fa756b4f-8d80-4f8e-832d-285c5095df8d", "comment": "Malware payload (Prometei)", "value": "0a43e84eb79abac3a3198b04a5f3dd0cfe2a67bcbcc5067aac87d2a9346fb9c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744056464, "uuid": "e032237e-ffd7-424a-af4b-ddbc72977ae6", "comment": "Malware payload (Prometei)", "value": "554e3db19cb25b71374f426b532a69bff062e722", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744056464, "uuid": "d9d6a2e9-dcf1-4552-a107-7509495db28c", "comment": "Malware payload (Prometei)", "value": "ceaa8cffc2607e2b15cf819b984f8644de451192c4bc1384d947dcb0f48745c83677b4b53fdad9ea5c24e4287495f294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744056464, "uuid": "190c2fbd-c6c4-4605-8e5a-a898360375a0", "value": "T1619423F8C83D2E3098169F3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744056464, "uuid": "5136eade-68ba-4d2f-b37b-3df95a883bd2", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgy:25WOSACZSV6eKRH5EPiamb4DsDwwcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744056464, "uuid": "661654f5-d669-4ba7-8c38-11f473f4ae58", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744056464, "uuid": "f40d6829-22f5-4e00-9cd2-57e0dcc8cced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744056464, "uuid": "1b1de0cf-d199-444c-b49e-72e93e18462c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7554763c-138e-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744016302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016302, "uuid": "fea30e67-94c5-414d-8cf4-35bdcbb18657", "comment": "Malware payload", "value": "3394fc2ba0a976818691751aa7f86d05", "object_relation": "md5", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016302, "uuid": "4b0b5c68-7291-4d38-a951-980ea0739a29", "comment": "Malware payload", "value": "0a4777725673f9f7114ddceddd80e5a72ad3a4d20fd2014d4c60e2cc1a6cefc2", "object_relation": "sha256", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016302, "uuid": "e193bcad-3fa3-44a9-864b-11adaa2bf80c", "comment": "Malware payload", "value": "c03ff877cebeb395b18b123c4782bb64b91f4116", "object_relation": "sha1", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016302, "uuid": "6ccc6cd3-48b0-4e37-9cd4-d1ed8c7b164b", "comment": "Malware payload", "value": "a0e936556599016cac048b474f75b1e00b086b988b8f7b0c3191e4b2e1b636f92e1b7b9908c490f1c38326c3cca75ba6", "object_relation": "sha3-384", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016302, "uuid": "7506162c-3c96-4ef3-8ae4-bc59a39d8c83", "value": "T19C2523039A01D326F6AB8F745122739CE6701E6A838AD317B520B7FF401EC9765568EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016302, "uuid": "92d2f733-5b0b-42c6-9345-d187335d1218", "value": "24576:NpZ15RZNQCGAHEUVtK/221AYebLqtLK6yTgilRL/es7q:N149q9a/2mAYeStLK6ysilR97q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744016302, "uuid": "7d82f2a4-8fdf-4f3f-84ba-d412a509355c", "value": 1006681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744016302, "uuid": "e0b2001a-f55f-43c8-84db-8d52a8335185", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016302, "uuid": "3e2ee5fe-4f95-4cb2-b8b4-1e348aaca6ac", "value": "\u0410\u043a\u0446i\u044f Defender ARMY (2).xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b306741-135a-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743994032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994032, "uuid": "27392b73-b11b-4f15-96d9-c40eb8168de1", "comment": "Malware payload (SSHdKit)", "value": "43229860da9ea8c6b8d0edd03f667518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994032, "uuid": "5e7b1ae0-85ff-46fe-a13b-3cb2c2b2303d", "comment": "Malware payload (SSHdKit)", "value": "0c4f1d3b32c16816c22ee73fd36dc2a2aa2a58878e57cfdcfba4f7787e6014f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994032, "uuid": "dc9c53b3-488a-42fd-8d8e-83107e5d9b3e", "comment": "Malware payload (SSHdKit)", "value": "c64fabe9382471270fa225e3e61d7183d9d93e12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994032, "uuid": "c8da2cd5-8fb8-4d65-b86b-95b406be02b5", "comment": "Malware payload (SSHdKit)", "value": "5f3264ce927c0809c90459af9d8cfb0c5143e3300c8a5866797dd08c9c193b21612249876980c7a48d6238ac3eaa08c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994032, "uuid": "36990d9f-c69d-4141-b654-3d00c057a04d", "value": "T1C1356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994032, "uuid": "7eeaca69-e856-4127-93a6-694ecf974e6b", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxY5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO38mTfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994032, "uuid": "1afde2bc-c0eb-43c4-858c-24838c0b1ac9", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994032, "uuid": "5c5ff9cf-46d8-4b85-b98a-6027b9223ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994032, "uuid": "fb6ffd87-2363-4d8c-8143-ba411319b927", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb341b9-1365-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743998839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998839, "uuid": "7b0d2be0-209b-492c-89dc-6461382dd98c", "comment": "Malware payload (Mirai)", "value": "f60f285dda243fb5e86dcc89e69c8d3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998839, "uuid": "21c18a11-de66-47f4-804e-fc1038f7c32a", "comment": "Malware payload (Mirai)", "value": "0d0ae699f8037d178299b083c10629509468f99370c959d9bc1c86ad2555e95d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998839, "uuid": "9d3c9507-72f6-43a1-b520-8eec8acbd243", "comment": "Malware payload (Mirai)", "value": "2a829050d06372f0020a5fe94a2d7b43bde074c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998839, "uuid": "44f5acbc-8dd1-428a-b341-73e20357d53c", "comment": "Malware payload (Mirai)", "value": "224fb4566f351d9ff135c753599171ada1f1968de92370d4c0d151fa523e2b79014d883aa55cd589904655e61864fd02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998839, "uuid": "563d792b-0133-4133-bbef-a2056c284d6e", "value": "T1443302E5B3D0D39182D641368B121057278D3F3BD8B7362B2AE02516BAE975375FAF02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998839, "uuid": "60ba72e8-b6c3-4884-bc5a-2e315cd07692", "value": "768:ELx7pImovw4T0pu2HIPQsljegSA1pAuODwkWzDFG+Ij/isLgmQWMyaksisEs3Uo1:g7Evw4TCjeHSierjWPEMmQvHNzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743998839, "uuid": "51a9ce94-9b61-4fbd-87f2-a6c8d952f9f3", "value": 53904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743998839, "uuid": "bc4e10cd-9f09-4561-a43c-2c48bc1aaa28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998839, "uuid": "ff9c81e6-6fe4-478d-ac79-31b216c9fa08", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ccd5b6-13d9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744048414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048414, "uuid": "1bf9a67d-e1f1-4a6f-85a2-2233e79b8dc3", "comment": "Malware payload (Formbook)", "value": "0586178af06804183b2acf594e9d5d1a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048414, "uuid": "fd6486df-3bdd-466a-b233-8990465d8c78", "comment": "Malware payload (Formbook)", "value": "0d87620349f64e98b49ff306386a61b37734957f82c7ad40ab6c77122e9e5c7f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048414, "uuid": "2e7755ca-a281-4764-9d41-592e1db24e68", "comment": "Malware payload (Formbook)", "value": "05889e9b894805dc32adad64f8b3398ad121fb6f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048414, "uuid": "517862aa-4955-43f9-afec-9ad00533ab2a", "comment": "Malware payload (Formbook)", "value": "e89f5a155137017d6e9a604aac4d7fe37bdff3577186aa78eba4eb8406148d80e61e1ae4f781a95909056b50f515f7fa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048414, "uuid": "c44bfdb1-2db4-463e-9256-1efb5aa0b536", "value": "T184E42345F257D122E8CDEB1D30DE269A60B8C04FC4ADBF502E51289F0B53EBD84AD758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048414, "uuid": "ac2fb179-fae4-4e9c-8eb5-3cd188dee5b4", "value": "12288:QHysv4HBb1m0qSoOrZCYqUGGSfop/xYMo0Qb3GBssK2Hu4K7YHmdY1:Yqb00q8rZCLCp/xYRrxsKeFK7KmdY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744048414, "uuid": "12350250-433b-456f-8d6c-e8f2b13b1690", "value": 686262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744048414, "uuid": "19cffd5b-6f37-4a5a-b957-4cf95fc00e84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048414, "uuid": "658f1a8b-6dfa-4ae9-b2df-349d68116597", "value": "PO For Bulk Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f136ed-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload (MeduzaStealer)", "timestamp": 1744011010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011010, "uuid": "4aa50cd2-a1f9-4ae3-8d91-3a050f746f4d", "comment": "Malware payload (MeduzaStealer)", "value": "4e60b8fda44637d99a1ef7b5735e0836", "object_relation": "md5", "Tag": [ { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011010, "uuid": "7e73251a-6e23-4a30-a94e-1d5a819f3883", "comment": "Malware payload (MeduzaStealer)", "value": "0d887985023951f732272facb706eafcef4afd0a99b5f11b9511b105484d7269", "object_relation": "sha256", "Tag": [ { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011010, "uuid": "3d0fcea4-f00d-4d27-8c83-c57b1e38baec", "comment": "Malware payload (MeduzaStealer)", "value": "4d60c40519c2e31587934288e7041e3698edaa23", "object_relation": "sha1", "Tag": [ { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011010, "uuid": "22dfe296-6693-4abc-b804-0b0a0416a012", "comment": "Malware payload (MeduzaStealer)", "value": "ac0c396321e52f724e7663c13a8a6caf99beb8174e8ab3daf1f9c117b998b845fabcb4fe536d74e977c96e8e880d7c5d", "object_relation": "sha3-384", "Tag": [ { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011010, "uuid": "f22affba-71b2-4ded-ae87-08e4d446e650", "value": "T16D6733A56C7DD4E071BA55AB69139702CE7D37CBA588AEAF78731A30312022373FE055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011010, "uuid": "e9f2f421-3e32-4cbc-8825-b48e86b55ab9", "value": "786432:Gc1MP8JIRCQFiEa0X+eFsE/dE/12/YIs3ZPbKuwXavPO6tFQzwbzXQ:GcfQAEaBE1Q2/W2uUaHftFQzwPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011010, "uuid": "992451fa-d6c6-4786-8068-a2f15f33e0fd", "value": 30398660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011010, "uuid": "8e261089-843d-402a-b08f-38da8dd19a43", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011010, "uuid": "12537837-4054-4175-8f93-ba5657c53301", "value": "Macro-Hook.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd688a0-1343-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743984181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984181, "uuid": "905c8871-17fd-42ad-b546-378af9181285", "comment": "Malware payload (Prometei)", "value": "a73411cee0b4175a17a6906f2302d906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984181, "uuid": "a6930c00-1934-4c52-8d1c-e10efe0b98bd", "comment": "Malware payload (Prometei)", "value": "0d9ab3ddb20a28cea7aaa991faac60a04c831f80cff6a9c42762655ed8894434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984181, "uuid": "344be3f7-7794-4b7d-961e-4ece5c2e59e5", "comment": "Malware payload (Prometei)", "value": "bf0c3289be87a802aed019114f7bf2dc5958ddf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984181, "uuid": "15190562-8fb7-408b-89bf-97a5d6416556", "comment": "Malware payload (Prometei)", "value": "d861ce147c2afca3af29bd4e742c845184f03993017a388ba57c0bd9ba0835c1a7731388733d10ecf066e92fef100e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984181, "uuid": "e9dc9c78-04ad-496e-87e8-eb763b76a56c", "value": "T1809423F8C83D2E30D8169B3CBB1A826CF0A15772D9562B7AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984181, "uuid": "f04e71ba-667d-4165-a997-72a10e7fee8e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgJ:25WOSACZSV6eKRH5EPiamb4DsDwwc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743984181, "uuid": "8d209e6b-7f04-4c20-abc9-0b3301768432", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743984181, "uuid": "76e79054-bb9f-4cb4-9fce-27919362a773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984181, "uuid": "af46d894-7767-4b9b-a859-f789694dae0d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe0928f-1362-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743997341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997341, "uuid": "c3f62b26-abae-4850-a0d4-017fab58e4fa", "comment": "Malware payload (Mirai)", "value": "659a441fb5d03828d0e1dcdc8e94515c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997341, "uuid": "6375f86a-7d6f-4773-af59-64b592f296b9", "comment": "Malware payload (Mirai)", "value": "0e878390d0a19156525789562bacf861294b18a9308312e4a9c943d6e900ff44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997341, "uuid": "b1a153c1-29f6-4862-89ba-fd61fa26f641", "comment": "Malware payload (Mirai)", "value": "bf70af5209d2a89bd12c9a9d4b148ddd9b4af02f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997341, "uuid": "e5198069-ac2a-4f0b-a272-e32b3d1c462c", "comment": "Malware payload (Mirai)", "value": "13ee876baff10205d6e76413bebeafd98697176cc569b1dcc92ad5836168fcee8997a9668f2c79c4304a2ee15309d9fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997341, "uuid": "1b550fdb-29c2-439a-b5c0-f0dc9301482f", "value": "T15CD2E19D76C262FADDC9CB76300E4075B08A789D63F5732A7309CE43066B381DA61D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997341, "uuid": "16f73a37-f61f-4865-898e-ba48c1173b9f", "value": "384:Mod/PxEDLd2TwcAzT6lowYcEaqsM9udC4h0LwnoAGgkEtojN6fQKTBNyS:rlxKd2dAKxEnsMEkCBFtoBOTSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743997341, "uuid": "ad7d64c2-c5d4-40ca-8ec4-d9120f886963", "value": 29448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743997341, "uuid": "d9206550-2851-4178-bacb-4f67396481b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997341, "uuid": "9b5b9c39-5ca9-4df9-8b0b-a79ffb191241", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8f281b-1350-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743989843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989843, "uuid": "c8b3257f-03e5-47b7-afc1-62bc49b24e37", "comment": "Malware payload (Mirai)", "value": "2eb38a246cde0b2c24223b7c2b16a277", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989843, "uuid": "19d2c6c3-1c7a-4722-810a-29ccffcf516b", "comment": "Malware payload (Mirai)", "value": "0e8a5361959bef83ea2f86ec6b31347be8c56b3437907d22bb56e3100375d7dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989843, "uuid": "f5ad62c7-7d0f-4ee1-8790-588ffc0b8103", "comment": "Malware payload (Mirai)", "value": "c90745934f182e8e305e65f7e0a1dd9215bfc3ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989843, "uuid": "a3666ffd-6f2a-4ea7-9fb1-441ef04f6578", "comment": "Malware payload (Mirai)", "value": "baa060500b8a6d9cce797d5c8fec3bd4edbea24fbae99423a781b9f92e6e87bad4332b48315905c4781ba0fdf048eb2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989843, "uuid": "696d674a-ad22-4d2f-9469-682740b26376", "value": "T16753F1EDB22F7EC2E2F51834E43E0225BA94614217D64BC967114CC9A41D98F7E9D0FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989843, "uuid": "572a742e-8de6-460f-a7c0-ca2ebcd37e43", "value": "768:xgeuCYTh/gFL0cTg5DPHtA1u2wJYoDPl+Kvu4BtmBsA0GCH8WAQ478Bl6kJ0KqZu:ejTVsLY5DvtA1uxuBBVSH4syK6TID04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743989843, "uuid": "cdd16a9e-7a5d-4882-b2a3-fc36cf1dccd3", "value": 61268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743989843, "uuid": "a6bc9302-2904-4e75-9441-115475a18c3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989843, "uuid": "78dbe251-9900-456b-98a2-a7f898d7df37", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c843a892-13bb-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744035768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035768, "uuid": "7d4cdb7a-2d46-4475-b178-f71fedcfa846", "comment": "Malware payload (Prometei)", "value": "7103502897c02362d13ff94ab666ab9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035768, "uuid": "f759a917-b3a8-4e97-a165-510349ee16d0", "comment": "Malware payload (Prometei)", "value": "0fdbe22bb71e3a40c5b20de0cea7c46aa5a49ad26bb66c716a31fa73e66b9338", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035768, "uuid": "3b0ee9d4-dfbf-4783-8173-52ed9c7913ba", "comment": "Malware payload (Prometei)", "value": "cbcc1293e00ea66530e592846a932a1466b4f785", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035768, "uuid": "0f0880f2-9255-488b-bd14-ae767b657eea", "comment": "Malware payload (Prometei)", "value": "a7bd44904352a3f6a47b8fdadc568798295411b2096c9be7c5ddd6134bc9caa4ebb06173244acd96d5ebe488874178c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035768, "uuid": "f3d78529-e064-4218-aa70-51412ec0dddf", "value": "T1C49423F8C83D2E30D8169B3CBB1A826CF0A15772D9562F6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035768, "uuid": "f7adddaa-92dd-4866-8121-a407eec299a0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744035768, "uuid": "f00b7e49-f705-4167-a6f4-44874d08fd6c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744035768, "uuid": "20df1fdb-4016-4b11-a6dd-5c2557405157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035768, "uuid": "b9eed115-accd-42a5-9fa8-73375580a98c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a686e0-1392-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744017831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017831, "uuid": "e52cf581-6e17-4dc6-afa1-e16e2024223b", "comment": "Malware payload (AgentTesla)", "value": "858e3093a128bfd8edb569858aee4433", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-concaribe-com", "colour": "#CC2B6F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017831, "uuid": "c937d2bf-6494-48e7-a2c4-34298db8783d", "comment": "Malware payload (AgentTesla)", "value": "0fdf6fd28e3d07c80e74e5c3c4794a5b2687044e1bbe8bb423168c7574dd01ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-concaribe-com", "colour": "#CC2B6F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017831, "uuid": "db11f6c4-64cc-4dbc-a3e0-1b0e3a7ebd86", "comment": "Malware payload (AgentTesla)", "value": "9833ee805fa16dcaceea689829047d3641bdf495", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-concaribe-com", "colour": "#CC2B6F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017831, "uuid": "df2509c0-369c-432d-a88f-4b4891f759b5", "comment": "Malware payload (AgentTesla)", "value": "745ebba76a268ee0c541aabd1c2b9f51ae2eef8678ca3b8ead205de1320b96167d008769c48a8679a33a6e3a1c077c87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-concaribe-com", "colour": "#CC2B6F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017831, "uuid": "a6a55a41-fdbb-4edd-bb9f-d4c4f6a64517", "value": "T138F25C61DD14062A4E4B2BAEFC950D71C57D82264A2B00A1FEEC735D1406AACF7FFA1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017831, "uuid": "59e10e21-a127-42ac-9bdb-c3708fa4f4cd", "value": "768:neifDkU2ZB8PMMg2vSJWlRRgTmusyh0mv34FT9VfQsx:5fDAD8k2SJkzc5f34B9V5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017831, "uuid": "53793eb4-390e-40d3-b954-d87f121693be", "value": 34235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017831, "uuid": "f0e40231-665b-4d7b-be55-03406b1f74ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017831, "uuid": "0511a21d-883d-457c-8af2-e67496244362", "value": "Boxerism.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12f0913-1371-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744003947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003947, "uuid": "c35d3217-d137-44aa-8c81-6e896f3b5b4f", "comment": "Malware payload", "value": "ded74a697eea15619058194573dd15cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003947, "uuid": "8ec6b8d3-0b64-4851-b58d-c62d46dc46b5", "comment": "Malware payload", "value": "10508873d38301fcb0c2068c74ef938eb27def95dc2953b7ee30ecb520d6b23e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003947, "uuid": "865291e8-1da0-4600-9380-0f0b78e6713e", "comment": "Malware payload", "value": "d747b8bbfb0e155030e24fdc257d897777a88ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003947, "uuid": "6dc01c27-8e04-428d-8887-0a11ed12e671", "comment": "Malware payload", "value": "4b954984ea652a1634094a2c794054dfaa4cd8677f4aed76196994a28ccf02ee5273e36d3432434175409ce5f4bea749", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003947, "uuid": "8856dee3-9084-45df-8fab-f2eebe36e310", "value": "T1CA02635BEEE2DBAFC0C92735045702B2C6AEC002E754A763935CA4257C2371EEF96719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003947, "uuid": "ff87433b-3f53-43ca-b011-d1a2984503e3", "value": "96:bblPgsaKRFFPtcryOSkVczjB66+5ZA4FjYaBdbd1JcQcWuYbh6jVNkEXBN:flPghAlcmOS9zjBT+5Of8db/SUh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744003947, "uuid": "6debf521-13e3-40e7-aa39-c1d645d627b5", "value": 8995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744003947, "uuid": "46db2f01-d093-49c9-b6d4-995312a61f6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003947, "uuid": "4b7b122f-4ff8-4116-8199-1607e8a54013", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc028820-1370-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744003643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003643, "uuid": "ec508e11-e8ad-4b37-a84a-4d93013bc11a", "comment": "Malware payload (Prometei)", "value": "f6821fe6bf765a501bf0d85224fba66f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003643, "uuid": "5f379ff8-cc0c-4579-91f2-ad82a4ae0a39", "comment": "Malware payload (Prometei)", "value": "10624fd8d2361c5bb2cce5ab0a20f82c2bf40d014d9813ecb5735b3d9b2f51df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003643, "uuid": "0c98e34c-0873-401d-a858-7dca05feeae7", "comment": "Malware payload (Prometei)", "value": "0d3991f6275561e241c4f1da8592c2aa87d4f27b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003643, "uuid": "0505cf1a-41d2-4d35-ab21-bcf7c521747f", "comment": "Malware payload (Prometei)", "value": "5bc62f10129f6025cac869137cf138ae0609a68a7219db81005e288c22c578564d793b91cb9b242e37ba97b00270fbb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003643, "uuid": "10714071-33a0-4a5b-bc13-71012ad875bd", "value": "T1329423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003643, "uuid": "8e343db1-ac11-4750-a6ee-1db82011e139", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgC:25WOSACZSV6eKRH5EPiamb4DsDwwcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744003643, "uuid": "041d5900-4935-4499-a2fd-24c142d4a4a4", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744003643, "uuid": "965e793a-e4a5-4d02-81aa-cb719640d15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003643, "uuid": "6335e10c-fb55-4607-8037-93ba868af2bc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a43f0e-1407-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744068456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068456, "uuid": "9eab6530-6475-4f94-b65d-160e4a4470d9", "comment": "Malware payload (Prometei)", "value": "cd166f4896b9fa0b1589f52b2c733f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068456, "uuid": "0cf4c086-c432-4ab0-a9c3-61314f8e6405", "comment": "Malware payload (Prometei)", "value": "109030686955bfe9475e7273a6ce087f1b62ecfceaba6ef111aecb7f3b87f8df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068456, "uuid": "8a0e034b-c403-488a-8b4a-8cfeeb4faaa5", "comment": "Malware payload (Prometei)", "value": "8e7db3afa4108c85f97023bd17d62524c25c5139", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068456, "uuid": "63a1acaa-0445-46ee-94b3-986201142a3a", "comment": "Malware payload (Prometei)", "value": "9b6e8f6677ebb1a78be666ab86f6e056166653aafbfdc62ab65c009025255cfdfff43412f9818e8ffa138d233efc06f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068456, "uuid": "8fb31528-baca-4744-bafb-c10ec3be8479", "value": "T1309423F8C83D2E3098169B3CBB5A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068456, "uuid": "d429ac73-e394-4c8b-95c3-4ea91e7bbc4e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgD:25WOSACZSV6eKRH5EPiamb4DsDwwcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744068456, "uuid": "ee29177b-1942-4384-ade1-39e8bfee945a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744068456, "uuid": "d3bf88b0-193f-4d73-9292-d1e87714f65f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068456, "uuid": "988268e4-d15f-4ee0-ac35-30468e2117eb", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2b6192-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744038724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038724, "uuid": "8488a088-501d-4338-b2e8-5acaf3efa42f", "comment": "Malware payload (LummaStealer)", "value": "542c8c0573d930276637310244dff44f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038724, "uuid": "a868dab3-ad97-4e46-8062-7bd7d31180c4", "comment": "Malware payload (LummaStealer)", "value": "109e5d6c6b3f99d4163e928446f9a113f7a83bac38c1e9f860910ef284c140ce", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038724, "uuid": "6723b044-b233-4c27-87d7-a0fcf13dc4c7", "comment": "Malware payload (LummaStealer)", "value": "7969c3da9b71295651fbdc8bdd5e53568db64e49", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038724, "uuid": "fec26e30-4e4f-471c-a952-1fa153f80ea3", "comment": "Malware payload (LummaStealer)", "value": "98923da10666abbbffd99a1710167a4a95e541cb6c2bfe0c57fc8a5803ea7d9e4c84801e16da27ac44aeae7ee55b3d06", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038724, "uuid": "e26199a1-2a3c-4fea-8a95-862d3376be43", "value": "T1BA25BE32F2A08837D1B31E789D1B82955936FD113F38A5A736E91F0C4F796817A272D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038724, "uuid": "e222bd6f-33ed-405f-bff3-3286c90bc53d", "value": "5ee7bf9f6582eaac86f806e2514790aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038724, "uuid": "32c58462-d1ce-49a7-ad87-b5a6d650e481", "value": "24576:GIZg9uiirPO37fzH4A6haDbcUZEbdT9TaWwtQ2FyxyRENaGW1m1HOu:GvqrPO37fzH4A6ha3cJ28FWuuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038724, "uuid": "088673e6-2506-4499-893a-67b6349d21ce", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038724, "uuid": "989d9e84-1937-47ee-b659-0bdac4f5bca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038724, "uuid": "1fa99934-9036-4457-b1f4-65710886c839", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6253b630-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744011116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011116, "uuid": "5bd7a7a0-7872-4a1c-9bb0-065e0071dec9", "comment": "Malware payload (SnakeKeylogger)", "value": "0f802da28856ece33e647575d93cd5e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011116, "uuid": "332a431e-9239-43fe-a8aa-c360df42c42d", "comment": "Malware payload (SnakeKeylogger)", "value": "10e48d3746e19506a456f75c0d1f2b0a6df191d01f503f1193cf9b57d59c8849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011116, "uuid": "54cdbb51-4d60-48d1-a58d-dca2ce4740e8", "comment": "Malware payload (SnakeKeylogger)", "value": "3bc45c07793e769d80e4988f85bef374d0399658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011116, "uuid": "2eaefcb6-fa76-403f-b571-0cf94e6f26be", "comment": "Malware payload (SnakeKeylogger)", "value": "fdb51350d3659d5b8d4156642e3ff8db50c9084d690f5ba47dd23c48b1163537bea30f8917d4fb829defe2f8a2badb02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011116, "uuid": "4849ccd1-01aa-4aa6-8285-d9921d24b031", "value": "T1C7E4E064336DED07C0BA43F51561D3B403B99D9A7620E3C2ADDABCDB38E1F845A406A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011116, "uuid": "5b6d6990-9e8e-4465-b3e6-ed979f52395f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011116, "uuid": "f974420e-c097-48e6-a973-b4289c2f17cb", "value": "12288:/Y4YqBCCwfxv5i+gFCtqZxHyJBwVe43iE1tXxkpgSlITuNeGmiRi:2fJvTaTyHUewJ1tXxk2SlGuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011116, "uuid": "9a99075e-366e-40a9-b0ef-e8505825fbd9", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011116, "uuid": "40756777-2e47-4fa9-ac07-af666057be6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011116, "uuid": "ed9f1cfa-672c-4685-bb80-fbb1197d88b7", "value": "241350882-CheckList.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae1de89-139b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744021975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021975, "uuid": "3d0deadf-7333-4df9-b2cf-e1d915321ed9", "comment": "Malware payload (Mirai)", "value": "831cd8a140b7f97b0c9584ea2d33e5c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021975, "uuid": "9eabcbca-e83b-46b9-940b-bef5938571dd", "comment": "Malware payload (Mirai)", "value": "11636d66da7f0307c50a933cdb6347c6ca6f40b2c34411085a0420a57e783abf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021975, "uuid": "a681e024-8150-4bba-af01-23acebb25e86", "comment": "Malware payload (Mirai)", "value": "65279bbfedcb50ca092288ec34b6211e89ebf68c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021975, "uuid": "96b9c3c4-ffb7-426f-a435-557f57040fdb", "comment": "Malware payload (Mirai)", "value": "87cab3b6c8890149643226a00664b4732d0ae6e8de6cad43c6186653e1045cdcd81f582115a8305b422b6fc92b5bee50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021975, "uuid": "eb82b6f0-f066-4533-afd8-929742119e2e", "value": "T19903E1947B978AE1FC2D0EF1955EDB8068C550EED0B36C76A6C26C386716B60348EBC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021975, "uuid": "1c54c3e2-566d-4d10-a79d-c9ebbe0b2cb6", "value": "768:UqDMGqFSw4UZG36bkq5Wa8tm5sxmlSj/Yypcn:HdqFfPO6bkq5Wrtm5sxml+5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021975, "uuid": "6d55cae3-ab13-4bf1-9cfd-4720ad5d7b07", "value": 38480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021975, "uuid": "90064b2a-8297-458e-94f2-8e92d6980a34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021975, "uuid": "3032c44e-ba8d-4592-885e-6be1e5f4a395", "value": "hanoi.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d11cfb2-1399-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744021066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021066, "uuid": "36b93c1b-e459-4ff9-899c-1e6d156ff1d6", "comment": "Malware payload (Prometei)", "value": "65ab2fbc36e293ef753255bb4f369e30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021066, "uuid": "609312bd-92bc-4a23-bfa3-09243ae2cbba", "comment": "Malware payload (Prometei)", "value": "1181dec1d7a5c76bbcffb9b16641ce9105cf3a91c70b75d0554333be045855aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021066, "uuid": "40ea3b1b-05f9-4683-8738-007ce39cbf78", "comment": "Malware payload (Prometei)", "value": "857d69590776c6d814c22397b75665739eb9a1e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021066, "uuid": "25f1be42-bf50-45e1-987c-1341dbc3532c", "comment": "Malware payload (Prometei)", "value": "7229cd65b3c2e1297d138a4e41b7a426e4074fd86b1e3dd7ec06f90201c8a5b661749246737bb02176da4d3567f5a520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021066, "uuid": "a69ec2a7-661f-4047-8bd6-d9c603fdde28", "value": "T1779423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021066, "uuid": "19ff13ce-4214-45ec-83a1-d7eb334b3500", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgm:25WOSACZSV6eKRH5EPiamb4DsDwwc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021066, "uuid": "b9a82c46-ebae-42bb-bb20-eed15bcb0dee", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021066, "uuid": "ad7e30d2-ffa9-44e8-8995-ad89af42f26c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021066, "uuid": "523cacc1-b43b-422f-af7e-9a53e5b58376", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46136e8b-13f5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744060461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060461, "uuid": "2180c6de-8ae9-488e-925d-0ce3cde09253", "comment": "Malware payload", "value": "6a9697be9d0764ef8314546449d4e229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060461, "uuid": "7e593fd6-14cb-458c-8946-23ff034359c6", "comment": "Malware payload", "value": "1261ad2cb8851ffc5978775f3148287df39d3967999240da753ba9ffdc46a85b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060461, "uuid": "25b60a39-7c8b-4979-bfd2-9d56be7156a3", "comment": "Malware payload", "value": "db9df399e42290651d81f6db17658697e0544e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060461, "uuid": "87e2c563-4fb0-47db-b1ee-2508ccb15deb", "comment": "Malware payload", "value": "aa3e63c96647fb342ddadc0183a22712b691490325ca7d315b284233e7cc08b51d0ea8a9a18f49583b3d5247e08ab353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060461, "uuid": "b1606487-96ff-480c-b722-e4f89c86663f", "value": "T16AA42A297FE58E04D580243ECABE2605C712E4F225026347370AFBA55D499EEDE6C3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060461, "uuid": "a70856fa-a8e0-4d75-a2cb-35c95e50fd8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060461, "uuid": "6f647847-2361-4df3-b940-393fbb2f87af", "value": "12288:v9IhDm2LKfEG/J0tR0qE2EuS/KqEXVHcd:0G/CtR0l2pbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744060461, "uuid": "a1ddfa54-72c8-4fba-8a77-c897e9bf4b31", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744060461, "uuid": "4358a8b2-9dc8-4371-821c-e23725aaa0f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060461, "uuid": "226501ff-9d93-4652-9b8b-9c7eda5695f5", "value": "fatality.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6032f8bd-13ca-11f0-ad17-42010a9c0004", "comment": "Malware payload (Vidar)", "timestamp": 1744042036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042036, "uuid": "184b2569-87e0-4bcb-9380-d68d1127c8bb", "comment": "Malware payload (Vidar)", "value": "9baf61196c985b17067f787d6373f142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042036, "uuid": "ba1565c9-a021-412e-b86e-0628a6975f02", "comment": "Malware payload (Vidar)", "value": "12dab9b1e693d996b00cd7812e3aa160fe3d85bd3441eb5655fd5f5d853984be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042036, "uuid": "7f0645fc-e9f7-43e5-b58f-be82c9e83757", "comment": "Malware payload (Vidar)", "value": "1dda434580f65aff8e0f9dbcd20a3e46c56db89e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042036, "uuid": "7ffaf0a6-6265-486f-be81-185131b19d9c", "comment": "Malware payload (Vidar)", "value": "9d60654e3e4f9e734c241b7b353e613dbc4ce8c90f21b2d5ac6bba9e4027aff72f942362d37286a1ca5188343f3957f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042036, "uuid": "b790d295-d9a9-4d0e-a65d-a747b75f9bfe", "value": "T100351DC823524647CE7B05B73FEA0EDDDA73975326C2929F2801F7B8A25A159435BF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042036, "uuid": "042e23b3-b48b-4e9f-a746-67d30041e83d", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042036, "uuid": "50910b2f-8cd4-4460-8d32-226fad784f27", "value": "12288:JtCOVG0JhTnUOucVcXpbjaCHgjD2MbbSnaF2KyGFIlqIhrEkoAbjKaA:JtC0G0JhTndBVcZbQD2MbbJBshyJaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744042036, "uuid": "123fd1ec-819d-4cbb-a3bd-197dcb38d065", "value": 1122194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744042036, "uuid": "bd948c78-a543-45b6-8aef-75afb804bef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042036, "uuid": "b2a8d97d-9088-4b9d-b0e2-986a0c7934ac", "value": "9baf61196c985b17067f787d6373f142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e02b80-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1744011204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011204, "uuid": "e409e481-7411-40f5-8ae2-ea222ece7659", "comment": "Malware payload (VIPKeylogger)", "value": "60f6e07b20e6da7322c729fdad326b47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011204, "uuid": "e86969a4-3cfe-4909-8622-28cc1688ec43", "comment": "Malware payload (VIPKeylogger)", "value": "12fddac7ebf3330acc85d3cbaf0bc87bf0a4123574ad43a75de39c928d05f886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011204, "uuid": "a11fbfcc-42ef-4d04-bb60-aa0d3e7314c1", "comment": "Malware payload (VIPKeylogger)", "value": "e46c1d58c2752ff2a34199754a180be8caa43454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011204, "uuid": "00edeaa4-0356-43e8-a37e-a81975a55ffe", "comment": "Malware payload (VIPKeylogger)", "value": "b35651cc8cc3828427cec35c0a58246f591b68d4f32601ffe1b7f756be2f2457d8205bfa78fa6a46c3b2295a43ea6300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011204, "uuid": "065f3408-4271-43c9-be9b-c9af1ce68ad0", "value": "T146B4230FB0D0C697C90206739FAA461B7FA5D1992E01C91B8A2173467F32713DEDBB89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011204, "uuid": "cbf1588c-a400-4b06-83b5-3ad70a42581d", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011204, "uuid": "196b6f9b-38eb-4ef7-849c-26a73d6891aa", "value": "12288:xggL2bxIygLM2wSXzjRS+tm0VP+Oh0uFnePOStm8:VL2b/sz9Sh0VP/nQPOStb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011204, "uuid": "0bed6651-66a4-4dbf-acf3-f5d38ba8bf02", "value": 517195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011204, "uuid": "44cec7c6-a0fb-4fe2-9cf9-985ec3a002d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011204, "uuid": "a547a01f-2fb7-4628-a67b-a600f3cf5aad", "value": "confirmation 0048349458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb8aa74-13c8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744041175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041175, "uuid": "140dc5e4-d362-4b87-abd9-6b8651fe1ccd", "comment": "Malware payload (Prometei)", "value": "16456278e110f69a334dc0e0f27a276e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041175, "uuid": "c5a54a95-5e8f-4004-a1b4-076f6f55c506", "comment": "Malware payload (Prometei)", "value": "139e789cb9f57bbc903d1ebde009017d1f5ae88f70b7e00a1d7a09f10a788e68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041175, "uuid": "8b7a7fa9-b212-40ce-ac4b-3c36f653de0a", "comment": "Malware payload (Prometei)", "value": "03a54db33086fd9be8d52b2566d584305a7d3a7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041175, "uuid": "c90c1004-a491-490c-9674-6ea436668679", "comment": "Malware payload (Prometei)", "value": "0d93de189f999b759ba9d8290dd375342b6267b79c35554637ceda891737d463ca863575f563440605dc2f81157e27e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041175, "uuid": "b0d85296-b3e5-4155-9517-e6c7e686db6d", "value": "T10F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041175, "uuid": "55de57bb-4c2b-4642-9a5a-28b9988415ca", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl/:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744041175, "uuid": "8a7b2b66-c353-46da-a62a-322e855fc8dc", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744041175, "uuid": "537b0feb-0ea5-4a14-b40b-5df28efef1c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041175, "uuid": "96ff943d-e6fa-4d67-a9b0-90884952994a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3f265f-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1744024184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024184, "uuid": "e9f13736-d947-42a0-b79b-0c506da9cc62", "comment": "Malware payload (AsyncRAT)", "value": "fa14d1ec3d9c803b4e409c3353df1c9c", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024184, "uuid": "d02a3a3b-9559-4a58-b681-c078705a5cd9", "comment": "Malware payload (AsyncRAT)", "value": "14265f20f7630df79cd43138ccc07a0f99b0906bbfc74619a345af12f8a7968e", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024184, "uuid": "f3d63798-b10b-4250-9151-1aab3be259d8", "comment": "Malware payload (AsyncRAT)", "value": "d03a08d241132303d086d2460c7208036dde9387", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024184, "uuid": "874f9ac3-aff6-4d89-92bf-4d8a5e26bee1", "comment": "Malware payload (AsyncRAT)", "value": "75566914b6fb4fa3c7e5f540b6c251588ada017d157cc7ca581b830f947a5db0b5b3cbe026d146e4c5297ffe62ecd7ef", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024184, "uuid": "8a970ac1-3b47-41d7-a59d-f59eb592d75d", "value": "T11A134A483BD44615DAFFBBF91972B10A4A31F5135913E65E0CD49ADA2B2BBC08E007E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024184, "uuid": "af51bcff-8018-48b8-963d-dc17267ca6a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024184, "uuid": "d90a8a6c-9578-4c6c-a54d-470b1a22d3b6", "value": "768:roP7392ZJHpCJVTZnPLcZXk6mJomwSvFFRPa9K4i6POChlOibKq:eD92ZJkBRR1XdFA9K16POCz3Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024184, "uuid": "dacde8b5-2b6f-4206-af35-046d086004df", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024184, "uuid": "8f346f1f-8d82-4761-b633-5310bf57e13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024184, "uuid": "29451a6e-8f6b-45c4-8c10-df8b0b859b1d", "value": "RelTekAudio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d7a905-13bb-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744035821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035821, "uuid": "807c24ca-d778-4ee5-aa60-cadffa7ac07d", "comment": "Malware payload", "value": "63cf34972405ca55d012b2637dae6143", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035821, "uuid": "7664d46d-2aa4-4beb-842c-378d58561c3f", "comment": "Malware payload", "value": "146df172a08f3b8bec4d5e2f3ac552af28ac2e17f682712f135e7c94c28263c8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035821, "uuid": "8b73bdd6-d414-4c0b-8089-b0d30c8ab75c", "comment": "Malware payload", "value": "98de7af6c1169c1b5857a5b139f5b0f5c5dfee48", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035821, "uuid": "7e811a96-5036-4ec9-9b94-a32b829609d6", "comment": "Malware payload", "value": "225bf500d8a477d43517d74b355741ee082078d9c1f00b470342826925d9d90dc4b24ed41bfe1fe6768373864758557e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035821, "uuid": "3d08ecb4-86a7-41e6-93a2-d88c3cd244fa", "value": "T143748C123980D032D8A211314F65EA756B7EF9304F6256CFB7E45E6E9F305C2AA31B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035821, "uuid": "d064d098-3f4d-4365-8c8f-e0e94bdbc014", "value": "6feddc0978cd3f33a5222395a37993e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035821, "uuid": "7ec55904-7a29-4d9f-8299-b082f7c0c9ff", "value": "6144:ibIfKkOB1H6ygftkBlrmxmorobPGdNJ5hSGuYyfYjKGl2KVyZCh7:ibMTO7HzgftkBlrmxmsobqJ5h3HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744035821, "uuid": "9c20e07e-a727-436f-8d57-ed89c37bdca9", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744035821, "uuid": "0ab05098-1c89-45ea-9832-fbb8bfc63478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035821, "uuid": "f425759c-0ccf-4903-bebb-7ff680bd7b54", "value": "uNT32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88de91a8-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744017194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017194, "uuid": "67a685c5-5129-4a6a-aa24-72f88116e834", "comment": "Malware payload (GuLoader)", "value": "c9b9b5dd35a2b0c2526a895708df2e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017194, "uuid": "632a37d1-e3d9-4e94-92b0-bb0c3ffba274", "comment": "Malware payload (GuLoader)", "value": "1481822b38f50ea009754c08d2a56569b11daad13efbae533e42470351ced02e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017194, "uuid": "ca9e6138-ae1b-4f80-bc02-ee1860f32b09", "comment": "Malware payload (GuLoader)", "value": "2fdfef13c94a0b1ddf6b1ccb2a13b5faee0e7600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017194, "uuid": "2321c6c0-045f-48ea-a580-f300156059f9", "comment": "Malware payload (GuLoader)", "value": "ccb81df47f5827fb43da9b83e15e554cf6c93cba6ce2dab92cbc5ef71c79555a2506f508f60ad11d9076d5b3b6fe5d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017194, "uuid": "74e09b3a-88f1-4efa-aedc-60d22490b667", "value": "T17EB423803B31E723D23613720D757BB36E37A124ED41D94B6F6916D47E22B876C2932A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017194, "uuid": "ab7ca820-95e8-411b-b05e-d3247190ea14", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017194, "uuid": "27273a8c-cdd5-4938-9f9f-7ee57985f133", "value": "12288:hdUsBkMkn7Z5Bfg6u/dhwoq8JqroHuy08sVDv49Uy514LyYR2B:zNrOHswke4uy19U6OTRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017194, "uuid": "ad25554b-0c13-4e38-b8bb-c84b16125545", "value": 515758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017194, "uuid": "fefee799-4ae1-486f-96aa-fa207d7f0b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017194, "uuid": "39e61ef6-c855-4d67-9e8c-a90ad19232e1", "value": "SecuriteInfo.com.FileRepMalware.16782.10037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abe3ef7-13d4-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744046376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046376, "uuid": "fa7b37fd-ba7e-49c3-aef0-82fd16bd07a2", "comment": "Malware payload (AgentTesla)", "value": "83a60d06c60c24cc9821506d19bb3a5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046376, "uuid": "e8aac991-69b7-40a9-bcaf-aa75a795fff8", "comment": "Malware payload (AgentTesla)", "value": "14b84fff6d48ef5945d9d733a9de53c3277d4a640a791c403eff9e2cfdf62610", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046376, "uuid": "a34bf3bc-ee72-4d68-913e-a15b0d2e6c7d", "comment": "Malware payload (AgentTesla)", "value": "4097bf842ca2aaaf1ab910088283f78cfe6c4989", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046376, "uuid": "78eee2b0-673c-47a7-a54a-d0afa3e0fd19", "comment": "Malware payload (AgentTesla)", "value": "eaba0c06e32c59f302565347eed26f5ca1b97a0651ba0cd950991334c58e3198e770cd9b92b1bc57070b22d058d96248", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046376, "uuid": "4dfc54c7-f7bc-4f7c-9170-3afa69231613", "value": "T1B6D423EA454F3533512854F6D28878C0922089AB2EE0DCA477E9377A34F6F9D663F825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046376, "uuid": "0b0850b8-afc6-4c5b-a460-bda56e08669f", "value": "12288:NeJyV0+FQONL8uMxBavqd11jlOOS+RquiJuS9v9ePvRKz1g1HK3kjz+:AJwemw1BPMOxguisSjQ5KBg1q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744046376, "uuid": "378e670f-8f59-439a-b9d5-f4a3fec4bbdc", "value": 638516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744046376, "uuid": "1d7bd6f6-0d8b-444f-9604-6e1111b01b00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046376, "uuid": "b3898b6d-f038-4554-82ba-1fac3f32871e", "value": "New PO For Bulk Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def1fc9a-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744028505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028505, "uuid": "57274588-58af-4916-98c8-afb6f6fb7196", "comment": "Malware payload", "value": "382686131cc78022e7c8a83aba449b42", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028505, "uuid": "d5b976f6-af4c-444c-90f1-ec87461818e2", "comment": "Malware payload", "value": "15732d38e8b6ab536c825fbf49c3d2a6080c10ad06b051d75db802d01cf58948", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028505, "uuid": "38d88d64-ba40-467d-9ec2-114d42b2af56", "comment": "Malware payload", "value": "94fe5203821a1063b38b8860b7fe7eea384996bc", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028505, "uuid": "ff309078-ea1b-449d-bbbc-49d9a345b3b0", "comment": "Malware payload", "value": "34a4806a9d39bb6d9193ccd5ad7029ef4ddcf59a1ee1a2fd28328f08d6d2160d8fae1118fb605aea3d46ac7be03ae15c", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028505, "uuid": "d70419c3-da78-4a19-8448-43269f795328", "value": "T113B6D120927E64E9EB2F52BFA0685FD5D0187CE15728D9FB23B87B949B701C22172D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028505, "uuid": "27116234-01e1-44d1-a670-cf3c3eb2fb15", "value": "196608:mdrYHeVtodlir7CweMY7LmliI7Te8YHewQYOcMHpw8a58p2BD0wff8svcv4F:md8+VtUa7CweMY7CN7e+SOcGw4p2BIa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028505, "uuid": "f0ea23f2-8c85-46f1-9448-e065f536b354", "value": 11225600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028505, "uuid": "ad2844e4-78c0-46b7-9bd3-4030f26d0d55", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028505, "uuid": "33aede2c-6ab4-44f9-bd20-4f7907d6a230", "value": "85.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94c0417-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1744034455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034455, "uuid": "93d9426e-ba8f-434e-aa5a-fbefe12c4ea9", "comment": "Malware payload (RedLineStealer)", "value": "dbd1e6072ec7ff8387004806bbaf7f8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034455, "uuid": "79c8448e-f159-4702-a4e1-98defe4f93f1", "comment": "Malware payload (RedLineStealer)", "value": "15c4529463b66c4e8d71eca85ac55d5584c8defb2f4318e38f5c8a04b9513d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034455, "uuid": "e7822c5a-614f-4100-ab40-342a44e327b6", "comment": "Malware payload (RedLineStealer)", "value": "c3f921e507d96843ee382046fa8b8319dc03440a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034455, "uuid": "97f8923b-e73c-4f65-b93a-7433a8810dfd", "comment": "Malware payload (RedLineStealer)", "value": "58f4cbe6b981c1e70b055f061c94bb615241384fe2c202fefc87587708c6385f5bf311d60dcceec692266cf886144f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034455, "uuid": "5ef12db0-ffe1-4c3d-897c-76076a5e3dec", "value": "T1A445AFE273CDC260CA679172BE3AB7536D77781D4D34B41E2E843E2A7D21361112E6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034455, "uuid": "560b39cb-a39b-4988-930f-1848fba02721", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034455, "uuid": "d214953c-5703-4b00-a79b-4091cf379cc5", "value": "24576:qu6J33O0c+JY5UZ+XC0kGso6FarA8oRxJrUOAlpDVOKRWY:cu0c++OCvkGs9FarA8QEps7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034455, "uuid": "9c97de33-b548-4b6a-b6cf-779c37aa4cd8", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034455, "uuid": "332e8f6b-3f9c-4184-a370-54043b7e4458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034455, "uuid": "1821d461-9ad7-4fc3-b07a-e328352bee74", "value": "15c4529463b66c4e8d71eca85ac55d5584c8defb2f4318e38f5c8a04b9513d63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f4a111-13b2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744031683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031683, "uuid": "dd61459e-a92d-4ac6-b448-161206e10d2d", "comment": "Malware payload (Formbook)", "value": "721c26a75727a0c44ce634a4757e46d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031683, "uuid": "03901f4f-4dfe-4ef7-980c-d9a9a0090d89", "comment": "Malware payload (Formbook)", "value": "16c9547d6f84550ab7b51748cbc875d7a3979b51ea247f024aea5cc5d6c457e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031683, "uuid": "abdca553-34b5-4f8d-b183-a172600d183d", "comment": "Malware payload (Formbook)", "value": "a1423da9fdbd95f09c3db4d2db03c4aace05c467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031683, "uuid": "27f191fd-8d3c-43da-8060-e39b907562ef", "comment": "Malware payload (Formbook)", "value": "08f0dee93b31035842462e13030d77a6d0e702f1cceea55dca7846aed32a553580f3d19c597d3164e54bd04644b0ba21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031683, "uuid": "bb4d14cf-497b-406c-8f62-6c65a0f264c4", "value": "T103542310E6227C0FC92DAC7002C70EC5BBD2AEFB5D5526A1EA65F0C7ECB51B9650784B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031683, "uuid": "b814a774-12dc-4aed-b585-56b6dc90c4c9", "value": "6144:of2vr7riDFG1kaMAdJGuRzJDOo000I5NURMYHJt29nPr3QcaE:hvHGDoztdDT0zI5NSFqPT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031683, "uuid": "38d2e03a-f4bd-416f-b6bb-f57d1b0bff43", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031683, "uuid": "5f0e90bd-a877-4e5c-bcb7-e8713bfa7f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031683, "uuid": "36dfd3f6-d188-46b5-ba65-d84e1d6e5794", "value": "Purchase Order 139022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e66ea0-13ac-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744029047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029047, "uuid": "f29ffaee-9880-47a0-ba3c-a218af2cb4f2", "comment": "Malware payload", "value": "ef6996b72ccc2a2cda8b0bacfd81fc6e", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029047, "uuid": "95796bfa-d1c2-4fe2-b09e-5109153a9138", "comment": "Malware payload", "value": "16eb4a0b60b83389165a3f9b77ce339bec1693268b845205af12ad9e810348e7", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029047, "uuid": "fb2bcee4-7310-4aa2-8261-5456cc285450", "comment": "Malware payload", "value": "35d2e993b6d7ed79290b3b92eb5070b20a15f72c", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029047, "uuid": "510e6c3d-a313-4821-9a24-0f79e4574bf4", "comment": "Malware payload", "value": "2aa0220d950085eacd68768ee9eae511bf6ef09f9293931a1d605e985afd8d25e83312792ce45b23111ab3bc9369cf1a", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029047, "uuid": "f0cadad3-c78f-497e-b021-8cd78630a810", "value": "T19CE43D413791BD4B0A0797777366A1F9E61AF914D248C4CEF189BC14F0DEA31BAC92B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029047, "uuid": "a0d25be6-c91e-4cea-87c8-4e301713fb39", "value": "12288:uE/0h6mSQpNJ3H8stTJS86iXdvBPP/nvOA73G8OQGI07ApMt7J5ir5LenzZwwYuN:uE/iRSQpj3HXTU86iXdpPP/tzh3GL7l1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744029047, "uuid": "94625ec7-370f-45ac-a2ae-62edc3a8b973", "value": 721300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744029047, "uuid": "e8a9b644-bff6-4992-bc17-ffe2e6935d66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029047, "uuid": "c166ad54-a37c-4ab1-8fa6-a09aa6c628fd", "value": "over.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef8bfdd-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744038518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038518, "uuid": "c96c79ac-a3bc-48bc-93c0-ae9b3f05a360", "comment": "Malware payload (LummaStealer)", "value": "00cd16fb6583280e5c3c577fff6acf33", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038518, "uuid": "e0e53a28-6951-4007-8bd1-d58ae8e394b1", "comment": "Malware payload (LummaStealer)", "value": "175044939f380e76500421ae360b172f72004dbab315fa398c4af9a5d7a97679", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038518, "uuid": "b616653d-2d47-4bf8-abec-2051c61c900a", "comment": "Malware payload (LummaStealer)", "value": "b5306f98021ea19fc9b0f7a2e686ec60db9c20d7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038518, "uuid": "f77f32a3-de51-43aa-82df-4d0a03e4f329", "comment": "Malware payload (LummaStealer)", "value": "470c8114529280d9e094ddca20ed20ec30a78b2a8b81782eb0a777453b212538ca0ab18c69637e649392006684daa051", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038518, "uuid": "d4d6c06a-27e3-4420-89f0-9a7b378d6e4d", "value": "T1D8E523809F5EC91BC8C13D3E8EE3515B6C898E435E99F0F39D8D3BA91975D895838E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038518, "uuid": "5557dcfe-7dd1-40c0-b249-b9128c09ff9e", "value": "49152:bbh6GyZD0Uq+I3BQzCub28arvVYPxzt9ak4or9m0gnRYVsuXNWbWUF3/H:R650+ImzCuS8G6JZgeXgKikNNCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038518, "uuid": "f1c63037-f438-44e3-b850-fd4f6cd54222", "value": 3140778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038518, "uuid": "66718943-7683-460e-97ef-1899f4e6848e", "value": "audio/mpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038518, "uuid": "a0c0095d-416a-420a-9788-64a21e90ac3b", "value": "fleeonepoint.ogg.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fa17cb-1408-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744068566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068566, "uuid": "32090c72-07e3-4616-8438-82f801636ce5", "comment": "Malware payload", "value": "91f84c2bfc431a0c89c9b59337c233c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068566, "uuid": "93dab7b6-f652-4d29-8437-e4c69590dbc3", "comment": "Malware payload", "value": "175387bdf3590691d55983a09cbabc017745e1b4565694f28ff40e9bb8bc83a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068566, "uuid": "8c775e17-3b53-46db-807c-02c6a08664f6", "comment": "Malware payload", "value": "8ebac40e62329942af28286588a4016d8ddf548a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068566, "uuid": "3daa40ce-6ef9-44d8-a2d8-5f5ae1ac45e0", "comment": "Malware payload", "value": "2df521b7333be956027c379290e0441f3a5d2324fb216fece4fc516ccbce8c051fcbabd0fda789303d57fbe70439778f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068566, "uuid": "bb109179-0bbe-49d5-99ce-fe49dad7b922", "value": "T146C52B83BAC74EE6CAC667B496D343356338FD518B1A5F2F6A08C2316D536C5BD4AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068566, "uuid": "596b7ca1-8edb-4fa7-8a48-ee7214472eab", "value": "32686f1a9ace11bb33ab0270b91bf9c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068566, "uuid": "aac4e78b-6d65-472f-8765-e104a4b8e3c6", "value": "49152:grnPieRfbNRT8Dmbi4jKHyrlHjd0MO2ox0u:gzB8DatOHy9d0MO2ox0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744068566, "uuid": "7f6aeeb0-e9c5-403c-b93c-3771489041cf", "value": 2667593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744068566, "uuid": "55b51bc1-a007-46d7-87ee-0322353a6af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068566, "uuid": "383b7141-e7e2-46df-99b8-7a4a9939c855", "value": "finale.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c426ada3-1373-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744004838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744004838, "uuid": "34efc6d5-389f-4f7d-954d-9d1e2539b2b1", "comment": "Malware payload", "value": "0cefec4bfb063eaf926362d9327df94d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744004838, "uuid": "fc5722f0-b4c2-457d-a3d2-a366e4f93819", "comment": "Malware payload", "value": "1764d788cdc95cb44cf84e119c00bba404ffc7252cf6c1581023678a2928bf7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744004838, "uuid": "76e8b0e9-93de-46f4-aba5-aefa7d41a298", "comment": "Malware payload", "value": "178e5ca55cefedda9113a30688997529da203c38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744004838, "uuid": "8ccdef4f-bd5d-46d4-85dd-23388d8c8efd", "comment": "Malware payload", "value": "284551be32bfd9e2df01e191e68101dafcf090c8e59ac37151e5280ecaed3240119209e2b1a53db6d599d117f8267422", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744004838, "uuid": "3a2b6cf3-12e5-4c08-a6bf-55ab14a76e17", "value": "T173356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744004838, "uuid": "326a8dd4-5c3a-449e-8f84-8c7debb09ad3", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGN9eLtRajZa6ZTxIVD7bLv:E8dbbsO38+TfoRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744004838, "uuid": "70cb060f-fca6-405b-b8aa-2d05e39c9921", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744004838, "uuid": "c67e7a1c-2689-4b68-97d4-9254795cc7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744004838, "uuid": "a35027b6-167e-4325-bfe2-4a69f7922b94", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea32400-1386-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744012694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012694, "uuid": "f508e24c-86ce-44da-966e-36d38e0e7ef5", "comment": "Malware payload (Prometei)", "value": "58e7d6e619a5b280c28b2425e56c7cc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012694, "uuid": "a7cfc73d-eb2b-471b-ba72-c9ee1f35eefa", "comment": "Malware payload (Prometei)", "value": "18c5887e8800c1a4323d692eef7945319c6caf63b02eeffee314c6e3681617d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012694, "uuid": "a6f01219-6f8a-4b62-a934-b105282e386b", "comment": "Malware payload (Prometei)", "value": "242546f8bddab5ecfe5315d8e6440ff91030f1f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012694, "uuid": "b690f38c-ac0e-4fec-b2e2-516820d5d007", "comment": "Malware payload (Prometei)", "value": "e8c5a87fb3ba302dc69bb2f08be03a8cd5ca8a55b45a14125a470dd568d8f36db9434fbdfb402459c03e1f23f1dd4e4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012694, "uuid": "6383bc7b-3f2b-4468-b542-c68a25a70667", "value": "T167155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012694, "uuid": "eaa46c4a-7679-4690-b88f-f34b64ba1344", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplo:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012694, "uuid": "0fc6ccba-e339-4b9d-957a-17cb8fd2597a", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012694, "uuid": "299685ca-55db-4dff-ad63-3cd1e536a424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012694, "uuid": "44e24516-3967-46e9-a987-dd9d5524948c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676dd678-13b3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744032170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032170, "uuid": "019b1061-8324-4f5d-a278-66dd07096053", "comment": "Malware payload (Prometei)", "value": "010d1a567c0c7f26d0e9ac91d05ecf56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032170, "uuid": "ba192ef0-e1e5-4616-bbea-4b865b9496e8", "comment": "Malware payload (Prometei)", "value": "18e8130685d98192f48be2eae2431b0b81b1ebd4b728c3cfb9846628f9c17341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032170, "uuid": "f5e92b93-0522-4992-bc08-a1aa079326ce", "comment": "Malware payload (Prometei)", "value": "333dc403fa572c46c8cb2b397be76d75c9c3e4e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032170, "uuid": "694052c2-b8ed-4fd2-9971-8867bf8577fb", "comment": "Malware payload (Prometei)", "value": "34e193735886e34c71cd5bf5e2a35c2133deb326a88a3af684da5fe852bc682064083dd8668f5213266695a1cdf1ab4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032170, "uuid": "f48ae9b5-93cb-40f6-b914-cb820d08a926", "value": "T1719423F8C87D2E30D8169F3CBB1A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032170, "uuid": "375ca1f8-fb88-42ae-b78d-d0142b9a049a", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgM:25WOSACZSV6eKRH5EPiamb4DsDwwc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744032170, "uuid": "b3eb6259-4171-47ad-a9d6-510953c28185", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744032170, "uuid": "ec040b55-aa34-4a9d-a0bc-9bfeeb1f3288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032170, "uuid": "78353557-24f2-4418-a5bd-bc05fb21d4ec", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97654009-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049430, "uuid": "2add9326-2a36-43d0-ba3c-77f416e91c32", "comment": "Malware payload", "value": "a9c12ad0ca0e929009609539dea391a1", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049430, "uuid": "6e4ec43d-b6c2-45fc-9f7b-377347c0e30d", "comment": "Malware payload", "value": "19664fdea764b1e40a150d7101e819b73d8ce748cb9c6ece6319c3feb231ef38", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049430, "uuid": "27a28b9c-525d-46d4-9b37-7b0914f84250", "comment": "Malware payload", "value": "1d3b44e0282da0c4c74ee70082ad0356fd4d74d1", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049430, "uuid": "2ae360ed-33ce-43f6-8c74-64bb68641df9", "comment": "Malware payload", "value": "4f5ed2d678cd657213f29768fd2545fca67beb0c2ffe2c3cb67c41ca7f2b89500ed23126ef58b985122e76b6e69827d2", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049430, "uuid": "836fec49-8538-4719-a51d-0fbcf533872e", "value": "T16D24D066F285C80AC649D3798CA3DE167662FE054DAF7707338D732D2DB66D48A02DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049430, "uuid": "4ed94104-abc6-44c5-b049-29f08227852b", "value": "6144:s6Z+RwPONXoRjDhIcp0fDlavx+W26nNV219LYxmcCZ6SYbKPrCLjvHCj6wMwKgTx:YCmWblqj6wMws1c3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049430, "uuid": "341461ec-fcdc-4a50-8662-aa5f52810fd6", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049430, "uuid": "7359d43f-fbc1-4360-bef8-9e6b63d18ab3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049430, "uuid": "32f974ef-78a7-4a8d-a6fd-e7c9dcb0b183", "value": "19664fdea764b1e40a150d7101e819b73d8ce748cb9c6ece6319c3feb231ef38.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2b6603-13c0-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744037872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037872, "uuid": "96786363-1544-4e09-a333-eb7d8c7b7d4f", "comment": "Malware payload (LummaStealer)", "value": "aba7be82c289c6c551dd27b9b72b2b3f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037872, "uuid": "73f325e8-5ca9-45d9-a849-8c82d304877c", "comment": "Malware payload (LummaStealer)", "value": "19dbe25c6cab039bc3bbeee04c24d26009f4e319a9f204d065c6104f3fcfc22b", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037872, "uuid": "4536f6ba-1552-42ca-bea1-60d865ea71a4", "comment": "Malware payload (LummaStealer)", "value": "f8e37d53e1adf33fc48bc66e1bc82a11e6d1b657", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037872, "uuid": "cc5cf095-78e3-4801-b5ae-b655bf7d9212", "comment": "Malware payload (LummaStealer)", "value": "03efcd5b26bfe31347f15f07cfde7bb9f276a3018add03b250993c312c96eada54eddff31677e404cda89042d62305f9", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037872, "uuid": "23b7bbcc-dd60-4113-b2f8-0220718a9ad9", "value": "T1CE55D0516AA1DDA6C108D1704CBF3F3B3EB18573437489BBBB982D821957AD253F321A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037872, "uuid": "7d178a5d-77b7-4ef2-8995-1badf9a50388", "value": "7a198086ab6454f928ef37eea73f36f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037872, "uuid": "c55c8bb9-ebfa-4fdb-bce5-c73bc2a7b1bf", "value": "12288:dz0cOT8ypSZt7R2AC5PrvNZWoeUvNZWokJOeqFJOeqEJOequJOeqVmbSentHdwqz:dzHa8yUC3PrTWNUTW8ntH9516LrOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744037872, "uuid": "0c82cdd0-2779-4979-804e-0d0af060d14d", "value": 1394688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744037872, "uuid": "dee24601-8013-4ea8-9063-6f7bb6e0aa35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037872, "uuid": "93b95680-7405-4005-b7d0-126d3ac3775f", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2dc3e3a-13b6-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744033639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033639, "uuid": "8cdb86b3-2c33-44c7-8ca3-f629d43215f2", "comment": "Malware payload (DarkCloud)", "value": "b1182bcd005bdbbfdef1efe8f7f516a2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033639, "uuid": "cd15313d-7f6d-4e5e-8dd8-04429eacdb78", "comment": "Malware payload (DarkCloud)", "value": "1a0174c4b5021c3e2751a074dc0af5ab2c63f7f40ceff38897b3345b7f69449e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033639, "uuid": "30ad7437-92d8-4e2c-ae91-6dc320878093", "comment": "Malware payload (DarkCloud)", "value": "fd406ea5b188d2a2e88a782ca32a562813944056", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033639, "uuid": "77fefc02-8a70-40eb-a94a-7820b72cf8c0", "comment": "Malware payload (DarkCloud)", "value": "8659ebb290a0ea7d8586c9bb2a74ac85df1c0648ff0047eb154bb87c3895933f62b57df0bf9460d98b0558d914a4769f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033639, "uuid": "bb222f0e-c20a-4f19-81bd-f8119bc234a7", "value": "T1864502E5D39805E6FC275B368C779D22169B7D3D69B8A05C297E32201B3339310BAC5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033639, "uuid": "bca6d3f7-c52f-4607-bb39-e8df7b555a3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033639, "uuid": "1481c5d6-f5dd-4bca-99cb-18106f509124", "value": "24576:GEiDsNdj0dYdRXEpmMMFv5rUNMqeSIwgfgzU4XKcrmnSilM:3iDsPIYr/MC5rUHeJDfg44XKcrmn7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744033639, "uuid": "d5510f62-b501-4420-b4a6-1f8dc4809887", "value": 1267832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744033639, "uuid": "27201d4f-c0a8-44df-80a2-e4924285214c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033639, "uuid": "ba6e2a85-bd7c-4788-bcc9-3fd87be7028e", "value": "MT_51026008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3614632f-13bd-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744036382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036382, "uuid": "e9101bc8-06cf-45c9-be63-527bccd92f65", "comment": "Malware payload (Prometei)", "value": "62c0871b43260ff12f40d382b7e0c108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036382, "uuid": "753df2e4-6320-4344-951b-b8edd2f1493f", "comment": "Malware payload (Prometei)", "value": "1a6346e0ec123464dc7e50413d8cf15eed1c4c322808bd0ad7e4d2de93062a58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036382, "uuid": "7168ce2b-1527-41f1-8dc0-df9f65222e9e", "comment": "Malware payload (Prometei)", "value": "db12ffa7947135a300840cec7c282ab35d6f5585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036382, "uuid": "140336a1-6cc0-49e4-8ed0-5ab81547a79b", "comment": "Malware payload (Prometei)", "value": "b655e68bc2305f34fc4e2b561c7aa8dd3753de59dc41a0cd51eed6d508a99ed1a812e505eca1f440c963300ead0094a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036382, "uuid": "0854074f-204e-4a49-b2ad-15914709e170", "value": "T1FD9423F8C87D2E3098169B3CBB1A8268F0E15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036382, "uuid": "ae3f2bd8-232e-425f-8b5d-ad1ac2fe5655", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgF:25WOSACZSV6eKRH5EPiamb4DsDwwc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036382, "uuid": "d39615d3-86f9-49ff-b0fa-2be0bf7dde39", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036382, "uuid": "3bcbfb93-3e07-4e11-9436-c7768cdebef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036382, "uuid": "c4695321-535e-4bdd-b26e-344c7415c926", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035b8d65-13be-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744036726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036726, "uuid": "87f0e212-3ea7-4a26-a204-d22f031eac97", "comment": "Malware payload (LummaStealer)", "value": "5137ba884d60878a2370f6a44b5fc882", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036726, "uuid": "736e79ce-129d-4af2-a3da-e16f96da1a36", "comment": "Malware payload (LummaStealer)", "value": "1ac1948b2f3fdb8020303aa9218de6c845447247928e61d627d2ada162d9e7c0", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036726, "uuid": "733c9b9d-2501-483e-8795-9ff3c04ecc24", "comment": "Malware payload (LummaStealer)", "value": "7d54e15e368245de0038c1e9b3087d4c649fe97f", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036726, "uuid": "85790913-ff65-4ac7-95ac-13754f0fe5fa", "comment": "Malware payload (LummaStealer)", "value": "d09cd4d66a7c6de4d7db929b866823f9987a00e395bb486fbf59ee2adf6f08af92430bac811ddbed59278cc83707f03c", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036726, "uuid": "b5f9f323-4dbc-497a-8f5c-f3967a19040b", "value": "T17FC722344310CB27D1B3542B72F346D642F056A586C7689E968FE3C202E3796D8ABDDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036726, "uuid": "525e592f-238f-4998-acc6-0260277ba256", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036726, "uuid": "7e4a1461-e89d-465a-ac7a-5ea08e304e62", "value": "24576:G0aFhwuBfrpm8h3CcySN7a1Bmu4CGx4VqfIvmjUzO0LnSq66IZsbw:G/hwup1mo3W+7t3XQvmQzO6F6BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036726, "uuid": "74dc844f-caf0-4936-a865-f03d56d72ccd", "value": 53487729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036726, "uuid": "551b7a84-7b59-4265-b13b-563f5ceb2710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036726, "uuid": "9a31355e-c742-4624-8ed4-a2bdf3f8b236", "value": "\ud835\udde6\ud835\uddf2\ud835\ude01\ud835\ude02\ud835\uddfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09940aea-138f-11f0-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1744016551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016551, "uuid": "73f03815-3be7-4a82-a588-e1ea1702b0fe", "comment": "Malware payload (RedLineStealer)", "value": "4521b685c28375f96c506d2704aeb9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016551, "uuid": "1078895e-65a3-4112-8796-cd28d73b6c17", "comment": "Malware payload (RedLineStealer)", "value": "1b5999386a740a46a22d91956828a6c20a278e7cb056ea85e996b19c18ef7459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016551, "uuid": "f0a9a6cf-e3ea-4820-b138-8efb4b75f554", "comment": "Malware payload (RedLineStealer)", "value": "7ca9a35128781618e426e70f9770ccfab5bdf294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016551, "uuid": "aa4581a1-32d0-4be0-9505-2ba32162fd35", "comment": "Malware payload (RedLineStealer)", "value": "b26f42a193d41597ee98637802c3d9123395f8635cc87d9a19644bff27b38f8176eed91cee7b746402cbd95cb023d718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016551, "uuid": "097951cf-f5e2-4be8-9d61-2d6acb1a8d60", "value": "T14C458D6133ADC392C66685727F9967207EFB386848E0B50E2EF40F3DA7D1261116C6E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016551, "uuid": "739c18aa-8794-41ec-af89-5f460ccd6baa", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016551, "uuid": "48a91d14-0ead-4cc8-8065-0f41d48cb539", "value": "24576:+u6J33O0c+JY5UZ+XC0kGso6Fan6aFy7VY9d/OaBvWY:Qu0c++OCvkGs9Fan6htasY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744016551, "uuid": "9f6b0a96-ecb7-4e4c-94e5-a04d74d9cad3", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744016551, "uuid": "6d041b34-7d46-462f-b928-ca1c6d2a0e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016551, "uuid": "c731e0a9-ee57-4f8f-aa4c-ce15b663860d", "value": "SD6789000900KJ20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea89482-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744038463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038463, "uuid": "f8f6932f-f125-459c-9d2c-eed2fec3aca5", "comment": "Malware payload (Mirai)", "value": "3781644e993ea39042ad5d6480dd50fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038463, "uuid": "dd598e18-fd34-48ca-9e30-d7916c38e5c4", "comment": "Malware payload (Mirai)", "value": "1ba25aeb2f3cf820b0e0477bbd0d23d50883a351701776ade9c9c6310cb4cdce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038463, "uuid": "8a88be54-f42d-4946-8521-f4723f4ecd28", "comment": "Malware payload (Mirai)", "value": "0de8327f3f278fbcae4049518633a1a6a5d55fe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038463, "uuid": "fc9b0b49-5cba-4cd4-acb8-0ea8a51ee11a", "comment": "Malware payload (Mirai)", "value": "6c3759422ba613072023f02ffb417cef376e06075885fce364cedd078be80e84c4fce45937066d183824e06a92363289", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038463, "uuid": "c7a3bebf-24f1-44ce-830e-a425edaaafb8", "value": "T13F539EA5C5ACAE58C61441B8B954CD388723F408A5E72EFBD646C796900BEFCF1187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038463, "uuid": "b7d7546f-28bb-4223-80b6-3a93d67e9a69", "value": "1536:PXaA1Nnzd/mUUV7tiYmG66ZSjs7Iofs3wXxrlzN0Z783Cz:PXv1NzdeUUPw90GMxf+whr5N0Z7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038463, "uuid": "8c943bed-d9ff-46df-bdbb-d28a8afdae55", "value": 63764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038463, "uuid": "2784b786-42bc-4e16-b28e-e129a793363b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038463, "uuid": "262d11bd-57bc-4726-864d-8cb0ed5473c1", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438dff1f-136d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Nitol)", "timestamp": 1744002045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744002045, "uuid": "ffac371d-6a85-4d70-851e-136cc1262f09", "comment": "Malware payload (Nitol)", "value": "24454252738e7239dc45f4d59e3da23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744002045, "uuid": "c34dad8d-4a69-47e8-9b03-e15f519d39e9", "comment": "Malware payload (Nitol)", "value": "1bee721c9ec771b4ec07ecdf4ca0f623b6f365bae70aa991653ea78b26400696", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744002045, "uuid": "c7d00c16-6679-4595-9983-906dfe8d059a", "comment": "Malware payload (Nitol)", "value": "f07673c60f166e1449a2a77a30da4569262bcac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744002045, "uuid": "4b8eaa55-cbec-4686-8278-866f01ab5b4d", "comment": "Malware payload (Nitol)", "value": "fc5862bfc692be65f4636afe52df20489125b15c7b6f8630371a53f796ce0587fc6a47a1df2e4c02662df078d0c52a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744002045, "uuid": "cfc76837-376e-47e2-a657-340e50e4db1b", "value": "T15E07AE01E7E48F17D1BE0375947254049BF5F89B9766DA5A324CB1AE2B72B002A6333F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744002045, "uuid": "5cc4e918-3b7c-437f-b793-c7bf4c63df6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744002045, "uuid": "906f08b3-04ab-4421-8ed6-1ebd24f94f79", "value": "196608:MjpaWrUHSR6QqOyjr2LF3Ye6YmnwqdU142US/XV2dkhYtOEi4Gsq4G8pVK:zWz1cjSLFoBYmn5U1PV/XVOrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744002045, "uuid": "a7feccac-bd21-4ccc-9445-ab2df5bec757", "value": 17267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744002045, "uuid": "ba700042-a402-49f8-bb6d-acdfebae6a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744002045, "uuid": "c4be627a-47aa-433d-98ea-11efd35b2ae4", "value": "CirnoRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8e0240-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049469, "uuid": "feb0bf07-817d-444c-8aec-22134c6c8be0", "comment": "Malware payload", "value": "840d483e31abef5785e34abe365e4393", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049469, "uuid": "b4fda831-74a8-4618-8b44-92692d770482", "comment": "Malware payload", "value": "1bf083badcb622e709d0fd8a394f17b694402481366a969eab780ba31b107ee8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049469, "uuid": "80003dd9-8a63-4d80-95ed-ba8537350130", "comment": "Malware payload", "value": "34e4046ce038343bdf475523b8fd6b086c40dc1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049469, "uuid": "31b69663-e824-4907-b40f-ca19ec947848", "comment": "Malware payload", "value": "8d110d0330210d4fa5361005c160542d147d6ab7969939e78f9c20761479f3d1b4f06bc9b37b10f785f6853ce4945e24", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049469, "uuid": "5d8c74fb-beec-4b4b-b533-c21bd1c9e023", "value": "T15FF36A51B4D18032D572153205F4DAB5AA7EFC700FB25ADF6B980BBE4F302D19A31A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049469, "uuid": "95786794-24ea-4adb-a3da-26316fbd19b8", "value": "3d5d5760afe23c07a7c6be6e570893a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049469, "uuid": "a24894ad-f724-4de4-bd56-305ad997fcff", "value": "3072:FkdKifmZXyV3Cur9qGNVSYJ2H+MksWb3MIZ345hGYjgiGg2vsInWJ:yv+QfrcaVS0HTH7vsIn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049469, "uuid": "fe8e4cde-43be-4b25-8de3-d942ef2b69de", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049469, "uuid": "8c3d5ef5-6af0-42b0-b665-e7cebf1312c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049469, "uuid": "27869ef6-7195-4fd0-b364-dcb9e3f39034", "value": "1bf083badcb622e709d0fd8a394f17b694402481366a969eab780ba31b107ee8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf3c11e-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994945, "uuid": "9f58ebd5-7ee5-40d2-a5c2-84ac024e1c23", "comment": "Malware payload (Mirai)", "value": "edc62b4d18751b4f9c13a8d28f294566", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994945, "uuid": "bd38ae2a-de51-41a7-ad2b-7b693c4fecd5", "comment": "Malware payload (Mirai)", "value": "1bf0d2bca69369bb0b706c623cd9334d69d45bc8ffe3830e0a5b8c52dd2a0caa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994945, "uuid": "b2e0e9ef-3178-41d3-9131-8d8e86b504bc", "comment": "Malware payload (Mirai)", "value": "c1bfaa73e82ef56ee8c65a6374d000970d3b65b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994945, "uuid": "1a400e47-9b89-47b7-974a-26d317338eec", "comment": "Malware payload (Mirai)", "value": "ae15c845f2b33d8341d50e70ccc0d3c962c11d8bbba4167ac540a631bb8f8a379f0a78ca5fa3dbf1b991f21ac1309580", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994945, "uuid": "30c62dc1-0e89-44be-90d5-d30fced3ba18", "value": "T12D339E23CD352D68D21C51B178A68B7997F3E650A2CB0B9AD421C36CE053EDCF5A52F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994945, "uuid": "d08948ab-f743-4343-9277-3f9a7f7a63b7", "value": "1536:dTeMzc9FZb5Hcv4K4jWVnqvT6xCHMpk+0Ns:MMzOZ5Hcv/47vT6xLGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994945, "uuid": "f2567bfe-8c8d-4527-a6fd-e6b195477d29", "value": 51132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994945, "uuid": "96ddde23-86c0-40dc-9018-4b6c2ed743ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994945, "uuid": "b1539e4d-0f5e-42f3-b2a0-ca0ad4d20c19", "value": "resgod.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2faf653d-13c1-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1744038089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038089, "uuid": "f14b897d-ad57-4192-ac0d-a992248af9e7", "comment": "Malware payload (AsyncRAT)", "value": "42f28953b76411abd2581d6c0c3a7a9d", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038089, "uuid": "9278e808-7578-4b4d-9f9f-d849cfebcd06", "comment": "Malware payload (AsyncRAT)", "value": "1c71ef453581ed62652dd7ffc6fc276ad50c50a9c67d5ad2dee1e538ec85a40e", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038089, "uuid": "6f5ceeda-ef35-40bd-aab4-e435d4f4a33c", "comment": "Malware payload (AsyncRAT)", "value": "f0f830908092b12525656ad2c19e3cec4cc61879", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038089, "uuid": "3b710db6-27a3-4724-b84b-ab4e0feae93c", "comment": "Malware payload (AsyncRAT)", "value": "b7851dbe742ec5eb92cb399004eb605e637e350c04a32a73b18ce9a3bb3f9f49e6f07470443087f46185c5dfc84487af", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038089, "uuid": "039a45f6-3742-451b-b972-7c201d37783a", "value": "T14DE0F14B08A9AFD749814ABD392F91C24900099DBC7BCC0885DF114AC0A5CC4B4CB688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038089, "uuid": "d51d57be-9a01-44fb-a8f1-6868005c097e", "value": "6:udEOrnlYM/V/mAHEaQ2tFJQiGVEW85mVaBqzm4jLQ04/DgVItnHvR4125PQY+v96:oEOrn6MFrHmEPQiGX85mwYzzjs0mEitz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038089, "uuid": "823aa0f4-fc1c-401d-be9f-7a8101937fe9", "value": 380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038089, "uuid": "5f2ea34b-655d-4ac0-ab0a-6758f78262a2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038089, "uuid": "d23d3f97-61f4-4d40-ba4b-11324abf92cc", "value": "Invoice647848.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f962bd6b-13c6-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744040575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040575, "uuid": "5ef2a17c-67bd-4733-a8e7-e99c6760a733", "comment": "Malware payload (Prometei)", "value": "76608b4fe9003117cb5c791becb9ae5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040575, "uuid": "bec1ab60-3a14-4c2a-a964-b12389972fcc", "comment": "Malware payload (Prometei)", "value": "1c89fe8b22736a706b0734fb3f6a1454aa68a22e4cdf31e6d997951a15fbf073", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040575, "uuid": "0fd76d3e-ccd9-4d9d-a21c-8894e966fb9e", "comment": "Malware payload (Prometei)", "value": "8bc9810be947bcafa2bf68b52f30846c6053075f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040575, "uuid": "c8e23d05-73ad-4671-a6c1-019a377f91b3", "comment": "Malware payload (Prometei)", "value": "8c4fcc16fb768b3ce2d7c6b35b87ecf713fa5e4c7dcb80b0596a51e704173b1ad34e0c2585941dcf6b9e75ba7c4cbf8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040575, "uuid": "35d21bd7-44de-4a18-8fe9-1ac2dd7f4bf4", "value": "T1919423F8C87D2E3098169F3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040575, "uuid": "d4b8cbd2-c2b8-4c32-9acb-02b869911247", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgW:25WOSACZSV6eKRH5EPiamb4DsDwwcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040575, "uuid": "eaf68bbd-5294-4a57-b202-8a6b5f72babb", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040575, "uuid": "b619753d-0055-45bd-9ef2-82ca7b3c987d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040575, "uuid": "beb2ec5f-5579-43ff-95a9-b73458625a10", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e24913-13a6-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744026765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026765, "uuid": "62b3dde9-d45a-4deb-a553-b62ada037921", "comment": "Malware payload (Mirai)", "value": "2f14c3502e71ad30b745a1b7d97a511d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026765, "uuid": "311d9264-9b9a-49b3-9361-e29409353877", "comment": "Malware payload (Mirai)", "value": "1d20424a992cdcdac00e6b438e3755c6d1cfc6b44d073af93f7bbf418cda36b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026765, "uuid": "fadf3e1b-3b0f-4c9a-aa20-594c871e0b83", "comment": "Malware payload (Mirai)", "value": "6f9a9238136b35848ba3af13f5feb95db50b2b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026765, "uuid": "5c74c0fa-fda0-4151-bcd4-2b0ab4a9b5ab", "comment": "Malware payload (Mirai)", "value": "6b860978f11c8179326d129c867502bae034d0c3b12e08881e44fcfa5443227141ea6c390d79897b59a1902546f7c439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026765, "uuid": "67857857-1dc5-453d-a0bf-22741bd069a3", "value": "T102B38DEFF24B0561C8A346F003C75FAE3D2322809F5395E77D29267968762DB9905F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026765, "uuid": "11b32979-2865-4941-a7f5-51380e0e1926", "value": "1536:Y4xLE0N0WPpxSaEdiMWpMMCnciQ5xVMcXgzLk/LWM4:LxvCaEd3PMBiQNXgzLkqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026765, "uuid": "0bf65458-72d1-4e5e-b91b-5ad8f0bd2ca8", "value": 108312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026765, "uuid": "9a999165-c9fd-4004-bebf-5dc2255f96c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026765, "uuid": "60bfdb8b-8b0d-4a88-a7a6-e6dc16031fa6", "value": "hanoi.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e61e07e-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049388, "uuid": "0542a248-d85d-4e69-9386-f941a9670a02", "comment": "Malware payload", "value": "a8bcb6e76ac03229d61775ca0d8b1cd9", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049388, "uuid": "3db23821-5320-4115-9426-720edf2fa668", "comment": "Malware payload", "value": "1d45e37eeef4fbcf79113d4136d9c6b4a9aa5b3a43194ebca162bdb1ab4a5ef9", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049388, "uuid": "39f60501-bf8f-4ff8-a922-ea9e1d859206", "comment": "Malware payload", "value": "1c9d70082c8da0fdde17a99928f2e883bb52c20d", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049388, "uuid": "7e387256-2403-45bf-b9f6-c8b465d8f658", "comment": "Malware payload", "value": "abb8da543b7af46e5be7a71764cefe162f64793844c80387b5777cf0666e705bf845a7ba6974b02f1a096098632cad11", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049388, "uuid": "630fc381-92f3-4be3-a8d6-cc645a61da88", "value": "T195B41261F144A227C557C6B2C8D1CB5F4BB2BC141B5AE45B639873FC0435FACAB2B868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049388, "uuid": "695f4f6f-cc78-4e86-8ee5-ff4b5b7397bc", "value": "12288:vshijFLuYNWwrJqWqoulSB/wKD+2upveGK7eLPHLGFLpB:vVjFLuaVqzouU8FeJeLPqFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049388, "uuid": "dd653f2a-3ca3-4f9a-9377-30be8def3ef7", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049388, "uuid": "f483002b-711d-405b-8d4b-a59c00838729", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049388, "uuid": "d05170d8-353c-4257-9d10-dee227dde614", "value": "1d45e37eeef4fbcf79113d4136d9c6b4a9aa5b3a43194ebca162bdb1ab4a5ef9.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cb7fc7-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028458, "uuid": "d847ac9a-e181-433e-88b5-2e5904c136a1", "comment": "Malware payload (Arechclient2)", "value": "391f67eb98c7f707cb94a070b74400b6", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028458, "uuid": "529689b4-7e9d-4cb3-a546-2ad9e899c8b3", "comment": "Malware payload (Arechclient2)", "value": "1d487d11f8e3c45d76a260e4995b79f3cceca02942d9e426970eb560530c6c09", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028458, "uuid": "b2dd6733-33dd-4dc4-8737-b8453d5adf76", "comment": "Malware payload (Arechclient2)", "value": "ed2e0e03a19fade042fb7f4be2d305987075711f", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028458, "uuid": "acabbf6c-b593-46bd-961c-c865c770656e", "comment": "Malware payload (Arechclient2)", "value": "a0dbe184cf8e5af3f69100568a6651da442015585994d8435039a25026abc8473820b898875b1c4ae6f7c9ac55c76671", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028458, "uuid": "e61918f6-2c71-4a9e-bef1-e78922911058", "value": "T14066D00177D48472E55E43318A2DA72456BABD71877083C3B7DC7A1E2DB26C2EB32663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028458, "uuid": "73f21536-8508-439e-a1ac-9566b49bb3c6", "value": "98304:1RJYyhcOqGU0xyoZ3lSby0it97V6NGaS6F4Kt56TchTV3uAJ69Xt:TSyvrjXtFIS6F44ccxV3uAMXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028458, "uuid": "bf9c8100-874d-405d-a2ed-177a89a067c5", "value": 6488576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028458, "uuid": "35e78bc3-6adb-4fdf-88e3-902296755067", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028458, "uuid": "65e18875-e0c3-43eb-9380-5f5ad570976d", "value": "msi (4).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b620c95-13b9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744034592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034592, "uuid": "d1b5a2a2-be44-4920-b58e-a8626b495363", "comment": "Malware payload", "value": "375f639050a2f88fb53e2d5e66116b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034592, "uuid": "2f33eb8c-b081-4b58-8ec7-cc29496c59c8", "comment": "Malware payload", "value": "1dedfbf0e8e3a2c2afdb2723f24809f02b9bda161c7e7c3f3932445030f5159b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034592, "uuid": "3eb50369-41f3-4f65-a3a1-35f670411324", "comment": "Malware payload", "value": "8728b702b377b6af0ee272c45f889c49ad815b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034592, "uuid": "9151604b-d792-4497-9683-489f41189732", "comment": "Malware payload", "value": "efb35965ef02a7e16290dceab969f04ce5529b53ff4b4d3175b1ce04f3dab797c8e51476ae8c8b481a54ff4219668d92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034592, "uuid": "097abbbb-c442-4a62-81a7-bd35c255ffcb", "value": "T13B1423B7E73716DE7FEA88B867C80C61C2E1658273907E818C4EE553E9E55A9C1C1B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034592, "uuid": "d93b4bc3-f23a-4697-8608-c208ffbfb533", "value": "3072:D0cRN2dlvR8X0SxJZXL0yOj99og9OZ30+HdQfth6RQ03FDM5TTpaywHk:D0oApQXL0yqgg4Z3dHdUh8DVoTpaywE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034592, "uuid": "fb8fd095-fd85-4da1-8ac0-1ce06b5cd182", "value": 208636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034592, "uuid": "ad7cc75b-e49a-4782-91be-4961b14ab1b3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034592, "uuid": "989d9bc2-59db-4fcc-a727-182a47776a46", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0414fbfb-13b9-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1744034580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034580, "uuid": "043c86ad-4a84-4df9-8ea7-26e7e97d4e22", "comment": "Malware payload (MassLogger)", "value": "9811dac19427aa107820f50bdfcd40a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034580, "uuid": "07e2c87f-962f-4128-bbe1-c1948b49c4af", "comment": "Malware payload (MassLogger)", "value": "1e058e9630f1e51af1fc8c839c3ed93b553904afc1a1f5eaf41e3c428ea3caf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034580, "uuid": "8287e201-689a-42ee-811e-49f289b0017e", "comment": "Malware payload (MassLogger)", "value": "f18760c2831828826c4dd18a4c9c1cef882540ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034580, "uuid": "c1764e64-c259-4c3d-a782-b31c2c75f8cb", "comment": "Malware payload (MassLogger)", "value": "fceee3abf17f7b768bf26dc25a32c06a44db979337dd1234b30c426d40515d0143f14caf86ae5e06cb12c513c3df6885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034580, "uuid": "d2b859a7-5ff8-405b-b8f5-af763e24145c", "value": "T1B515AE2273DDC360CB669173BF69B3016EBF7C610630B85B2F981D79A960171266C7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034580, "uuid": "d0a6c628-9fcc-469b-9af4-6e91ce8db427", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034580, "uuid": "c5db177b-9186-449c-8966-3d9214147602", "value": "24576:/u6J33O0c+JY5UZ+XC0kGso6FaeD+2F1KFDWY:Ju0c++OCvkGs9FaeaQ1KkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034580, "uuid": "c9bcc88b-9912-48fa-a981-4a14eb181219", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034580, "uuid": "f918eaa0-aeff-4f19-b220-805e2e28de68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034580, "uuid": "2c2880ba-527f-49fa-931a-71a008f0d5a8", "value": "1e058e9630f1e51af1fc8c839c3ed93b553904afc1a1f5eaf41e3c428ea3caf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dceb61ed-13b5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744033226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033226, "uuid": "4cd95a19-4601-495c-92ea-b001dbe2c952", "comment": "Malware payload (Formbook)", "value": "745fa0da75b49ed26f2160c235ff2ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033226, "uuid": "57203778-14af-45d9-95e2-bad3892bb21d", "comment": "Malware payload (Formbook)", "value": "1edca718cf31d412880976d2b05773ce491b4fb3ce0da57d60038b04c90bead5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033226, "uuid": "b8a37f09-59f3-49ba-be03-8ae11fc8ac8d", "comment": "Malware payload (Formbook)", "value": "c1a2c55cf4779de63e4558ad32cbac41f55b9a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033226, "uuid": "309a7686-4c4b-47a6-836e-467908a99405", "comment": "Malware payload (Formbook)", "value": "8e60fd7f38c0e763f6205520abc30c213a4cfd5d0ee96dcf2d099a30ca9bb41af82e39ffafc6ef669bc42d24f93e1e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033226, "uuid": "3a759ca0-c91e-4fb6-a649-e437e5724138", "value": "T169F402143369ED02C4D147B66C21D3BA167C9E8CB802D3139FEEADEF7D7668639041A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033226, "uuid": "707045f4-5b74-40ea-8982-52b9df837eaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033226, "uuid": "40fc6265-bee1-499b-9ff9-43a8fb4e2607", "value": "12288:/YqBCCwfpBFxgfTB/IOB0v4e89XAz+neBzFaRXVuDn+ddst2AMsbukPaV6CjX:AfRBYNg20wesQz9Ze8AdsxPaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744033226, "uuid": "5e4721ef-22b3-40b0-97f0-03b0388906c6", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744033226, "uuid": "bf010288-f6d7-40cc-8978-7e10910872d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033226, "uuid": "40ffb09d-a6bc-4a30-9222-9beb55ecdb7e", "value": "Order Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8de7d5-13b9-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744034593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034593, "uuid": "36499d29-3cd3-4d89-a24e-bdd879c0beb7", "comment": "Malware payload (DarkCloud)", "value": "605a01f895eb5085a9560508140cf161", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034593, "uuid": "ab8c352d-64d0-4b0b-8512-12dbb7827873", "comment": "Malware payload (DarkCloud)", "value": "1fba7af4b342ef972c4ffce8680ee351c8af2909050f3304dba95978509251de", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034593, "uuid": "f617151f-b269-451d-8716-bc5047dd3a0e", "comment": "Malware payload (DarkCloud)", "value": "2f7e8253d0c718927c492da2c7fcea14a10722d3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034593, "uuid": "32e89f82-a8f2-4dd2-bb11-66886caaa389", "comment": "Malware payload (DarkCloud)", "value": "20574ac7283b9cf5f43d54479a5ab65d502338bbcb1da575b84cc35071a9831ac435788cb8eae5cdd1fc11d9ca8217fa", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034593, "uuid": "ffee9930-dc71-4daf-a0be-3d82fbfc5e14", "value": "T118643B019BE88366EAEE57B4F4B106148BB1F58BB57ADB0E198461FE0C13B509E1137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034593, "uuid": "1963dc08-dae6-41cc-9681-1d4377a390ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034593, "uuid": "afc1eab3-4600-4961-84ed-697802131d47", "value": "6144:AXTU/HSjqqu0FiOEdAojJ9WztYvLChOf6UAHJyk:AXTYSjg0FiOKH9WAF6UAHJyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034593, "uuid": "788ac7ca-b58e-4036-a1e0-09d327bf7edb", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034593, "uuid": "b928a8d7-75dc-48bd-907d-29cbe4508a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034593, "uuid": "3548c706-ee3d-409e-9ba2-623673b89b69", "value": "1fba7af4b342ef972c4ffce8680ee351c8af2909050f3304dba95978509251de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ab9d5f-13d5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744046869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046869, "uuid": "8776cda5-1a13-4651-adfe-3c6fd2314ddb", "comment": "Malware payload (Prometei)", "value": "ffb520d223d00c092db939a253c3fbe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046869, "uuid": "e68a24d8-a1f5-4924-b315-15670e58a944", "comment": "Malware payload (Prometei)", "value": "205c2a562bb393a13265c8300f5f7e46d3a1aabe057cb0b53d8df92958500867", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046869, "uuid": "14665fd6-c9a0-4cb0-b4f4-5141a7f0178b", "comment": "Malware payload (Prometei)", "value": "fd6140cc9442d0c86421e2ad38e94ee8d92f7af5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046869, "uuid": "4d2ef1b0-c975-4979-984d-ce712440514c", "comment": "Malware payload (Prometei)", "value": "ad8dfb592db406857b28ce4b0e19cbbbd43f200ad386f7384a6e06eaa92c92e42aef049546f4b22adab638432b0465a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046869, "uuid": "dfb4de81-a739-4ae4-abf2-9a7eddeafe22", "value": "T1AA9423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046869, "uuid": "b6f6ddee-03a1-4035-8a27-0685af7c94d0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgD:25WOSACZSV6eKRH5EPiamb4DsDwwcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744046869, "uuid": "f12f1872-1fd2-4e88-a66d-b822df4f213d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744046869, "uuid": "6313f9be-7ec8-431e-a578-48a74d1835b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046869, "uuid": "bf86bcb2-9d6e-49e6-a191-b99f1aee1d57", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bdafa2-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload (Loki)", "timestamp": 1744050523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050523, "uuid": "93cdf3a8-618a-4fdc-9667-efbd45853dbf", "comment": "Malware payload (Loki)", "value": "874b8fc99dc1d9edd71656c5d3227c30", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050523, "uuid": "9c791d24-60d1-4cf8-a7d5-bd718fc05548", "comment": "Malware payload (Loki)", "value": "21279bd6ea91ce89dfb270f99c26706543c0a1d06354873c91f51f2fdc68a2ee", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050523, "uuid": "188be314-009f-41ac-987c-f10db2ffae8e", "comment": "Malware payload (Loki)", "value": "b8c4ae76a5a2b4a1af48008d821019b524045c75", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050523, "uuid": "4bd38ccc-e03d-449d-b450-db92c55ed7f0", "comment": "Malware payload (Loki)", "value": "944f6f63e8855c28fbd079d677c5b15dd03583aa531e4e893e07138a4407734b62aba8ff58e417c5b23a891d6294be89", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050523, "uuid": "db0f02c0-7728-41d4-8e5a-115af605637b", "value": "T197E44B2DD34B02598F620277AB571E5142BDBB7EF38552A1302C537933EAC3DA1252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050523, "uuid": "96aa9b48-e831-4b15-b6e5-8d59855be5ba", "value": "6144:qwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwA6:m8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050523, "uuid": "810eeaef-d97f-4bff-b4c1-80198e6e887c", "value": 696239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050523, "uuid": "53d9d884-b840-4d9a-96cf-16fcf64688f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050523, "uuid": "6bbdd3b9-c6db-42d8-9070-14c2cc667916", "value": "Payment comfirmation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0f3fc1-13ef-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744058085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058085, "uuid": "f4d99d21-9e3d-4d37-93ef-90efbd2ed332", "comment": "Malware payload", "value": "6e0d9bb04843a809c01478932c659772", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058085, "uuid": "f0dd7e1f-bde9-412e-af3a-505bee614874", "comment": "Malware payload", "value": "2174f8d959047d53f9532abca4becba6cead5ad6a0f7057d56ef50796d6d701a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058085, "uuid": "dcd14e4c-70c2-4c8a-b752-8b99e73e5a78", "comment": "Malware payload", "value": "7cc7ed40fedb68a9977d33de4ff2d68a930eaec2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058085, "uuid": "b70717d4-8a28-4a77-841b-f73728465027", "comment": "Malware payload", "value": "d31242d57546506d0fa6c6bcc138aae5aeb81126497076d33757c490bbfddd604c2e815c38d66c12da2e438d1a20e1be", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058085, "uuid": "d4f26ded-8127-4191-97f7-ce00ebf315ec", "value": "T13665B05C94F09C912028FF74AB96F7C788E913962B2B4B420FE591963352843FEA7375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058085, "uuid": "12ee6493-44aa-45d0-bd06-c8d590ad0bae", "value": "24576:gRrWHuv5K/FfcNc0MMe6FcBHM/gRCTvaT:jHlL0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058085, "uuid": "ee4a9718-ec55-45a2-b52a-d29d556de5a7", "value": 1410664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058085, "uuid": "98538734-4ae6-4ab7-96ad-5abf40fcc732", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058085, "uuid": "efd0700c-534e-48a7-9af0-3ce84ec711cd", "value": "Client.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41ee6c5-139d-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1744022876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022876, "uuid": "ed2bd690-1044-49e2-b93e-75e9bfa988b7", "comment": "Malware payload (RemcosRAT)", "value": "031d51f5351f1770833f12825874cd81", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022876, "uuid": "ce91c764-63a0-4e73-9d1e-ce6aa2b80e12", "comment": "Malware payload (RemcosRAT)", "value": "2175a8a31bc7732642d46db8f07a092125347baa44a6624062eeee52d68e521c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022876, "uuid": "aabd865b-3a48-4634-ad00-01d261b01042", "comment": "Malware payload (RemcosRAT)", "value": "597c0740a05034f3c092ea50eec0e695e63449a0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022876, "uuid": "56ba6f29-ca44-4223-ae5c-af8f65313b72", "comment": "Malware payload (RemcosRAT)", "value": "1fb58e857340180f2fb71060ecba8a7254b2f775e4fb53315827e21fcbde067ed7b9589c20964e5f68c44b7d62a0de6c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022876, "uuid": "3ab4e195-72c6-448d-8667-c9c3860a2517", "value": "T15FE0F180C9E1C00219051FE0163F95AB21A90E317C03CF5B560F23AD408868D8356640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022876, "uuid": "bb8cde3d-b5ab-4000-a7a2-c0fc4d7dc0ca", "value": "6:udEOrnlYMRuLWlgg3zz+fQrSfmksU6ErpL12aJy0SYwC9QUmc13Arys0f4l:oEOrn6MFgUUQ+m4Hl1zy0SFMQUmE+0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022876, "uuid": "8fa65418-f6d0-4e26-9f8d-1b15c24743dd", "value": 384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022876, "uuid": "6c053b5f-9bd6-4ebe-be37-52a8c0f1880f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022876, "uuid": "b173e492-e92f-4459-bd32-3fe0a8708840", "value": "PURCHASE ORDER - PI.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538e3eaf-13f0-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744058336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058336, "uuid": "ed5a3d2a-bc60-4426-ab64-b6e36c5a0674", "comment": "Malware payload", "value": "0243e1b3e03cc3ca7f6de720b87cbc1c", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058336, "uuid": "c21260ca-d862-4131-9732-6c19cfe5f4de", "comment": "Malware payload", "value": "21a8a95e2941e914fb969929fb17714326d1612db8781e7d8a1af8001eef73e4", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058336, "uuid": "bff4931d-8740-4da0-a9ac-d5b026e6387c", "comment": "Malware payload", "value": "7419e11d220eff5139c9ee76f1a7f1637693ddf4", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058336, "uuid": "52994bf8-8a2f-47f4-9a2e-518f53d1057d", "comment": "Malware payload", "value": "64a8fd925ed97e492e3015341f077dc543909123b6acd05fcf1c7e8e07aa39d2c9fd821e673429a0171c876aceeca5e7", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058336, "uuid": "12305154-621c-4240-be9f-2be6b89d59f8", "value": "T1AED02B3D43054201C160D8F15A134B36CC9F5A30472C47E35A0CFB0608D16634D9B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058336, "uuid": "d049af4b-1b1c-4368-a889-50bde90092c6", "value": "6:5jeIPWJc5UzCBoVR9OHs8cxxJDOOeIPWJ35kmt+lG:5jEFu+VRIMfxbKl8mtaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058336, "uuid": "9de0630b-9441-4bc6-af8f-7a111b96ddd6", "value": 284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058336, "uuid": "652eba67-5aea-4f72-a718-af1cd19d3e73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058336, "uuid": "c7cf06dd-b303-428b-86db-3e8b41b04bc0", "value": "1YSA7493812930.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0622fa5b-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994640, "uuid": "716b2383-c7a2-407e-8f16-12970d43c912", "comment": "Malware payload (Mirai)", "value": "98ff233dc316ee2b49f438a15bd64cc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994640, "uuid": "0fd4aed4-32f7-43f6-b0e9-60d813485b8f", "comment": "Malware payload (Mirai)", "value": "21ca3ed2cac4b5733a4d27d681341e45235bb54ed221e787f13eae6f7d09b770", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994640, "uuid": "bc93cdcd-9b4e-4b2f-aa33-28af75a67cbc", "comment": "Malware payload (Mirai)", "value": "1d7f588ed3db578bd893b571ec296510e64d238d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994640, "uuid": "a9ec91a6-4af1-4806-950a-bbe89087ebe3", "comment": "Malware payload (Mirai)", "value": "fefb6667ff12ecd9fc1da2874535b996fd38447b5772a2aa47e8f15ebccbd747c58a88d3d6e067cc60057e3f4fc0ff2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994640, "uuid": "d3a03cc1-f345-44cf-9c09-5cac3a8c4f6a", "value": "T19C432BC5B981AB26C7C15677FF0F02493719879CE1EA3342A9291FB437CB85B0E27256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994640, "uuid": "4f2ace54-1647-4aad-80eb-d2a4a23c71ad", "value": "1536:ddni2Z9n1M3jg9TnSZL+IMt/PGKYlHoza86uNknI+04:dhZicGZL+zVPGvl93uNT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994640, "uuid": "137d15a5-66b4-46c7-8a87-5a24332b8ffe", "value": 59500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994640, "uuid": "654abe30-38cb-4549-9dda-6f3163fbb5f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994640, "uuid": "b020297c-3931-4c34-928b-1c4a042a38af", "value": "resgod.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8ac085-139e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744023162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744023162, "uuid": "c00a1730-1836-422b-8bfc-fc0279737706", "comment": "Malware payload (Prometei)", "value": "5f8ad77c56fc728409c21178953be80f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744023162, "uuid": "1bfc806e-c445-45b7-9152-f93d4b675714", "comment": "Malware payload (Prometei)", "value": "248660467a4c16c1215c1674b386b765e0ba54691de190c2e22096d51823e60b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744023162, "uuid": "87c80911-8657-4112-b270-56c6a10a7dd9", "comment": "Malware payload (Prometei)", "value": "52632786d55cc31bf331738e21ff6b638ecea1ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744023162, "uuid": "7467ab55-ca14-492b-ae51-0dd3846da6ab", "comment": "Malware payload (Prometei)", "value": "66a30268de5eb37cc2265fef6d63f693fb3781b2c1385ffb52e43495b5cb1fcef81618a40dddcc4253b73ea89f62341f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744023162, "uuid": "fa2b3690-e5c1-4d88-9951-827c02129047", "value": "T1009423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744023162, "uuid": "1c698487-5aa4-41e6-a23e-3b4edcb1a9ff", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgn:25WOSACZSV6eKRH5EPiamb4DsDwwc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744023162, "uuid": "70dc4b63-52a8-4116-a7d0-9225da07c605", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744023162, "uuid": "0272e74e-7fdc-4159-af92-5691976954a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744023162, "uuid": "2fe96306-2452-4a92-bd6a-e8d1ea2601c6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f6ebca-138e-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744016278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016278, "uuid": "e8257813-bb21-4537-9690-a065fb68729a", "comment": "Malware payload", "value": "daffbfd71f8595ab6d6b8c94cc81a778", "object_relation": "md5", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016278, "uuid": "15e6ad78-f6ed-4ec8-bfb4-221e3b8b5337", "comment": "Malware payload", "value": "24a60e50ed8469fc31afa9abfc361291f72922430cf062bf9c4ac7e6d84b5fad", "object_relation": "sha256", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016278, "uuid": "58f45452-8848-4f84-8636-5b2043bfaee3", "comment": "Malware payload", "value": "74d8e346237999f9ecb92bd88d868f6da4fd85fd", "object_relation": "sha1", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016278, "uuid": "e57da09d-63be-44db-b12b-1d56fead88cc", "comment": "Malware payload", "value": "9097a3e03c4fbee63680ee8e9f0775128145d8b2424a6e846ee9eebb65e7b734eb25457356ecca802b4702dfb9b3ff09", "object_relation": "sha3-384", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016278, "uuid": "07318fde-164b-4357-9edb-385a7e908af5", "value": "T117D423CB4085E304CAE475711E40B9C5BD2BE3B61FA2A210629879D74367DF942FB2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016278, "uuid": "682c40dd-f4b3-4cd8-8792-00aee5951a51", "value": "12288:2DZNLMl8CLgNLzJ+DuehbWQhNK2LEhPKqh6DJ59ujphuiVa262mzkvs:2D0l8CIzUDu/QW2LEhK79y1huikg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744016278, "uuid": "86902b08-2546-40b0-8ca8-ef495776a5d3", "value": 608524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744016278, "uuid": "c1249f99-1941-4644-8f1d-9627a49aafaf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016278, "uuid": "842e9530-28e4-4c4e-8aa0-d1cf8eeb2e5d", "value": "\u041d\u0435 \u043f\u0456\u0434\u0442\u0432\u0435\u0440\u0434\u0436\u0435\u043d\u043e 519445.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f37e064-1356-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743992240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992240, "uuid": "ac26f25f-8a79-4c2a-8d92-77438c0f34e2", "comment": "Malware payload (Prometei)", "value": "366eefb8f45d260b0a40b311ea5504ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992240, "uuid": "e9da2215-4f29-49b0-b561-2b734c609ca2", "comment": "Malware payload (Prometei)", "value": "25a3dce91d079b2ce41560c638fa92b0e5fc685ed62159242573c2463ac10c7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992240, "uuid": "6cb09ac1-66a4-4972-a38b-affd16fe9f0a", "comment": "Malware payload (Prometei)", "value": "64cab4f4f2bfe70eadebdedfee0e9638b1b2c51f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992240, "uuid": "4d716156-40e6-4319-8d06-89ceec1d76e7", "comment": "Malware payload (Prometei)", "value": "b5df35cd185b66a308452c80d9f5ed078d60a7b62019d023e23fb1d62a92dba71130e93eee5a708baa17f50bfb7bc078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992240, "uuid": "43dfa80c-63fa-4d29-a9e1-3d1a72807a37", "value": "T1A7155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992240, "uuid": "2115d982-78e5-4b89-ab3d-99ddc905e666", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplr:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743992240, "uuid": "a79646c4-d477-4bee-90fd-d1e03bc2275a", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743992240, "uuid": "c59e4313-c2a9-421d-b7f6-08c94730640d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992240, "uuid": "9cf397ea-60a6-44f5-9ad5-981c7805f0da", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a937bff-1348-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1743986246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743986246, "uuid": "68718c2f-1b3f-4c13-9932-e59f6fb8d031", "comment": "Malware payload (Formbook)", "value": "f48531351dcda245ca7e9c73d684ebfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743986246, "uuid": "51485383-a9c5-4142-8a79-6ca7d5d39033", "comment": "Malware payload (Formbook)", "value": "261f2a75af3fd7541820c5f57ee4e5d2451001de4f928bd2a13f07bb48a45ac6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743986246, "uuid": "86c87d7f-5707-4a3c-883a-2124d45e63c4", "comment": "Malware payload (Formbook)", "value": "3d690e5c90d9b79c6bd00af582e9ab35bb4cf234", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743986246, "uuid": "335297e1-4282-4a6c-ada6-3d10801bb474", "comment": "Malware payload (Formbook)", "value": "3096011bdae9ec5e99308b03670eaa1aac6f211ddbcb1a683eba4c5ed6bb7ef4a3f0186c5fc8bc8b4082d5902161e890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743986246, "uuid": "56a13981-5852-4986-877c-e91730dae185", "value": "T11445BE2273DDC360CB669173BF6AB7016EBF7C614630B85B2F840D7DA950162262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743986246, "uuid": "dcf81899-b55e-4c9e-9fe7-8c193856a9ec", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743986246, "uuid": "2420a830-ccb1-4c1b-b990-fee22b17e73c", "value": "24576:ju6J33O0c+JY5UZ+XC0kGso6FaSX9xGQw4FnRWY:tu0c++OCvkGs9FaStQQN8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743986246, "uuid": "92027920-b0c8-417a-8d07-be1325527653", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743986246, "uuid": "22365fce-8827-4f2c-b852-2b607e9dfd24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743986246, "uuid": "38aefbc5-1b41-4a33-a724-2958b37f327e", "value": "Employee Performance_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5844dca0-13cf-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744044170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744044170, "uuid": "a0a25e99-f54d-4d72-92a1-fa5c521c0363", "comment": "Malware payload (Prometei)", "value": "546d736866fb86fb8d4d51f1bb018360", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744044170, "uuid": "3dfb931a-ff6b-4ec5-ad48-cc38bfffc0e6", "comment": "Malware payload (Prometei)", "value": "269285d8828107abe98d166f1d002e7ba46bbf5b89e05dfc78608fed77ff7e46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744044170, "uuid": "e8b48081-75a9-4a93-8e27-f96f0e4959eb", "comment": "Malware payload (Prometei)", "value": "0201607ed9059c5fae6d3052a989ba857f0a4dc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744044170, "uuid": "5b843efa-e90b-4410-897c-b3feb15eeda6", "comment": "Malware payload (Prometei)", "value": "a1fbbc88a9ef429d14b63168e5f8ba48c8491e96ba423acdfbdc746b30795c1f6ce85b70f5cc0cee47f96f18bc8a9ec9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744044170, "uuid": "f975d4d5-cde6-41b0-b21a-c35854a2e296", "value": "T183155B653700FF5EF29DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744044170, "uuid": "fc0ac4e1-359b-4364-a8ba-ea3ebdb06eaf", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplw:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744044170, "uuid": "53fb4e4e-58c1-4e22-aaed-680f2321e09d", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744044170, "uuid": "50346ca9-9030-46c8-98d7-94e359377220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744044170, "uuid": "8639d648-e0ad-4277-86a7-5dabb62a5dda", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fa062e-13ce-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1744043729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043729, "uuid": "5377ab67-def8-459f-8406-0cbcb5c1ea24", "comment": "Malware payload (AsyncRAT)", "value": "bb7ee0e66d883f4cab7eb65b4718d2de", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043729, "uuid": "bcbbfeb7-de14-490e-9e0f-20f478520555", "comment": "Malware payload (AsyncRAT)", "value": "27e69ac0767eb994dd5cb9b45b02a704d19b983943468fcdc986a051e8783a94", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043729, "uuid": "690f1466-d197-4a6e-a165-63921d9d3390", "comment": "Malware payload (AsyncRAT)", "value": "f230ce3791d5c585aa6e0063ed1ef8f3250336e2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043729, "uuid": "c1919ee9-5ee0-490f-aaba-43e09040693e", "comment": "Malware payload (AsyncRAT)", "value": "828a41ed1e713126bbf16228bf5fe2ae8223d18a8c03f7ed7bbb769c67a97e9e6b9d2dc641719cb99d819680880ee9e9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043729, "uuid": "54507cc4-b0b5-4957-b150-245c8dc96e8c", "value": "T12C377C06E7940A62D51AEB30C92BCF32D7F0BD250731835F2515EAD52E73BD18A7B1A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043729, "uuid": "df3ee182-2be4-4044-a56b-0145f85dc932", "value": "d27b998cc490c060cac5c6c124469c7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043729, "uuid": "7f657879-11f3-4058-8461-f8090516700f", "value": "196608:P1/KKx5jsZM9D7A7UqBIYEio7+v+clwxm3jDLLPY9DEPdGsTv:1KKnsgD7A7UU/aijPPTIsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744043729, "uuid": "564eb3c6-1aba-46e0-83ea-011beda3bdbb", "value": 22873600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744043729, "uuid": "82d6b99f-437e-4ee8-a903-fc69f5d789de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043729, "uuid": "d404e7ce-d477-4685-a75e-71e7cc7c8c93", "value": "vcredist_244.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c732b21-1347-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743985632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985632, "uuid": "d0d8004d-8046-4fbc-957b-c015e07143ad", "comment": "Malware payload (Mirai)", "value": "8f118da3ad82192d900ba8e7b5835d9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985632, "uuid": "ecd4c939-e946-4c8f-88d8-f04d8f7c414d", "comment": "Malware payload (Mirai)", "value": "284ab4c81ea52f1755119c5b8d8f6851dce15ce3334bdd008e404139ad370d6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985632, "uuid": "6ec4f7fa-3f1e-4e99-937f-29f642414013", "comment": "Malware payload (Mirai)", "value": "a199567adad0ee6723794c2da5504f0dd347466c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985632, "uuid": "6f8bcd3e-c45a-47ef-ba27-63953bfb4200", "comment": "Malware payload (Mirai)", "value": "e5e4e394fd42d177e18355127768a17804be9aa18bdea6c19abfe219992fdedef4383e6b4637dddff6d9a3a96f9ce718", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985632, "uuid": "1546b0bc-5ab0-4ea9-9f75-64ae0645860b", "value": "T12BF2E07E26D56BE0C6BAA430E52CC2A0829756F2E5EA347445D4C3BDFD0138F486DA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985632, "uuid": "a417ca86-a7d4-4102-bb17-127d9bc6bd9f", "value": "768:F8kUDTbWxEjlSrA82XZMv1hK8mndUuXkNSOdYpgs3UozG:F8kUDfIEKA8LvLK8my+k8U0VzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743985632, "uuid": "7ba7fdfe-0062-44f7-bbe5-f3d0ef731e46", "value": 34684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743985632, "uuid": "6c6812bf-5a74-4d8f-b224-bdc8a220ac68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985632, "uuid": "5849a819-429e-4127-a041-b342a0eff14c", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56241f13-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744015391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015391, "uuid": "ac619bda-a48b-4565-952d-397bf989b848", "comment": "Malware payload", "value": "d4a89f9166bceb115d2519fa8d856230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015391, "uuid": "ba02080e-3201-4adb-88ee-2da92a8a20c9", "comment": "Malware payload", "value": "2852883c40d06ed983c838bc7bad359ed4247b3b060b7597702cb0460c12aee7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015391, "uuid": "596ec831-3c78-4317-a2c9-e429955e28ff", "comment": "Malware payload", "value": "b66095c3e0d5e10e7207a190a230fd7c8cacac97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015391, "uuid": "0e481050-4242-482d-a495-c3d82f434da6", "comment": "Malware payload", "value": "4265009fa884488fe2a8279d297e423ee8c0d241a9125db0b3e8db7336f82eeb6b266cc89e96044d9b51f2e9c8844fd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015391, "uuid": "33dbd255-510a-4846-aef6-31f7b18f7f2f", "value": "T10A453388A70A98BAC18F963F174A7B56A7D1CC22E4D1C271CF1E46AD74720179FB064F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015391, "uuid": "0f8a72af-bd59-404d-b35a-9860b0d581e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015391, "uuid": "0999a2c3-209c-4cfa-831f-a6bfacb21b95", "value": "24576:mc5G1Ynp5qLmHnhxDtUflFdmOugrsj1yQasRPxQdrmh8Qjl787/w:mc5GypgLmHhNeflORUQasbQ1Ke7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015391, "uuid": "c6f7ed2a-94f3-4912-9bf4-0ec8e8dabd1e", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015391, "uuid": "fece5ff6-e45d-4b81-9f5b-2b0e6fd27901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015391, "uuid": "3c0b933c-de57-41cf-88ba-80f53ec92e9c", "value": "proforma invoice with signature.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85c55f4-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028467, "uuid": "d920b50e-9d53-42a7-8a6e-f5ffea284986", "comment": "Malware payload (Arechclient2)", "value": "a65e06ab79f119377a2c92fcecc00dfe", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028467, "uuid": "60ebd8a4-637d-4b9d-8c74-2ba9220ae9ea", "comment": "Malware payload (Arechclient2)", "value": "2884419e86608068c59c4352cb7c9472de27549d4710e8ccb2127ac0464e4931", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028467, "uuid": "8d57532b-51e0-4f61-8590-befd62c9b4e5", "comment": "Malware payload (Arechclient2)", "value": "4c3fc302743879aa9713540ce33c78ba12b703e4", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028467, "uuid": "e79ef1c6-0ab3-4efa-bc69-62a9376a6826", "comment": "Malware payload (Arechclient2)", "value": "194b263910face66a302a8da120de5e03e5136f505e19961d2b158193bc2d00e4fbda3448895394cb2ca9e2ac9c8c191", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028467, "uuid": "dcc9391f-f34a-46e9-83a7-30796f896a45", "value": "T1EA66D00177D48472E55E03318A2DA72456BABD71877083C7B7D87A1E2DB26C2EB32763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028467, "uuid": "400870ab-111d-4899-9cf3-60abec45417e", "value": "98304:bRJYyhWYSugsS6a5BtGFC6hxyoZMEHGTS6y4wi36gZByUkXWo7FQR:ls8IkrkS6y4ZdZsUkXWYQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028467, "uuid": "ce548607-b090-420d-82f7-cd3942611b84", "value": 6509020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028467, "uuid": "71887359-d296-4e91-ae5d-3ebc6e86a85f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028467, "uuid": "164abf9f-0fc9-40fe-9156-3d2029e783d3", "value": "msi (3).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc02b198-13af-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744030594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030594, "uuid": "d6fcf997-57bd-486b-8326-28f3ec53b165", "comment": "Malware payload", "value": "5ab1c7ac2f0f270a373933d5aecf84dc", "object_relation": "md5", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030594, "uuid": "20063c28-6bee-46f3-8c43-1bf28dfce04f", "comment": "Malware payload", "value": "2899208ee77af2f7505c9df3e2622f133086523b8a463f3fe7e5fdbaabdddef2", "object_relation": "sha256", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030594, "uuid": "ada124dc-f24a-4ead-941b-11026512560c", "comment": "Malware payload", "value": "d5e899a0e43e2180b8f1b8645d942d064e0924d4", "object_relation": "sha1", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030594, "uuid": "6b0bf740-eb4c-44c9-a82c-006b0dcdf41a", "comment": "Malware payload", "value": "31dd905c0d3cc88200ea07b7e6a8410d71d2309a7604ef736ea653317ef0c4e8fa10ce186664defb3c83b9b8bc7e349a", "object_relation": "sha3-384", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030594, "uuid": "003c7b0a-83ba-4452-b676-53e057f0a5ba", "value": "T1A3B2EF693E90E983034B0BB7BF5764E8DA099D6A3D8D149BE411BC44BAF5C70E1E1237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030594, "uuid": "36ee1224-d85e-4d1a-99cf-c765da9d790a", "value": "768:d4kHkHqv5y/gxq7jHjChpP0owS6V4yICS5TU4+62sIwBP/pw2aZkH1sZ4u:d8uOtPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744030594, "uuid": "70921b46-af59-47b1-a065-fe04c72a47e9", "value": 24921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744030594, "uuid": "bf44de47-85ca-4d05-ae40-e32f6336e525", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030594, "uuid": "00cdb144-4391-44ad-abdc-0066e2bbda16", "value": "Chrome 134.0.6999.43910.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdec7d8c-1405-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744067561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744067561, "uuid": "3e8abc98-e5a9-41eb-9867-306231307e1d", "comment": "Malware payload (Mirai)", "value": "628c47a521f26c2626c44dfa89327511", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744067561, "uuid": "1fcc761b-176c-4314-afa3-44adc9e6a6ab", "comment": "Malware payload (Mirai)", "value": "29392889c12aa28518bdb46c8ee003ad8f5ad548aca4e50bbddafe58c51e5b56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744067561, "uuid": "93975982-7990-4500-822d-1ee0f12c17a4", "comment": "Malware payload (Mirai)", "value": "d2b24be98a2e62ea9e7276958fbeb1a461b7274e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744067561, "uuid": "9cd5f417-3f03-440f-a420-1ab535ca1011", "comment": "Malware payload (Mirai)", "value": "731a739535a2827daffd7680757274329917c6465d1dc779402c7c5e6fcf9d94b58560733998e6d8baf067b651410962", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744067561, "uuid": "b8a5f031-ae32-49b3-b75b-121369e85c3d", "value": "T1D0D329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744067561, "uuid": "957108a8-8693-437a-bf2c-f9074c539a9f", "value": "3072:RwmzTDH86Jk78lKBlpjABq2idSEQ9yWVvjbiBLMdKyAk8i:Rw2TDH86JafjABqHdG9y/LpyAzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744067561, "uuid": "da89fc66-a3b2-4cfb-a5d5-bca1ed0e8965", "value": 136112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744067561, "uuid": "cf36ef25-01a1-47d7-8d8d-ab29789d1a06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744067561, "uuid": "183cec8f-48cc-408c-b331-3cad5ed1b988", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8cc369-13cc-11f0-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1744042970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042970, "uuid": "ad3504e8-789f-4fea-b65f-50295c32eff6", "comment": "Malware payload (Hajime)", "value": "3328244f91f9352b6f3132cd55bd3c8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042970, "uuid": "bc1a9bac-0b93-44ca-9cdc-2d8c843ea07f", "comment": "Malware payload (Hajime)", "value": "29fdcc48966f25ec048af388f191e41bff4766945415e7efe61e417bfa6586e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042970, "uuid": "b11a833f-6732-4b1f-9baf-6ab0664ae212", "comment": "Malware payload (Hajime)", "value": "ab107d10b665adc11b6232be9e8d646958e351da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042970, "uuid": "91b36416-e338-4b91-b2c3-6e71f215de45", "comment": "Malware payload (Hajime)", "value": "492ecc977e7b44c621d855f1d84792f0a5e503a0f9afdcacc59cc7c5952d738d84eac177cb3348df52e832aa42df7460", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042970, "uuid": "453e3433-1625-4e92-a1ee-824ccc5e18a6", "value": "T1D192F18726983743F4B195F5F73CBF88B2062E9DEB3B542750886123A07301BA208C7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042970, "uuid": "c5ddcbcb-726e-4d00-af36-193abf7885f0", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBOo3g1qH:YTYIDfYG6ZmewZ59+Nw1qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744042970, "uuid": "3a49c860-61ba-44f7-aaf3-1c4097a4cb10", "value": 20190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744042970, "uuid": "5ed9bf0a-6fb2-4c0a-b367-ca75450f33fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042970, "uuid": "1003f6a4-4385-4c35-ace4-5ab6dbc30480", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7d2982-13cc-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744042948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042948, "uuid": "db441ec3-f41e-467f-b457-7297abcba76a", "comment": "Malware payload", "value": "3d36d418f731550be40bc54878d71ef2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042948, "uuid": "723b0081-7d86-41d2-af26-c8599b0f47d8", "comment": "Malware payload", "value": "2ae69fc0aa763128d7708e006848bfa853c5f8e061892e088c50975582af4303", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042948, "uuid": "b27719ba-eb97-4fcf-8482-3e3c2da22cc3", "comment": "Malware payload", "value": "e6a685015bb9cb2eda8c8cee84e7ace462708a83", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042948, "uuid": "d84b3aac-c403-4f79-8ff6-5ea751a42905", "comment": "Malware payload", "value": "928be82ce7c5683069adc5efa1c598e58e1927012e65727b5a05b8a32fb283d39acf3551c30ee83f2841d1f28851a455", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042948, "uuid": "f003e87e-49dd-4480-8439-de9004ccbba4", "value": "T19728336A751C9F96A1E7CDA946C9482DF4C211713FE36C5EA023B4051C8FE0DE2D9E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042948, "uuid": "c9fabaa1-d878-4715-b218-d926735eddd9", "value": "3145728:W5RO1bG0c2f/sVuR3Z9Cg0mlYHjcUTn0ls6:WLO1bHGuRF6rTn0ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744042948, "uuid": "3b26240c-58c9-49e8-8c9a-578c6c49d02a", "value": 102489883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744042948, "uuid": "d7b87e49-8e95-42a9-b216-e74ccf7cb167", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042948, "uuid": "948c4d5b-7be2-4ac5-8d63-25edf862c505", "value": "MulenuGame.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe29d6e-13bd-11f0-ad17-42010a9c0004", "comment": "Malware payload (Vidar)", "timestamp": 1744036694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036694, "uuid": "f29ee08c-3c06-4d23-997f-e39604f87321", "comment": "Malware payload (Vidar)", "value": "cf080c67338b28ff9b72f3393c04cc22", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036694, "uuid": "9e1e3ed2-8795-4599-bdbf-e605e0c3fe24", "comment": "Malware payload (Vidar)", "value": "2b001e975bcf9400a7727d79af902dc01055da5f7446b829b19c66069f173e79", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036694, "uuid": "efeb4483-2a30-4d0b-a210-ac86e7a4638a", "comment": "Malware payload (Vidar)", "value": "bf8876c5267e38be803cff4e66e88a482bbccad2", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036694, "uuid": "e7d9533e-1627-48f7-b5f5-cba4c46ca0bd", "comment": "Malware payload (Vidar)", "value": "571b498b2de94d8949fc81023d4b118cd9a6917c0df6cad4a2eb93de5af3e4c247630d1a08bd87dd338434c9b4a37327", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036694, "uuid": "c53727e8-f5c5-4d42-9353-b5825f018814", "value": "T1F8F64C95B708B1C000870A759A318F8EB93BAEC6F2515B688D3BF838F1C9B075677567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036694, "uuid": "d21da129-e0af-4dbf-aa0c-f0c36a717f40", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036694, "uuid": "88edb85a-39a2-4673-b7dc-deb387569cb9", "value": "24576:L0aqjM/K/xHEpSa2nl5JAHuuX5vRoHg9ORYfsaEn:L+M/K5HpPJ0XkpFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036694, "uuid": "05d1237a-eef6-40da-ac7f-e0aeeb424597", "value": 15740621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036694, "uuid": "880ffa41-08f5-40bf-a501-f34872847e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036694, "uuid": "fdecd21c-64cb-4932-b8fd-4140384f893b", "value": "\ud835\udde6\ud835\uddd8\ud835\udde7\ud835\udde8\ud835\udde3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e04342c-134f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743989231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989231, "uuid": "760b6dd4-a67f-4443-aff7-4559702282c2", "comment": "Malware payload (Prometei)", "value": "bc488d234fdad401030115524268b416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989231, "uuid": "b9310685-0806-40c8-ba56-89d9707ce918", "comment": "Malware payload (Prometei)", "value": "2b3bcc655d6bb65b3e4af31ce4a61d459d551d2ddfbdc26462c135246e68d8ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989231, "uuid": "8f93ecc1-b6a8-4ab8-9a9f-e2e10c9a88a0", "comment": "Malware payload (Prometei)", "value": "fd052560bfcea5ff3bdacd7a8eea4b2783b14172", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989231, "uuid": "e8edfe02-6af7-466b-901f-654ca54ff6ab", "comment": "Malware payload (Prometei)", "value": "b13a04e9a44c14284419998ddfc9d7956a95c5060a76012c1dde675d7dbefa4e050026438ab32d93c97f62ec969cdefb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989231, "uuid": "21def1cf-2cfc-4d2b-9a69-a9f0d39d47ae", "value": "T1789423F8C83D2E3098169B3CBB5A826CF0A15772D9562F7AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989231, "uuid": "ec6de41a-678f-4006-a250-00f820c93160", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgH:25WOSACZSV6eKRH5EPiamb4DsDwwc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743989231, "uuid": "2f00ee72-b305-47a3-9d80-d8c72e63c24c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743989231, "uuid": "6333e4c9-8833-4a19-a89d-6a95bfa224af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989231, "uuid": "d6cf085e-328e-4cf9-a31d-4d497a2f9fd0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a961e36c-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744034428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034428, "uuid": "c704e43e-e707-451e-9795-ac2eac06cc2d", "comment": "Malware payload (AgentTesla)", "value": "2e39d085e1d25a202abd1e65146c0195", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034428, "uuid": "f7cb36f5-ae8e-4033-9f75-bc128fc4f83a", "comment": "Malware payload (AgentTesla)", "value": "2d096b77a85732091954e941e842e3518cda30e2ae75c64e68f893bb5bd14b46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034428, "uuid": "9cceee10-276e-47a1-b3ba-02e8dbce2d4c", "comment": "Malware payload (AgentTesla)", "value": "3a222b40eae844933c9284122be2dd4c3cb59d69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034428, "uuid": "690bc300-74e8-462d-9c86-118cec56b78b", "comment": "Malware payload (AgentTesla)", "value": "729416e57b52f83a58e249edbec39850cc5f4e90df5824eeb5a31e037a3035e1e36d7343834b904e69fd25d13e31ec04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034428, "uuid": "8a55fd75-23d0-4724-9d7d-f01d5b1cb2e1", "value": "T1E225BE2273DEC360CB769173BF6AB7016EBF38614630B85B2F980D7DA950161162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034428, "uuid": "c8dfdbeb-46d6-4fcc-9613-d573aaf51ab2", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034428, "uuid": "ba50cc7e-fda6-4ea5-b01b-d796c55c2d31", "value": "24576:Fu6J33O0c+JY5UZ+XC0kGso6FaYTfp6sdcV9p3DWY:Hu0c++OCvkGs9FaYrQsdcV7yY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034428, "uuid": "83d56608-c6cf-41ea-813f-99b17391caad", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034428, "uuid": "5e403915-1344-4905-85ad-cf65afe0e0de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034428, "uuid": "7ba3bcaa-9c6f-40cd-9a2b-1f61aa13c69b", "value": "2d096b77a85732091954e941e842e3518cda30e2ae75c64e68f893bb5bd14b46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df8c4dd-137b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744008156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744008156, "uuid": "7969c908-9d42-4d79-b0ca-f50a02c9c53a", "comment": "Malware payload (Mirai)", "value": "233498cc485f3d9323470e0d74e313cd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744008156, "uuid": "d9ca292d-fd40-4045-96ef-e1487e774309", "comment": "Malware payload (Mirai)", "value": "2dbdae2cf27308d8dd73a031576c7ca1bdc45053f38e0054ef050be8236467af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744008156, "uuid": "a1a6bc74-b402-4708-a214-1b0bd21aaef1", "comment": "Malware payload (Mirai)", "value": "060be82f17864c224b4635f4a774f4bb117f4833", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744008156, "uuid": "66b1ecf4-3dcd-483b-a634-26eff604bc76", "comment": "Malware payload (Mirai)", "value": "07359084b647f713b27450c77550d2b29c8cabba4b3179b4748838282c25aba9765b4b4244a10706d3f8a067e083568d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744008156, "uuid": "bbdbf49e-0c33-40d0-8965-661a39baeeb4", "value": "T17271A9F87C716F3ECA8EDF40912188656C3BD4D129A18B05E47E24BAE6FCE05A47174B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744008156, "uuid": "1a1322fd-4e80-49f0-86f8-c8676a4ffa55", "value": "48:olpWxnNa8MFPMB3AQNrq20YENeRmAoENr4TmCFv:oKnN6PXQNAzfSS3Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744008156, "uuid": "84b72bf7-adff-4239-83af-623f135480e4", "value": 3520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744008156, "uuid": "ccd8b17f-ef74-4185-a36f-0e2c2fc39b47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744008156, "uuid": "9730074f-9f12-4f92-9439-97a83f0fda9b", "value": "mass.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e8be2c-13a8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744027492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027492, "uuid": "7bb2d694-b285-480f-83b6-2f08418ca499", "comment": "Malware payload", "value": "1a02c07eaefced5b7078144617f42998", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027492, "uuid": "cfdfd29b-e592-4a9d-a88c-4a0adad4f9f9", "comment": "Malware payload", "value": "2e3568804af8ab7a255c16a54a7c5ed4e065377aad32e46ab0b3798fbaa1409e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027492, "uuid": "e06dce56-86c6-4796-b2cf-0e4eb39500e4", "comment": "Malware payload", "value": "cd0bb5b0be82c3f7d4e79ae0cefac0c14e53607c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027492, "uuid": "7f3457bd-94d4-4610-bf1f-80b346fae113", "comment": "Malware payload", "value": "7421708e0ace44a7c439fd6c3f89ad9fc0f7ae6db1f2e231c3f3dd01340f22d0da8490921583e1f5ecf164c776c35c74", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027492, "uuid": "fef9c386-def9-47d5-938a-7b153b42707d", "value": "T1E7C67A1E52463A65EDBCCCE2A244E26AE1F7C8A73D1034B5B94AC367EF1DD75E090720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027492, "uuid": "75e8f8b5-293a-49f9-88ba-06c93ccf5bfe", "value": "196608:0KWtkKp0o8mgHOsv484sn/1+6i5bCCZyfmGLjs8AHxg:YqKp0Fn1/1ByeCZy+Gv4Rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744027492, "uuid": "064f07f0-5ee0-4691-af09-478d372ad796", "value": 11626843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744027492, "uuid": "4c13b331-516b-4d0e-a7a2-95a8c474dfac", "value": "audio/mpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027492, "uuid": "a4fdd5c0-5179-4f97-b0ea-8bc276c86c28", "value": "cjyvy6os3j.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d89084-13dc-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049939, "uuid": "ccfcb240-99bc-4452-b635-755820bd52e5", "comment": "Malware payload", "value": "310e0b159088937e6e285f162aacf88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049939, "uuid": "8d15c543-93d0-499e-b470-655d5ac4ec87", "comment": "Malware payload", "value": "2eb84c78ab2354c4919ba364402a14a02aff97a8a2f32dafeab24b13f56caad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049939, "uuid": "b2b9d01d-5b78-4c9a-bf77-828bf11c8c1b", "comment": "Malware payload", "value": "8738b0a5c23a34a4c12d474948d8d9d580388a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049939, "uuid": "64adcbd0-daeb-45cc-b46d-3739daba2368", "comment": "Malware payload", "value": "507fe7176f486efc62c6818bc75dc9508e94ffa229c8936f9578dfc77de709ba6b0f35fb7994f3e2ec5ba259331667ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049939, "uuid": "67e6710f-1636-422a-bc05-cd02628e9c97", "value": "T1EA95CF23F2CBE03EE05E0B3705B2A15494FBAA256523AD5786ECB49CCF751601E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049939, "uuid": "78284190-01c3-4c4c-9348-18b868a2c7cd", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049939, "uuid": "ed7f6944-f147-4cc0-be8c-0c34b95c7adf", "value": "24576:waE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH1vNf+8H5JaFMWHIta3+8Fk86Y1ol8:0+MRvHrF4Ju+ekQoEcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049939, "uuid": "eee850c2-c31b-4493-9b84-ff82be966a45", "value": 1914581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049939, "uuid": "ee80bbd1-8ded-4c7b-a618-badff53503aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049939, "uuid": "16db60b2-8173-420e-9c3c-34b904141d6e", "value": "310e0b159088937e6e285f162aacf88d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61e25d8-13f0-11f0-ad17-42010a9c0004", "comment": "Malware payload (CoinMiner)", "timestamp": 1744058501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058501, "uuid": "1b168fee-25f6-48b4-a922-e50d4108504b", "comment": "Malware payload (CoinMiner)", "value": "f260c734b1fd66443de91cb53a857b5b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058501, "uuid": "b707b4b1-c6ff-4893-9a45-0b791d74da6d", "comment": "Malware payload (CoinMiner)", "value": "2eb9c409c7aacc8efc7ed4e96964d378c1237d7941b154cae74d99789f9a38b4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058501, "uuid": "7baa8a36-13df-4266-b002-69ac98a452db", "comment": "Malware payload (CoinMiner)", "value": "c5257701e6cbfbb852fd90560e6533e036bc9d79", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058501, "uuid": "df840fda-29a0-4315-bcbc-d65350d57179", "comment": "Malware payload (CoinMiner)", "value": "7cc7bf9682b9865d840dbebdfa53a9979ebb47a563717d778908f00d136553e00eb2c97f23a8204527afc2ae46ad6c25", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058501, "uuid": "825a0415-7ac8-4eaf-9107-cc9fbda11206", "value": "T10B463314D44A58DADEA342B09D114602E9337D63C73C9BDF53B0CBA62E93EEC597A318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058501, "uuid": "353397c3-80ea-473f-82f0-11fa4f56a4c9", "value": "d7df155ab6f6974888ad50c6d9e3480f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058501, "uuid": "79adcb5f-478c-4563-97a3-7ca2f708140e", "value": "98304:DO0hSVQ/0+JgGxdFKoUlecDNkjSTwP1bifCclLZsFC+gJ6j/7UC541SFNcx8:68Sa/0JYdFR8DNMSsBXONm3UZYI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058501, "uuid": "868aa287-fb70-48d0-ae3d-7586918ed9b1", "value": 5615104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058501, "uuid": "b6df54cb-883b-40aa-ae79-4025ce3704d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058501, "uuid": "a3a22697-d357-43c1-815c-f05d3d570645", "value": "SecuriteInfo.com.Win64.CrypterX-gen.31944.20452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e79bd2a-1356-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743992239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992239, "uuid": "31454de7-85cc-44ca-b16f-1e824fc50dfe", "comment": "Malware payload (Prometei)", "value": "fbd86d107003be717e93a209b60b9d8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992239, "uuid": "984559e9-db19-45b1-9eba-2d20a154aef3", "comment": "Malware payload (Prometei)", "value": "2f352b059ed884a949e53bff72d6072014678e3ee7456adc8489f4247676fb0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992239, "uuid": "4b3c26fa-1a74-4471-b389-c3b35f31f8b3", "comment": "Malware payload (Prometei)", "value": "8f9ed19ae770a897959f0315e55cd2e9288c299b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992239, "uuid": "0a83b991-8e0c-4799-931b-e7aabfff7bd6", "comment": "Malware payload (Prometei)", "value": "3194d0c43bdc35472ef984d9447c9b8d313020ae6c67dfe7eacf13633feda8fcf2ce184aef2a62aec250369ee831d294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992239, "uuid": "fbbd2e75-c1ff-4b41-97a9-fc0da8a9bac0", "value": "T11D9423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992239, "uuid": "e019dddb-8b76-479c-8777-02b54982c558", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgI:25WOSACZSV6eKRH5EPiamb4DsDwwcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743992239, "uuid": "5055fc6f-f63b-487a-aee3-a93aadf2c631", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743992239, "uuid": "d68af5a7-f199-4cdd-8f8d-aae142a73fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992239, "uuid": "578deda0-d493-4a7e-811e-defafe947389", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea10e3c6-13dc-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049998, "uuid": "0ae552b3-e189-4ec2-b8ae-063e060d32d2", "comment": "Malware payload", "value": "c5319226246e278bcef9b7ac75e22dc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049998, "uuid": "69be8db1-1d29-4bb9-ac07-de99dc14d6f3", "comment": "Malware payload", "value": "2f5919bad203e226d55ae84fc6fb680be0cc6e82b8ef575e8d10e67adb083532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049998, "uuid": "9e479ead-cd8c-4585-ac57-21f209599e56", "comment": "Malware payload", "value": "d3a6c4e37b3baccb6dd18b55c2974f3ad8159a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049998, "uuid": "a2b2558f-f27e-46c4-b668-c07f8dc78a50", "comment": "Malware payload", "value": "40f7fe81f8e4709ea2c15dc07c9132d59ce7b7c13b74c491eaee7fa00eeb99c1885706722eedbaf2e6cc967406afc28a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049998, "uuid": "7b2dacff-637f-405f-b017-7922019e17e8", "value": "T1DA95CF23F2CBE03EE05E0B3705B2A15494FBAA256523AD5786ECB49CCF751601E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049998, "uuid": "b065707a-2e30-4afb-b9d4-42b397c2d12e", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049998, "uuid": "102837ba-20b4-44dc-b289-23b966cf581c", "value": "24576:waE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH1NNf+6H5JaFMWHIta3+8Fk86Y1oli:0+MRvH1/4Ju+ekQoEct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049998, "uuid": "e2a1d8e8-f024-4d1d-96d5-eca54ec111c3", "value": 1914657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049998, "uuid": "cd5dcb87-4388-4b6b-9bda-2e77d893a845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049998, "uuid": "f53bc139-e4e6-47ed-a874-e074582fe034", "value": "c5319226246e278bcef9b7ac75e22dc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c616d56a-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1744024168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024168, "uuid": "8b9ef905-50ad-4ee7-a465-088c43532fb7", "comment": "Malware payload (XWorm)", "value": "507316fb00445c9545c6745b22beb61a", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024168, "uuid": "54b9b29b-648c-4ed4-922b-101d361bead9", "comment": "Malware payload (XWorm)", "value": "307751653bce22ec059223c3e516840d20963e0e90d98f1cc83a11f8739f3deb", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024168, "uuid": "8b84d9db-8605-4914-8541-1975d7361dcb", "comment": "Malware payload (XWorm)", "value": "26b6c90ac4c68f1ee779efffea602a465d71e4bf", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024168, "uuid": "337124d9-c087-4220-a65f-0969ffdb9b4e", "comment": "Malware payload (XWorm)", "value": "210c89b539e8291099ac9fed0b2ec006f7791780c5528e45a68876985f142cb9d83156a26786d63f02b565f578c5102f", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024168, "uuid": "56380b15-07bb-42f6-885a-ddadb26b3c71", "value": "T1A663A0313402BDF5627ECD84E21428B1FC55351F56A58E7CBA8388792FB64E09AFD9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024168, "uuid": "b0395b1d-a26b-40be-adbc-52ad921cfb3c", "value": "1536:F75P27RyZoUrJ/72cWAcdCURheY91KnMB:55trJ71coq1Knu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024168, "uuid": "6dd29a1b-77ae-42e4-a6d5-1e4485638107", "value": 67428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024168, "uuid": "8de4cede-b3b6-4b07-9d13-1ea225d23538", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024168, "uuid": "06abf5d7-542a-48dc-89a9-6a3b200707e2", "value": "83.147.240.230 (11).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548ac8bd-13bd-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744036433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036433, "uuid": "09116cb3-702f-429a-8d12-cc2cd91f9d32", "comment": "Malware payload", "value": "cb9d250ba277ba0b50ee7a0d1fabcc16", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036433, "uuid": "dd3f533d-bfd6-4c2a-b00f-82067d90ee04", "comment": "Malware payload", "value": "30eb01177844dd73b3955d00165056ce294ecd2f96332407d46e11100953c07a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036433, "uuid": "423eae49-dcf1-4943-b380-e05bf1591517", "comment": "Malware payload", "value": "95d899feac9347fdc92ace5e42e9ba01533bd9d3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036433, "uuid": "2d42dc76-79cf-409d-8a58-71d4049c632d", "comment": "Malware payload", "value": "89bd0de1d6923ad0f9131d17e2759912704548fb93d2dd8cf45d7571d9f08e730fe5c581f5c2582951d0dfe66a25b918", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036433, "uuid": "c6c58b73-9f9a-44d6-b646-757197dfde36", "value": "T141E3122796040F5DD30E6B3290542868EDE4157687378B1FB7B45ABC8A7F3AF4680B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036433, "uuid": "e75f4482-d5bb-4210-ae3c-fb3a0b84a24a", "value": "3072:0aoXkGEkdk5pX/pu2DoKGvXyLkAG+GAXTlGCAUL9EBAKEGGVzqh6:0aWklMk5lwCzYyYfAXRGrKQA/JVzqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036433, "uuid": "93837e70-bcb0-4fad-b47f-b09eccd238a5", "value": 144888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036433, "uuid": "bc23fbce-21d9-434c-b931-b6910920533f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036433, "uuid": "ad808d49-723a-4167-9a46-4e0c8d80cde0", "value": "SWT-BT-GJ23000.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f49c2d-136c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744001804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744001804, "uuid": "28aad580-7ca5-4d29-9802-fa1b67bceaed", "comment": "Malware payload (Formbook)", "value": "ff5a3d6bdeca5e6a42761faac183664e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744001804, "uuid": "7e30103b-2ff4-4eab-9df8-b9562dfae113", "comment": "Malware payload (Formbook)", "value": "31392e6a085cd192909456279d9ee965c0279928d06b6c7133afba72905cadf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744001804, "uuid": "ef87ba1c-a4d2-4741-9a89-3d77d25883cf", "comment": "Malware payload (Formbook)", "value": "b2b930c8105e848b23cf522cabaa334b71744d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744001804, "uuid": "03ed80df-15b5-4ce6-ba5b-471540b9bc45", "comment": "Malware payload (Formbook)", "value": "360d0f9f06fda0ec3c8f4544ee5d285bc427e4b5a01cd5028b852609e91d0b7179d575060d6f8d9be434c8bb3aae04cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744001804, "uuid": "32ba9322-eccf-4a91-9446-c59343432c27", "value": "T1FE05F1A4336CDC17C5BA53F51821D37403B66DAA6521E387ADEA7DDB38E1F441A00BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744001804, "uuid": "e046c91b-e628-4a1d-8c01-0e40117402ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744001804, "uuid": "92f1fedb-8085-4e75-b7c6-3a30d9d603b5", "value": "12288:4YFlYqBCCwf4e+Y0CgjWx94VyAC+mJcORF9UKZvve8DB0XRY0BfSBs1vdOl/lwTy:MfQlCFx+kD+mmOvW5xSgZ4zdzbY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744001804, "uuid": "b6b9111d-5b9c-43f0-a63a-fccd1a26c509", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744001804, "uuid": "cf505711-45c6-477a-9bae-551aa5025077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744001804, "uuid": "951b6cc8-a465-4a5f-a3f2-79895ccf5fd1", "value": "wN2CkbzxeQPK0sV.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617da8ca-13e1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744051917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051917, "uuid": "92706267-5c66-46f5-af51-4257226d1d7c", "comment": "Malware payload", "value": "7bfc7569ef1db7a12352dee90ca72623", "object_relation": "md5", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051917, "uuid": "7d94e708-5f19-43bd-b971-418ce5186e5b", "comment": "Malware payload", "value": "333c037c9bb3ca75c92e5e2b3dd884df387a4ab73f8f9c8efc39c27e43b9c317", "object_relation": "sha256", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051917, "uuid": "7b54613f-4305-494f-a3be-688c80034043", "comment": "Malware payload", "value": "519dbbc674182934cd2dda5a229b44a6707e87e7", "object_relation": "sha1", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051917, "uuid": "88b1e666-7b2b-4648-81d7-5b30da6cee8d", "comment": "Malware payload", "value": "c8c6e82cfbd39bc51369db7738d70b24c192cc52762f9587dcb8b26a7c94d21ff06ceda91f758c50238999a81de583d8", "object_relation": "sha3-384", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051917, "uuid": "9b3734de-bdda-446c-890e-144534b01ca5", "value": "T1FD5255247A85956F97B3536AAD42E105FE95023B9C5BD90172CCC0C1BFF110ED3A4ABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051917, "uuid": "1aa14f85-cf11-416b-b3da-81cbc3b6e734", "value": "192:FOmpTf9Hl4pnAExzw5XSmEcJiWmh2JX8slufuVoMrerdBtej/:FOKf9HqpvzwNMWDX8slumVfrerd/ej/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744051917, "uuid": "eca2c702-c307-4463-bc76-058fc10455a3", "value": 13651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744051917, "uuid": "8f511852-c10a-4329-99c8-d36ba0b13b3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051917, "uuid": "4a1ac0bc-ba70-4b4a-880c-1beef55c595b", "value": "cliente.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574df352-1385-11f0-ad17-42010a9c0004", "comment": "Malware payload (Apos)", "timestamp": 1744012386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012386, "uuid": "f4691eeb-936a-4140-abfb-e80eb5820f70", "comment": "Malware payload (Apos)", "value": "bb62d73fcab6f29f95f9919e1dc0932c", "object_relation": "md5", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012386, "uuid": "1acedf25-df79-4e15-b7ab-3b517e4b813b", "comment": "Malware payload (Apos)", "value": "33a99066776eacf39e2f36243b8fbee2e542e35a4b56531187463a266dd5b0ff", "object_relation": "sha256", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012386, "uuid": "8d8d7b1e-f0dd-450a-8d73-94ac05879561", "comment": "Malware payload (Apos)", "value": "4657887a8f288d3b764553b88e3b60c3656936a9", "object_relation": "sha1", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012386, "uuid": "56559e2a-c48f-4365-85e1-bc548a5b098a", "comment": "Malware payload (Apos)", "value": "a5ad8a2e407be18ff789f231a65e19fdd71707013561678a5f4a4c97c55371fe9fadeb18559a2732c03422f39c2c0432", "object_relation": "sha3-384", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012386, "uuid": "55059925-39cb-44cf-906a-e5b583f84232", "value": "T191C51306E3E909FCE4B7E178D9979E12E2B63C0D0371969F13A5566B1F233A09D39321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012386, "uuid": "41721089-e103-467d-a71e-fdf277d055ee", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012386, "uuid": "46ed263a-57c5-4e74-a39b-6176e8f26b82", "value": "49152:RZB1G8YJtiBO0r6fUTfC+qc9LyRb350D2tZcRpU8bxGWxmhQXkHWaZO0:j3GXAT0UEMmRbpERpr9mzDs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012386, "uuid": "bc136e9c-8a07-498a-97b7-e6b6f02a3d5e", "value": 2625175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012386, "uuid": "b82de7fa-d4ab-41b9-a253-0c86b2e6395f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012386, "uuid": "be14d00b-d202-40e6-bb56-52486ca56c50", "value": "33a99066776eacf39e2f36243b8fbee2e542e35a4b56531187463a266dd5b0ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf83795-138d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744015697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015697, "uuid": "c53175cd-6317-49d1-8345-9f14afed3026", "comment": "Malware payload (Prometei)", "value": "937ec577feb19e38d741a53290345926", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015697, "uuid": "a0b655e5-e3fd-4b12-99da-488d6a0a37da", "comment": "Malware payload (Prometei)", "value": "33de4b796ce69921b844a08604e33bcee6399f772b3548a568383b866fd39300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015697, "uuid": "f4d8e28a-9900-4b57-b75c-180ac4e6da55", "comment": "Malware payload (Prometei)", "value": "a1623341d03a5a7f7f0e2a86b39fad75c9bbe5de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015697, "uuid": "50891726-10dc-4d4f-b611-ced13a592b0d", "comment": "Malware payload (Prometei)", "value": "00650bab6142ec4a4dd0695a2097dc413c16e65ca4ddbd108710c4de0bbce35bb6d8beabeda890e6afe6593c0fa97c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015697, "uuid": "098b0cf4-780f-4638-8dc2-e3c1fad70234", "value": "T1629423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015697, "uuid": "b5df4890-09ae-4d00-9a9d-50d1716b19ab", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg0:25WOSACZSV6eKRH5EPiamb4DsDwwcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015697, "uuid": "dcf40df0-a86e-4071-ae45-6fc3eed8a867", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015697, "uuid": "28a592e5-5280-42fe-9890-a6c60ba943a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015697, "uuid": "de39b2c1-2061-401a-87f5-7837016822dc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c416252e-13d1-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744045210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045210, "uuid": "be95c1e7-61c3-4a6c-9ee3-1333ba62b5df", "comment": "Malware payload (GuLoader)", "value": "5bbb2a2901f1cf515dacf3a7843ae264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045210, "uuid": "623811dd-f1dc-4014-b410-710104e86a0e", "comment": "Malware payload (GuLoader)", "value": "345c8803bf81ff7862597daa4155b7d070f68168f5b06df674fdfe1b75d08525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045210, "uuid": "934b96e5-bb96-4367-a1be-26b67e69e7ff", "comment": "Malware payload (GuLoader)", "value": "3223c18280edc35f1e06e0b1fc68a6fd59d1c032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045210, "uuid": "4764d7ef-23d6-47af-b622-2b1f9fb3a6bb", "comment": "Malware payload (GuLoader)", "value": "ac8a2a170fb46e2dcb10f118269c08cc60dba4f28947976fec2e69aa56fb6c08ca059a978f60fed03ee2ec61df429577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045210, "uuid": "05a77e77-d259-42c1-86c4-d1bf9c403698", "value": "T11525230B5671C60AD05B5DB2285FCE93BB86E70144ED8BCF67568F863E32381A50DB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045210, "uuid": "440b89f1-3fcc-4f54-a590-4f7f54929cec", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045210, "uuid": "ff7870c2-02d5-45ab-9b08-b5ac7e4ac322", "value": "24576:CMwH5IlPz77hgMo7nJ/0jTosW5F7v9CIWMOWv:CMwZKuMolB5B9qMOWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744045210, "uuid": "cdadec66-36f9-4767-bc99-a7fd5144be4d", "value": 964808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744045210, "uuid": "c1b185da-074f-4b90-b6ab-0cc47aca9236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045210, "uuid": "2448a9a3-55af-4999-8f93-abd8e626ddf0", "value": "rfactura00386.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e273395f-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1744034524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034524, "uuid": "8e867f9c-15ac-4a0a-99ab-ebf31af3bc0f", "comment": "Malware payload (MassLogger)", "value": "91100e2f5cccb43b6df820626e106bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034524, "uuid": "31d3dbf6-04ad-4c18-9bb0-b0d230a5cada", "comment": "Malware payload (MassLogger)", "value": "34f6133cf583cb11933a78536f75971e5cc8d2c007d0a08b00eebbcd4efd912a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034524, "uuid": "01c558db-82de-4981-a8ed-db3c97fc41d6", "comment": "Malware payload (MassLogger)", "value": "5784e334c91c083bd985453484d44f5c8c57e6fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034524, "uuid": "466ba929-e466-4148-9749-7addbb973a2e", "comment": "Malware payload (MassLogger)", "value": "b321d98e6b58f56cd140187eb67de4abf3c95f730f5a85fc1d4ade5a1b7d9915d720f611934b175dd58aadf8c600a377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034524, "uuid": "d3b57af3-0b90-46da-bd4b-8ac6f144ca4e", "value": "T11B351207BB4A8DB8E753173EEBBB150457A4E082A183C77A254B2B4E184F7BB55D130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034524, "uuid": "38b14884-8222-43ff-8909-9ade022b762d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034524, "uuid": "2ec4a1b3-2aad-4351-add2-40afa19d79dc", "value": "24576:PMnO9KfuXHn2RvU1zrQK1jO7wmq4bENt010WQrr79bxi7OrOSi:UOMfuXH2Rv2D1GwpzHr79bxi7Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034524, "uuid": "425953f5-c8dd-443f-b351-4ef2859d34e7", "value": 1153024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034524, "uuid": "f61b7ec1-589a-46aa-8110-9c8c0b298e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034524, "uuid": "7a8f74bd-fde8-42f6-993d-f5db416a939e", "value": "34f6133cf583cb11933a78536f75971e5cc8d2c007d0a08b00eebbcd4efd912a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3c00de-1347-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743985633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985633, "uuid": "89789f9d-ef6a-4855-81db-eb72db03c638", "comment": "Malware payload (Prometei)", "value": "3583b874e0306b7bc44200b6ab638e69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985633, "uuid": "c9182b3f-1bc9-4454-96be-b69f75daf54e", "comment": "Malware payload (Prometei)", "value": "3513d6c4f3ecfa933af3659ca3c4b411a732a7f98baa3283969ad5805e197386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985633, "uuid": "90cccb60-dc0d-4943-bc6c-ab9c5500b0e5", "comment": "Malware payload (Prometei)", "value": "2a444fa2d69fb1ebf07ee931c5c4c6cf1804cd62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985633, "uuid": "ca3ebddd-13ea-4cb4-b8da-9a6ccdda6385", "comment": "Malware payload (Prometei)", "value": "783224d2800e38507d77eacde2dfa75901e13f5335b5df877aad8d11973db7aedffabae0cda55aae60b52e8d788c1e30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985633, "uuid": "ed940c0d-45fd-4957-9b74-18c0afda9226", "value": "T11F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985633, "uuid": "2b8b90c7-fa70-4594-a880-954a1652ec1d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mply:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743985633, "uuid": "2cfdc8ab-7855-4802-951f-0edb6ca7273c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743985633, "uuid": "4983fd3e-5994-479e-afd2-2f7e3dcdbff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985633, "uuid": "1a4e7f35-ec7a-4fa8-ab58-a4b19cf0f475", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793c8aaa-137a-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744007718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007718, "uuid": "6769bbbd-7b91-45f2-b0ae-085f3cf46842", "comment": "Malware payload (SnakeKeylogger)", "value": "1ec8195374e1e7e4e7fe82d80e2a36c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007718, "uuid": "3eab2ede-87c5-48c6-9a6a-5326eeb47db7", "comment": "Malware payload (SnakeKeylogger)", "value": "3543cb3f9359037b6f177ab44ef175f17017381b33759d9709b46268f248012a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007718, "uuid": "04be3438-093f-43f3-807b-aa8192412286", "comment": "Malware payload (SnakeKeylogger)", "value": "fe991cf54e15852f94083cc5e5de2d3aa1662358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007718, "uuid": "63bbe0f1-1de2-4c3c-8310-cda024dfcb0c", "comment": "Malware payload (SnakeKeylogger)", "value": "1655b44c78986231304891f63f3a632594d4be2972a3e60f617b07ad88a76924ad45241c48e222a228c5b093cf693bac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007718, "uuid": "a32b4b7a-7c64-4f6b-b9de-3aa7c6421909", "value": "T1A105F064336CE903D5B643F51820D7700376AE9E7A21E3C69EEA7CDF38A1F415A4069B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007718, "uuid": "cdf6de00-b05c-4b25-b14d-51e04ae77de3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007718, "uuid": "be002bc0-1afa-4416-8e21-a4824cdbfa1e", "value": "12288:CYsYqBCCwfdSn0YZ2uz3BeSFNalp1j5fQ7Khjb3NM4vzM9NsV6utPmW+B0zwDGx7:zfV/Da34vp1UU3NMFsVHm1EILy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744007718, "uuid": "3ebef314-9440-4100-9dc4-2ce905146087", "value": 846344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744007718, "uuid": "a769c21f-2c2d-45ed-8594-fa4c6ccd5539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007718, "uuid": "9a2a30e7-77eb-44f5-b2cd-7973a7188516", "value": "SecuriteInfo.com.Win32.CrypterX-gen.24076.19505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d178dfb-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744011188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011188, "uuid": "a36f65bd-4f23-4d04-9fe5-2af5c3c6625c", "comment": "Malware payload (Mirai)", "value": "4895d7185e2008b7ccd4b7ef4f487253", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011188, "uuid": "a5e27210-5da4-433f-9b09-f4eb9ca2cd6a", "comment": "Malware payload (Mirai)", "value": "372954b8501f6bea6886866ce1088aa17c6ec0c00d4345942bd84adeafaba5a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011188, "uuid": "a90432b8-c637-4f42-84f9-0f0418ddecbc", "comment": "Malware payload (Mirai)", "value": "274e43853695d0e507594e2bc6771438c892160e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011188, "uuid": "84d365c7-2b8b-4db8-a330-216c64322c20", "comment": "Malware payload (Mirai)", "value": "dc1de81c809ed41ca07ccbdb7c06b942be2987181ddd2dc75d60dc4a0e356a5db580ab74cd9958a8dd6ad24cb9dbcdeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011188, "uuid": "970d7eff-769a-43eb-bd6d-cc062e4ac8db", "value": "T1AFC31B45FC504B23C6C612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011188, "uuid": "74b4e740-2563-4606-979f-0e14c20b8700", "value": "1536:p3Ka0rG5yC/cMIhygtXOBdWFAcJX4VlgXTAjcFAaUGxrf851WhXVVlnKwywEReQ3:5Kapreh7ROXWFh4UXwcFAa5xovW5kKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011188, "uuid": "364464f3-0fbc-4be2-bca9-65798f86cd1b", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011188, "uuid": "a11138d5-4563-4a84-9460-169bcebbdc2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011188, "uuid": "60cc659d-160d-4316-a193-4a2fdb3b55c8", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdddf1b-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1744024158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024158, "uuid": "026731d3-13f0-4f09-8e7c-30d94f6ffed7", "comment": "Malware payload (XWorm)", "value": "d5f9fe3b16b52755e101b845ee064673", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024158, "uuid": "24c5320b-5206-41cf-bc27-f568cb5135f1", "comment": "Malware payload (XWorm)", "value": "3925c4591a15940ddd40aeb7d7e736bd5f5059bee9926b03036465f6f85325dc", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024158, "uuid": "286a99a4-4a86-499e-a130-1a1c08a63e64", "comment": "Malware payload (XWorm)", "value": "a11fa8436a28bdb789728d3894debf1db03c023a", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024158, "uuid": "589c6dc5-078f-4074-aeae-90296369b462", "comment": "Malware payload (XWorm)", "value": "7ae9e87f51b2d0b44607b615b688da6a345cf572e8c44e661b4fb188d672c224a117fa18e5f3e1cbe0356bcf94c0e27f", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024158, "uuid": "af530782-9e4c-485e-9f6e-6b712e490bdb", "value": "T17463A1313412BDF5627EDC84A21428B5FC55351F57A68E7CBA8388781FB64E08AFD8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024158, "uuid": "24f0d77f-2cb6-4cb0-b215-7a7ca6e4ec37", "value": "768:FwDi6H5262elERh23pVmXCddoULqEJ/nb4crRsILJlLvdcTlR3EISvJuyAJZCq:Fu5P27RyfoUrJ/72cORvSvJu3JZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024158, "uuid": "d3016ba8-8a70-461e-b271-4d88cc10f3a5", "value": 67427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024158, "uuid": "bc24e04a-8d2e-4aa2-a392-27d7b68e1275", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024158, "uuid": "aef372b4-f87e-4764-9bba-598071e0dc67", "value": "83.147.240.230 (8).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057cf4f4-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994639, "uuid": "f235d8e2-9928-4351-8975-0dc9664d0d18", "comment": "Malware payload (Mirai)", "value": "862b1efa7a5470108f48de20ba4d2d5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994639, "uuid": "a7f99be6-c966-436c-9040-e6a0b1526ad9", "comment": "Malware payload (Mirai)", "value": "393f6001987345448e33e0d3a0a82b5497d071466d90460be1760cdec4009690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994639, "uuid": "e8c5b7d6-e8bf-4375-9fc8-a68b91574e57", "comment": "Malware payload (Mirai)", "value": "1527b1d323db3e8f08e42a6d863d5a32e27b2378", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994639, "uuid": "a4916092-fb19-44ea-a642-c641ea67768e", "comment": "Malware payload (Mirai)", "value": "0ce0829f2a503203836e80a7b15cb780de10926643fe12eeed106d483684c3aedb088684647291afc18b169868830a54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994639, "uuid": "443b7271-4fd3-4b3b-b590-ddb947cd300d", "value": "T130632936A9F12D2BC1CC95BF20F38321F6F6534A34B88A2A3CA50D9D7F1865135537A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994639, "uuid": "5bce7d77-aa70-488f-a569-75e153383e55", "value": "768:T203ez8FzQx2gJZI/gPnNg4+NV1wZHlkmxrO+T5VPMBGnK1tRe0yIz:aN+zQxDJZTPnGTH1wksT5MHtRe0y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994639, "uuid": "e67fe0c5-9847-4a06-abbf-e699aa722411", "value": 68520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994639, "uuid": "c739161c-f604-4e98-99d9-0eb37b68cac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994639, "uuid": "31ec7871-5f33-4dc8-a93c-0dcf694afda0", "value": "resgod.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcdb8a4-13c4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744039371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039371, "uuid": "42879d68-1be3-40b0-ac06-8b2ff5ec3c78", "comment": "Malware payload (Prometei)", "value": "f9aa99dc8366ddd805166cc30acdd640", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039371, "uuid": "5b977a5a-1a64-426b-8d8a-e71a3d822855", "comment": "Malware payload (Prometei)", "value": "396efcc6cdc65074344abc5cff352328527d31f3f3d7afec6095e4ac1e5db80e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039371, "uuid": "bc1c8785-ae8d-451d-8c05-2961891b4835", "comment": "Malware payload (Prometei)", "value": "5411fc596e2f4386d7e54808712e465c41328f26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039371, "uuid": "a410b84d-1a3b-422d-9be1-27dec748d95a", "comment": "Malware payload (Prometei)", "value": "daed55f76f588bf95895a5bd1329567681a5a1e216fa9eafd4c46129f527418366169786617725a6738d1864a7de5829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039371, "uuid": "7268bcfc-939a-4c7f-a213-79a5f1a7adc4", "value": "T1C89423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039371, "uuid": "357c67a0-503f-402e-a77e-c10685a51ef2", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgh:25WOSACZSV6eKRH5EPiamb4DsDwwcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744039371, "uuid": "42ada6cf-7139-4a86-b57f-a7ce50dece98", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744039371, "uuid": "d55ebc00-4541-45fd-8f0a-3e764773a7ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039371, "uuid": "70d37bcd-221d-4cc0-b081-74b57dad53fa", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be4ee49-135a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743994033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994033, "uuid": "ffef0ee1-623b-4882-bcab-6eeb70afb05c", "comment": "Malware payload (Prometei)", "value": "4d11d6d0d02f924d1a05d54e23296a4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994033, "uuid": "19e841c1-5b76-4938-9ca0-2b05a98b9dc3", "comment": "Malware payload (Prometei)", "value": "3a23146ae2fdaa116c0a3b2aa6637c25cfeac7a4b2d5dc7ba2f67a1a90e520fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994033, "uuid": "3d9e9230-656c-4dfa-86b9-5768fcc9c705", "comment": "Malware payload (Prometei)", "value": "fbdb40e72f91d12284d7fbc6cf4d85acb7fdabc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994033, "uuid": "c6bb4332-4b6b-4a69-ab97-d86b39700475", "comment": "Malware payload (Prometei)", "value": "11acad86b0fd33f8208f5411d3f12652c65572badd3825dfcea726e409ff6fc24900eb1006db83f700084525bcac5a56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994033, "uuid": "5ecf3681-76e8-461d-83c7-48ccc7c19dde", "value": "T1D79423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994033, "uuid": "ca7609b8-b714-4482-814d-a95830746e28", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgA:25WOSACZSV6eKRH5EPiamb4DsDwwcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994033, "uuid": "d328bf8f-fc29-437a-88a0-0b8c182f651f", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994033, "uuid": "5e018e18-764f-4f6e-b508-4dae0e83d83f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994033, "uuid": "099f8b9a-9d3e-4598-83d3-f0158ff19f4c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300532f3-1398-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744020481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020481, "uuid": "7c63275b-f08f-486e-9a2f-8d31dce5a346", "comment": "Malware payload (Prometei)", "value": "2acaf457c252d686a25f8cc5bf01ac90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020481, "uuid": "16a41c3c-bf81-4ebb-a35f-07a0bccf08ac", "comment": "Malware payload (Prometei)", "value": "3b342df4299760f2d76664b0827954f605b5f8e61a1e799f06ad63278d9e7839", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020481, "uuid": "95809e0c-0a78-44c7-9db3-f38c170e0772", "comment": "Malware payload (Prometei)", "value": "cb9bd4b23c8402b9169cfeadf685568034b667fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020481, "uuid": "0faa6554-ddf8-452a-a7e4-107e9cdc8f03", "comment": "Malware payload (Prometei)", "value": "e281a63d5c6bf1909efc1c15c0912af4025484257904c1700b3c03f054571d1f4aff384d9f8332040fb47e25a8bc7cd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020481, "uuid": "0a1b0b85-d37e-4101-a2f1-32512ea93fb6", "value": "T1489423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020481, "uuid": "b3b98e27-1d86-4fe7-a87a-4620056f8206", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg+:25WOSACZSV6eKRH5EPiamb4DsDwwcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744020481, "uuid": "2facda87-8ab1-4faa-8402-4c137b3b4bba", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744020481, "uuid": "a2fc566d-a037-431a-8702-6f45e967ff18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020481, "uuid": "d954ead3-cc42-43ac-897f-1ceaaa9f50ff", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fe0ca1-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1744024141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024141, "uuid": "3e23f41c-7c03-4ee5-8ecf-2979529c33c8", "comment": "Malware payload (XWorm)", "value": "d5bbb20f091d43d0a67328b0eb6f12f8", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024141, "uuid": "64867ae3-e832-4665-a22c-d982804302b7", "comment": "Malware payload (XWorm)", "value": "3b3583e2486d9736fec5bbb77eb0b7f151a418b525a9283170c5019c0a7ee53a", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024141, "uuid": "6482be31-0f97-45e5-a88f-8c80c651d4e4", "comment": "Malware payload (XWorm)", "value": "8a8dca53de529046a262c1d495c733acf499e6e8", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024141, "uuid": "d170c4af-511d-4903-9f97-efbc3eb7b907", "comment": "Malware payload (XWorm)", "value": "49032af1572e621d0700d83ef7a20125986e73c215a2057b117567d43152d03e071b886deadc5b60905b6035863d3483", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024141, "uuid": "0d5a6a8f-023b-4b01-bda9-7b707d7b2104", "value": "T16B5319313412BDE5627E9C84F11438B5AC55341B57A68E7CFAC248791EB64E0CEFD8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024141, "uuid": "22b10345-c0dc-47fa-bba9-bf3062eb66f0", "value": "768:EDoqHZY2uia/0XxVmX7aTxMU+8J/pnrdoutZZ/DcTx7y2EeKvFCyifzsM:4ZTu1odMU9J/FG0y7ymKvFCnfzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024141, "uuid": "786023f2-4461-4c37-9031-f506de8ce4fa", "value": 64127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024141, "uuid": "0f558154-e903-452a-a5fb-e3efdc8bceee", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024141, "uuid": "593f3d05-4503-476c-9ffe-4e6c802b1d03", "value": "83.147.240.230 (2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245247eb-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744050526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050526, "uuid": "ad293b65-d176-44c4-93cc-7fba1c62de18", "comment": "Malware payload", "value": "c7e7f644b61af90e00dab71b36439bf4", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050526, "uuid": "06643563-0e96-4caa-bfe7-5dd017a71db3", "comment": "Malware payload", "value": "3b7f21a27b39de8fe265aeea1468752a6821253051acc0e6e0d5a48d2983e614", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050526, "uuid": "ca28eb9c-d5bf-49dd-a434-5222cb324b36", "comment": "Malware payload", "value": "1d7a61f1fd05b9c315dd0bd831eefa3444b776a7", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050526, "uuid": "ab5de308-9e4e-4169-9186-c866c646329f", "comment": "Malware payload", "value": "26bc624b5f63e28c6ad8fbdbb47be4eb3961325482b703659ab051688b9105ec46f23d060b9f139d5d16788b603d1795", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050526, "uuid": "66a455f7-e994-4107-b049-74559cd27a94", "value": "T1434523BCBE18DF16D107903185A2D459042BFD96BA0FA60337CDB72D213417666EB8AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050526, "uuid": "3d0d9fad-311e-49e0-8a34-65492915e9d9", "value": "24576:ab6gA1jj+NpBOGv7Amjh3mIYlkaWnBMlssCNnHRQ2/JaU43rH3MRRC:ab6gAV+/BOGjAEhW+aWnBKAnVAUS3MRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050526, "uuid": "aad2a17f-65ef-494f-b567-6a7d22b56df2", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050526, "uuid": "32a482fe-72ed-44e1-b6f9-4c88060e52a0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050526, "uuid": "c2f134c2-832a-4a60-92af-6ec59dae996f", "value": "Payment advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6644d95d-1385-11f0-ad17-42010a9c0004", "comment": "Malware payload (Apos)", "timestamp": 1744012411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012411, "uuid": "047bf01f-c4eb-489b-95d6-2391ced7bcbb", "comment": "Malware payload (Apos)", "value": "c8c64113076101d13ee6dfad4ce1c934", "object_relation": "md5", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012411, "uuid": "66ff668f-3264-4813-814d-e7e2b14eece9", "comment": "Malware payload (Apos)", "value": "3da500d9dc1a24e1c4a55146a1dd85088c07cde5cb684f1ad4238b78b74cd5c1", "object_relation": "sha256", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012411, "uuid": "6f97f677-9eb4-49dd-867d-c94d715e44f3", "comment": "Malware payload (Apos)", "value": "eb7c8c07092e0aa0d3d329d322eca63d0bb7f02e", "object_relation": "sha1", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012411, "uuid": "2619910f-a135-4caf-8813-19850dd7c6d6", "comment": "Malware payload (Apos)", "value": "6f7338e2a69e06f8cd24a045a6dbb7e2e9828e2f85212da15b82a335357f27cc554d9521a015a413b84a03231fbf00d6", "object_relation": "sha3-384", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012411, "uuid": "8426a477-4899-47bb-8462-7870843cbdeb", "value": "T1F8B46E5DF3D6DDF7C501427A444FC36A2228B7B062428B1F7A6D293CE722ED29A95307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012411, "uuid": "854c7978-0e53-4505-a055-a3eff6eb46e0", "value": "25f97eba7b227746192e37f98c864789", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012411, "uuid": "c7185847-24cd-485c-b334-8c8085f10766", "value": "6144:rnjALa6O3K/ogbEPeK3Y98O9Yscj/cDc+agpiHRLGNWizbm2oP:fALlO3YEPeK3Y9o+zGRKkiXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012411, "uuid": "c320419c-c366-45bb-bf6a-0d9647dd3302", "value": 542282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012411, "uuid": "a64cfcc0-1148-4821-b5f2-e09f08a1d8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012411, "uuid": "5260d6ed-1b72-4068-9dcd-63a368dfce2c", "value": "3da500d9dc1a24e1c4a55146a1dd85088c07cde5cb684f1ad4238b78b74cd5c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0e8420-13dd-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744050057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050057, "uuid": "24c4a20d-6aa8-46d4-8a5d-53787c4b3b25", "comment": "Malware payload (LummaStealer)", "value": "49029acbd2a034382cb00156d5baa390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050057, "uuid": "eeab8b7d-2bd6-43f9-a163-51851550beea", "comment": "Malware payload (LummaStealer)", "value": "3def60f7c588480ab999f7f7e7df415eb8ebdd7ec099684b9035ed237e0ae314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050057, "uuid": "fccb004b-2aa9-4ced-8bc6-3f17d46b9bc4", "comment": "Malware payload (LummaStealer)", "value": "ad5097197ad82f36cd88855d0ee646a60c85f36e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050057, "uuid": "4a9d4d67-50da-4fe9-9324-6f2956e1b34d", "comment": "Malware payload (LummaStealer)", "value": "0c1caa7752eaf512a5908f35c0e566333f0e79a1af64ba7c032a52a4185736c4ce5d4ae0567dcb6cfe4247b960ac70b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050057, "uuid": "f2245eba-e336-447d-9595-8069da3cdfc8", "value": "T153A64B35AB1013E5DF435ABE8E07E7D5EE29A5007221246D618F164BEA438EC4373E7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050057, "uuid": "6a14d6ed-b817-4559-99bb-e482826d95c3", "value": "0e43c950e45b23ec428f3cb1662125c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050057, "uuid": "8352d149-0a82-4957-8dfe-c1c6587668c6", "value": "98304:E7q+O3ZDO4OGBNMarnO6BWwZgelSa/MMMMMMMMMzaTGjntnM/XBUMV:E7JO3ZDO4OqMarnO6j5/kgxUMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050057, "uuid": "36d9f697-eaf8-4a6c-8389-40efe5b83a27", "value": 9891555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050057, "uuid": "ab079d69-bfd4-4b84-bdde-5ebea710ce53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050057, "uuid": "0cc1a8ea-aad7-4673-aa2b-9c01f0df7d9e", "value": "49029acbd2a034382cb00156d5baa390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0dcf55-139b-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744021980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021980, "uuid": "ceb1af87-838a-427e-85da-24e986f0a3fd", "comment": "Malware payload", "value": "8cbeb938b79d3950bbecc08b844c01c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021980, "uuid": "41b53b43-0cf2-4fe1-ae26-ebc4756a23f2", "comment": "Malware payload", "value": "415eb06a559679d0a7f2e978472a29446539ee92b4c33cddf00c26f1e0401109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021980, "uuid": "54a4b3af-4c60-4929-82f7-91886e93e48d", "comment": "Malware payload", "value": "101a861dda686878ca78638148f263072b8d358c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021980, "uuid": "6679d80e-1a56-4fd7-8542-72b4422c2e29", "comment": "Malware payload", "value": "895bf05c7b4dc7115ee75796ab888bcef81ba395f9f3170026435c7cab1565f4656538e8b6efea81240a0f738e5f0d9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021980, "uuid": "284d561d-0511-4ae0-8588-bb4660314522", "value": "T10003F2873195AB98F0C06C391CC2FF1376EB52526EACCD6A50B582481C1CEFBE189C8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021980, "uuid": "2588e6ae-07af-4a13-9eb3-2c4d0d5fd61a", "value": "768:AtSpkF/SRCOPVERhAGzL6kAjyZZB8tw5cSNNTDvfM3pHp:A2sm3+RiGXT9ZEtw5ciTD0ZHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021980, "uuid": "a802daeb-ac8c-4a49-aeac-dfccdc333797", "value": 41340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021980, "uuid": "c8ef5236-0f71-4609-80ee-768ba862a898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021980, "uuid": "1cec210b-b9bc-45d8-8309-35cd3e00d7c0", "value": "hanoi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d091ab-13f5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744060574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060574, "uuid": "2f5ba99f-2830-4000-8cde-bd16a1401131", "comment": "Malware payload", "value": "9f9b3884ca71564099eabbf83f000707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060574, "uuid": "4623c1f0-0fbb-4cb1-99f8-9049df795e90", "comment": "Malware payload", "value": "41bd5025d65a7d212bfdefafcc43ef28a1642456a0dec1276a425ac47577f6e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060574, "uuid": "887ab791-b8ad-4bb6-9577-26e7ca33026d", "comment": "Malware payload", "value": "1fb06eedda121b5540cf8b9e425afc0807f2ec26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060574, "uuid": "72d255aa-8c20-4777-aa4e-7c1abe558ceb", "comment": "Malware payload", "value": "b9ab9424a14d04e670aa335c4b04d8715aa7e9008d91b27ff16de0f67a402993162dbce37c10100de6d913a43473decb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060574, "uuid": "1e504a5f-3988-4b23-9259-32e8355addb3", "value": "T19EB429257F958E00D485287ECA7E3A09CB16E0F12502A347370AF7A25D459EEDE2D3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060574, "uuid": "44c9859c-e201-4765-b5a6-c1c8b7e6f83d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060574, "uuid": "d0d28959-9004-4363-84f2-9136a8405bce", "value": "12288:Zj/boCI10jmc9O5oKgt1Jmkjjl94P+Imk0WR:BIyCj58zvjD4Pm6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744060574, "uuid": "9958820c-8c32-4721-b309-67585232c5a5", "value": 519680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744060574, "uuid": "7dd021b7-d2e4-4837-8441-617a43efd759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060574, "uuid": "d6aa95c6-2a9e-4497-a8b9-c2a9692b24b2", "value": "Fatality.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81049f6b-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1744034360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034360, "uuid": "75594a60-42fc-4b03-8cde-9a65f1e10cd4", "comment": "Malware payload (MassLogger)", "value": "deac5a720a61328569caaa104dfa3fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034360, "uuid": "3728b373-d772-4371-8976-b6be353c2ccd", "comment": "Malware payload (MassLogger)", "value": "426a50e79f5b9668b5de1ac553169cbab2e6472ebe9ca6950b5be01454cd04a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034360, "uuid": "8b5ef2c2-b84e-405f-b3dd-335a0a611f32", "comment": "Malware payload (MassLogger)", "value": "cb18cdff95d57801bffd0d1f6883e3fd5a714aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034360, "uuid": "063924b8-0d1c-4e6b-b70f-3b4cf37c0797", "comment": "Malware payload (MassLogger)", "value": "bddfca33406b80e097c1cf9b803c927e9a94b253314be097c8a2f9847f23f57c8468d85dffa95e731f7cd545024bcf94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034360, "uuid": "d087c5e7-e454-4958-9353-fae97c074d7e", "value": "T1E725AE2273DDC360CB669173BF69B7016EBF3C614630B85B2F980D7DA950162162DBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034360, "uuid": "ffd2c360-2cb6-4613-a284-757370612259", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034360, "uuid": "5dec3e18-efd7-4349-b656-a3ffccc01ecb", "value": "24576:0u6J33O0c+JY5UZ+XC0kGso6Fafp2rEubbWY:Ou0c++OCvkGs9Fafkr2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034360, "uuid": "f2ce90ad-56a4-48d5-9336-3bf75629938c", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034360, "uuid": "83423454-0fa7-4659-81c4-fe5b17cd09b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034360, "uuid": "872fef8b-6883-47b1-be25-1e8c4147abd3", "value": "426a50e79f5b9668b5de1ac553169cbab2e6472ebe9ca6950b5be01454cd04a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c412bd-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034415, "uuid": "148d2d6c-ebbf-4935-b6b3-3e0ecc4f4c13", "comment": "Malware payload (Formbook)", "value": "4dec1dc54cf8aa4a518be282a45dacf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034415, "uuid": "a95abffd-52da-49cc-b84c-6c0b39050e21", "comment": "Malware payload (Formbook)", "value": "42a87f8058a1d27b780dc4211820b9d272a25d87b6cb318441f9c00a7f4d9003", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034415, "uuid": "f25db623-a120-404c-bec2-1a2f6540f86f", "comment": "Malware payload (Formbook)", "value": "55d0fb2fe4cbb437bfafd4117a8e582c076bc63a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034415, "uuid": "416fb20d-106c-4e13-96c1-61a2e79c5407", "comment": "Malware payload (Formbook)", "value": "32883b12cd1c05c0d1e4a23eb201f8a9ef226003501ec3ce770fe947e018cbbb6e0afd21f441531472496aaf11954ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034415, "uuid": "e5cf2f2d-ce0a-463b-a667-2126e442b015", "value": "T1B145BE22B3DEC3A0CB679173BF6977012FBB78650630B85B2F881D79AD50161162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034415, "uuid": "f7ece450-0906-49f2-b8ba-91554b0e58a7", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034415, "uuid": "f353cc42-8953-48c7-9805-d6ccd3d5cc49", "value": "24576:ru6J33O0c+JY5UZ+XC0kGso6FasHoOUo8uj5TXtgWY:Fu0c++OCvkGs9FasHofJujLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034415, "uuid": "e6d9dfa8-b0c8-403d-bb5a-4cf77967c869", "value": 1227264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034415, "uuid": "f6b00ae6-5fc1-4710-82f1-a98dcea3c501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034415, "uuid": "cd538789-acee-4ccc-adb0-3203c4977015", "value": "42a87f8058a1d27b780dc4211820b9d272a25d87b6cb318441f9c00a7f4d9003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abc5e1f-13b4-11f0-ad17-42010a9c0004", "comment": "Malware payload (FormBook)", "timestamp": 1744032498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032498, "uuid": "36699dce-3b44-4930-9e22-7d4dabc32a43", "comment": "Malware payload (FormBook)", "value": "97662f0c219b3e2e78e02b69b077baed", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032498, "uuid": "eb1c76a4-6175-4da9-a2b2-297dc40998c7", "comment": "Malware payload (FormBook)", "value": "42fd1e0bfcc150b9dc0114fb854453fb35cf5568d0c2ab36c4556b9e18cc0171", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032498, "uuid": "fa81d07d-10e5-4222-9ec5-585e5108d78c", "comment": "Malware payload (FormBook)", "value": "16596bcdc9835f51ce1b4a3c3c636c92409fdaf7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032498, "uuid": "b008b618-577f-4a19-accf-cfeafe06a22e", "comment": "Malware payload (FormBook)", "value": "b48a9242f8eb74d15aff966ff3d736e4a0f956f80162396b7e7ba2fa8d8e43741031ae56dcefbbdb6c6ca6f21b15b770", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032498, "uuid": "c227553f-87c9-4507-af53-3242ae2a351e", "value": "T1B565B05C94F09C912428FF74AB96F7C788E913962B2B0B820FD591963352843FEA7375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032498, "uuid": "88850584-3832-48b3-8c0f-d8fa782acaae", "value": "12288:gVRfR4QN5I35QzulCq4sfLiMlNJaeK4G4aIkuQvCtbEmdR7aoZdpnmpj6Mr/XRpd:0RnM3eIg5C91Z1DJm4MrBIKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744032498, "uuid": "96b75916-e05a-48d5-bdcc-d63349f8d6f0", "value": 1410664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744032498, "uuid": "5332670a-ea98-42e6-b46f-a9615e40393b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032498, "uuid": "a13d92a7-6570-46bf-ad5d-05239ae67dd1", "value": "Client.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93006d8-1381-11f0-ad17-42010a9c0004", "comment": "Malware payload (MeduzaStealer)", "timestamp": 1744010940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010940, "uuid": "13b89dff-559b-4874-8da8-7db8f53a11be", "comment": "Malware payload (MeduzaStealer)", "value": "7a8d25a46fa8193b0b5b739aa0feddd3", "object_relation": "md5", "Tag": [ { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010940, "uuid": "7834c770-396e-4fed-8f51-68e147ebb337", "comment": "Malware payload (MeduzaStealer)", "value": "43005ec8d3e9f12c53ab28bcc79925ec6070525d15f38bf7a18c3d481b673c19", "object_relation": "sha256", "Tag": [ { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010940, "uuid": "391f4d9a-24d8-4554-b0c3-e49f11b0f9c6", "comment": "Malware payload (MeduzaStealer)", "value": "684b854047b6c0ca1b830f9a246b3593dabf26d5", "object_relation": "sha1", "Tag": [ { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010940, "uuid": "2e1d2540-aa7b-4656-ac5a-4cd04ed76af3", "comment": "Malware payload (MeduzaStealer)", "value": "9c53eab98a9de18e7f315c8febb1fc0fc2ad370077f327d300e963d1c0fabf685e3ce511545191f121c520d0e40131a9", "object_relation": "sha3-384", "Tag": [ { "name": "MeduzaStealer", "colour": "#7E134C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010940, "uuid": "eb60817e-8f67-46ba-89aa-4c18d4a6d97e", "value": "T12D5733B07C7CECD5A179279B29625612CEAF36CED0C45B9FBA37462035202B326FC459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010940, "uuid": "2000371f-0a25-4f2a-a53e-6c8e49a58c98", "value": "786432:Cc1MP8JsRCQFiEa0X+eFsE/dE/12/YIs3ZPbKuwXavxOY:CcrQAEaBE1Q2/W2uUa5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744010940, "uuid": "1797da3c-b338-4080-99eb-6d4be6e4c781", "value": 27178100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744010940, "uuid": "2fb67db1-556d-42d8-95b0-c6827eee9ab7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010940, "uuid": "5414eede-e0be-4dfb-bb6e-2b4413b932be", "value": "bot auk.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc441f2-139b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744021977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021977, "uuid": "55176d1f-7ee1-4a92-9c8d-c995048c3cb3", "comment": "Malware payload (Prometei)", "value": "a7a574da8eb102f1f3e485faced7e701", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021977, "uuid": "668565de-b449-4228-b888-bd82e59068fe", "comment": "Malware payload (Prometei)", "value": "4319f6a7996f3890655412f79439e791fd3224ad0d1809084bb2bd0ec677f5db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021977, "uuid": "24d53f6a-542c-4c31-8777-49ec11e5dad9", "comment": "Malware payload (Prometei)", "value": "77c8acc2cb54daef19312011025f9ca75f035196", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021977, "uuid": "af212561-42bc-4f64-88ff-542a747a3afc", "comment": "Malware payload (Prometei)", "value": "940a61812ac779cbf9d9a095d23adee6e569ae1f539c765e681bef2d1b77f04e5e79072fb4b0da19c2cc6875013c9809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021977, "uuid": "e17dd41f-9aaf-45a9-8ac7-46749bac6f8f", "value": "T165155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021977, "uuid": "37d17dc4-0f80-4438-82d9-9226b6040a45", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplU:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021977, "uuid": "e8c2dc44-4117-44ac-a06a-505ef67e1658", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021977, "uuid": "d9d09b34-d9e6-4c48-96e9-bf15c523e318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021977, "uuid": "fd50cd2c-2b04-4407-9640-95225b87f683", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36218989-13c5-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744039818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039818, "uuid": "86cc6724-cd9c-4f33-abd9-adc112ee059d", "comment": "Malware payload (SnakeKeylogger)", "value": "68401d77e500ccf9c2f2f2b5ac21294f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039818, "uuid": "8fc4c603-6883-48b6-99ff-368f645da123", "comment": "Malware payload (SnakeKeylogger)", "value": "43bce43841c666b306956a85716c764e822dabcf1fda317527fb262494d6cf30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039818, "uuid": "54f81bcf-06bd-47d0-9fcb-1c0526d81aed", "comment": "Malware payload (SnakeKeylogger)", "value": "5862bd3b74201c28c7b09ff9a4d2bf22e099fd40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039818, "uuid": "b218f11a-d178-4649-9732-675dff81cdeb", "comment": "Malware payload (SnakeKeylogger)", "value": "0b673a990a4775e88346cf07cf0e671673370e713ef9b71a57a0f1dc6413dd1c7352fd5eb52223b57902df7a81c7510b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039818, "uuid": "9f0575da-c8f5-4766-827a-cb621a34a0ed", "value": "T1F945D021F5C69075C2B327B15D7EF76596396E2A0326D19B33C83E366FB01422B29723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039818, "uuid": "f761836a-d70f-4f18-a753-664b94551be5", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039818, "uuid": "c9c411d4-964e-4ab8-a2d1-468088e95f18", "value": "24576:pRmJkcoQricOIQxiZY1iaajZilGKDiSOhSgBr3apT//wQFs:mJZoQrbTFZY1iai1dSASgdaGEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744039818, "uuid": "e7964c30-729d-4347-a6cb-4f78d0fdeea1", "value": 1249323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744039818, "uuid": "224273c9-6797-4af0-8f11-da421dc2ebc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039818, "uuid": "66cf5a8e-a422-4c28-84b9-079b63f49b68", "value": "rPONo_25000284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31e8b56-1386-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744012996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012996, "uuid": "737d76a7-42e5-4ed4-8e08-e9dbc6cb7b75", "comment": "Malware payload (Mirai)", "value": "dab977fe42ed8a3050fad1fcba29fa2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012996, "uuid": "a34336a2-fc08-44d7-82b8-9953a7d60755", "comment": "Malware payload (Mirai)", "value": "44694b336d50355f501f62edf1eaa53a7a32714419c5eba6d382a7446f33e101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012996, "uuid": "27cdafe0-5ba0-472f-b659-89e44932226a", "comment": "Malware payload (Mirai)", "value": "f56b9d7fe95ba570acc7c36012e04634dcdf0169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012996, "uuid": "a66b32b5-3895-48e3-8238-79e85280fe6e", "comment": "Malware payload (Mirai)", "value": "36bcc79d1a819fd684ea9a0ccc42875209775a1575946e73b85972defad22efd5dc8a1cfff671416dfa8929503836acd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012996, "uuid": "136a4f41-3fd9-4f1f-b5ce-97607cb90259", "value": "T11904881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012996, "uuid": "54d4b95e-3574-4d9e-9497-248c3006b13b", "value": "3072:jg57FM7LHZwbq1YSBan1yvbysxr1uGSGI:jglFM7LHZ0Bqyy1BSGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012996, "uuid": "bd8d76eb-7be1-4dd8-9b7a-d5c08862f104", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012996, "uuid": "fcf7f2ae-18d0-4765-bad1-c85f9d02f40d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012996, "uuid": "de734eb9-6044-46e1-845b-594dc418d575", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997a2dfe-13c0-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744037837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037837, "uuid": "90339be1-cdaa-4b4a-ab03-d7a0669cbfea", "comment": "Malware payload (LummaStealer)", "value": "16875d9525beba91fdf0871c0e4dc6fa", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6623", "colour": "#AEF881", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037837, "uuid": "fdac3b45-de04-41e4-8548-b6d9912af3b2", "comment": "Malware payload (LummaStealer)", "value": "45b25a18aaf73ffcd6da0e79323e5dbac6962be5388e04e5174407f343dbc420", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6623", "colour": "#AEF881", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037837, "uuid": "e761922f-96fc-40e4-b50b-078e64a9a40d", "comment": "Malware payload (LummaStealer)", "value": "deaddc77d3383f77c5c333238618f02f16e31f49", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6623", "colour": "#AEF881", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037837, "uuid": "0273b251-b89e-4516-990a-0425d5633dba", "comment": "Malware payload (LummaStealer)", "value": "44d81feb56c490bea569df1b5f489faa3ecb33e60ef00d21f8f78b3d196765c34751a9289541efd0ff5ae07bb74145d0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6623", "colour": "#AEF881", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037837, "uuid": "7991bcb7-e0cc-4d08-832d-2f51bd59ca58", "value": "T1BFA533C00AE55DD1125233606E0FC7F83B998BB2FD6E28D634126C67E7CBED4A51748A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037837, "uuid": "a9a25a4a-bfcc-40d2-8d88-f8292fdbf1ed", "value": "49152:EmNK8URiqDgJTSA846TkIaPDeay9adlznrGlVIBLokHAsgkbeqZc2Lf:P48q3gJTSK6kDFy9adxrGfkokg+Zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744037837, "uuid": "968fa89c-d1b1-484d-8b03-660ae6022d67", "value": 2123219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744037837, "uuid": "fca66aa9-eab8-4313-8309-9060cc19cb51", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037837, "uuid": "204ad368-9a70-4be5-8803-cf2931544c70", "value": "#\ud835\udcdf\ud835\udcea$$\ud835\udcd2\u014c\ud835\udd3b\ud835\udcee-__\ud835\udcde\ud835\udcf9\ud835\udceec\ud835\udcdd_\ud835\udce2\ud835\udcee\ud835\udcfd\ud835\udcfe\ud835\udcf9$4fre!!1New\ud835\udcdf\ud835\udcd2.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af485484-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1744024130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024130, "uuid": "f9e92663-91c7-4641-a7a2-b3a6523bb9ea", "comment": "Malware payload (XWorm)", "value": "fda9fb255d3b2b28f5af4ade688ed8c3", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024130, "uuid": "768e6921-d93c-4a2d-98f6-38becf806aba", "comment": "Malware payload (XWorm)", "value": "45ca3d764f32490b6621016d41a578a9d0670ad2e4c5dcc2b04ba7f70473ede5", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024130, "uuid": "dd8f7dc9-cd74-45e3-ac05-e789e8146e55", "comment": "Malware payload (XWorm)", "value": "fd98ce7ce31899bcf9faf65cacde2e4301fe3347", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024130, "uuid": "30a3426d-0de7-4167-bebe-5ce95839170e", "comment": "Malware payload (XWorm)", "value": "01f3d6ade6baafb855d2bf04de9a5d5006d220aa148b6bca8e59702e64697b9ed328176abd722037cf985cd8ecd53ac6", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024130, "uuid": "9ac5b05f-4690-4822-8e76-3f80d0b2a02c", "value": "T1B6B3C6863B3CF4764EB85F1D2AA38C8EA1C4604F5D84697D740ACA7F1A729C909ED0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024130, "uuid": "1a1da3f9-1da4-4677-8924-8894194dbc83", "value": "1536:98ANcSFb5qDSfwRQ+q4FuV6+u/yYB4i5Wxf0fgQi0+w+WLM69vLp5yvUYy3h37Vd:RzpFjn4uwN9T3yMXIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024130, "uuid": "ee0aab24-528c-4e3a-b073-584ca9e28b17", "value": 114162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024130, "uuid": "b4cad8bb-a0f5-475a-a603-6396e0c5b66f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024130, "uuid": "eaca2f45-0a0b-4e00-a7d9-732b6729fce5", "value": "83.147.240.230 (4).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad42c2f5-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (PureCrypter)", "timestamp": 1744034435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034435, "uuid": "693a37ee-81c1-4af4-8678-aa17c35023be", "comment": "Malware payload (PureCrypter)", "value": "386b9a58bb569af2dccc21c1da4e847e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034435, "uuid": "eb645c49-6952-438c-83ba-ec5a06ec3941", "comment": "Malware payload (PureCrypter)", "value": "460450473f12847e281e5af300a74fe7c184cca52d375aba36b4669ebc3607a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034435, "uuid": "a2f323eb-7528-450e-8830-68e64577a601", "comment": "Malware payload (PureCrypter)", "value": "6797eda382c708b190c892be2a37bfec2d7c0c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034435, "uuid": "a2162e33-7683-4771-a736-9d8c92920c1d", "comment": "Malware payload (PureCrypter)", "value": "32ecbdce4d065d03e67f939de107000cd5ac15065776f6b548bfc8b108e1c6f436745f06ee4b26f23772b5161cb5f4bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034435, "uuid": "db7efc9c-ef45-4f7d-ad88-291677181065", "value": "T16FA3D517BB8AC6A1CA115B7FFD9A450013A8E282F657C71F384A372E4C477BB9841B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034435, "uuid": "5d323083-4ad1-437f-902a-1f3d4ef1b788", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034435, "uuid": "c25c2dfe-b700-418b-bdb7-dc1fb103662e", "value": "1536:MJrkVvD4vE8lukQZ5Zqa125S8w74pzTFCWI5fFCHnen7Fumas0nhSDfS7Fah:EqDRh8pzJCWysen7FX0hSDfS7Fah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034435, "uuid": "21a4883c-1c88-4272-9828-40acff84f866", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034435, "uuid": "d88ceb6e-4d22-49af-8071-6dad9c0f4b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034435, "uuid": "9eed6f1d-6463-4c63-a985-82d4c43aa7db", "value": "460450473f12847e281e5af300a74fe7c184cca52d375aba36b4669ebc3607a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ef543e-13b6-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1744033436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033436, "uuid": "3d2fb5c5-22af-4e1e-98d3-dc836bfb7f26", "comment": "Malware payload (MassLogger)", "value": "cb79efac6264c29a0d0e749931396e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033436, "uuid": "75d3cf24-780f-4a97-bad3-7945432d9a2c", "comment": "Malware payload (MassLogger)", "value": "46dbe32e4885b393b91c546de4c7cb915b6a73d56cf0a1b6e0c2b4335d3a05fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033436, "uuid": "cf348314-cad1-4ac9-bdec-ff876ff48005", "comment": "Malware payload (MassLogger)", "value": "44c683db5d91d16331daebdf446238b8239086ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033436, "uuid": "7f4a5d04-b7ac-4cd7-9cd7-40bccef35642", "comment": "Malware payload (MassLogger)", "value": "6f860a2908a6ac0b4755223495c3629fbefaf8d4741618a790bb33d7d590af72e035700eb6b8d489472c1c24eb2229e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033436, "uuid": "dfb401f7-ae6f-4061-8542-5076ee16cbc5", "value": "T1B6C4F15433A9D902D9D243B66C61D3F9163C5ECEB822D3138FEEACEBBD3575224442A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033436, "uuid": "24deb437-1870-48ed-8bb3-77a606861ac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033436, "uuid": "d38941da-3bea-4395-97e5-9928afc68851", "value": "12288:GYqBCCwf4LVxUObmI6KQ3R4myVT3fII/oLsQ3SNi:3fA7UOPE8J/owcSNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744033436, "uuid": "7cdd83a1-5e0a-416f-8cf7-ed3c159c0b97", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744033436, "uuid": "3513ca05-1a4a-435f-967e-e03f96baf56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033436, "uuid": "fd250326-5f4b-4920-ba5a-55b6c582b575", "value": "apH0BwycrBb9tee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57df48cc-137a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744007662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007662, "uuid": "43e336bd-cd5c-4081-8307-59f412d883da", "comment": "Malware payload (Formbook)", "value": "a74809e7d2d6f6e2a6e01b0c0a024d9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007662, "uuid": "1d803273-ba2e-41ae-9c50-6bfa9c89f792", "comment": "Malware payload (Formbook)", "value": "46ebafde18dcfacd01abfc5ae6ecd6a5b3a80d19ac659585635b744262077a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007662, "uuid": "d860f15f-69e6-4855-8ff0-87e0ac07b20e", "comment": "Malware payload (Formbook)", "value": "fc7e1361e88e70a730a254c8a9794968b64bfbb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007662, "uuid": "27b39f81-eb31-4892-9541-77869b5e0f89", "comment": "Malware payload (Formbook)", "value": "23efe0a212843bd76283e1857b684b50e90a8fc0234a1fd0e17a33d4b7d2ab5d04523164c8acb36fb356c30211ddf5d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007662, "uuid": "d772a41b-9c45-44cd-919f-bdbe600f53de", "value": "T139542310E6227C0FC92DBC7006C70EC5BAC2AEFB5D4616A1EA55F0C7ECB91B9650784B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007662, "uuid": "3fd448f9-f12a-4fa5-8a29-c3649138242e", "value": "6144:6U2vr7riDFG1kaMAdJGuRzJDOo000I5NURMYHJt29nPr3QcaE:WvHGDoztdDT0zI5NSFqPT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744007662, "uuid": "b22f4359-e018-4d39-a1b0-b38e6908f43a", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744007662, "uuid": "44c15c75-0564-4e9e-84a4-b2d03fe3a10b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007662, "uuid": "bc2fc26a-7156-41f8-9114-b4ef13c85071", "value": "Biomedica Order040725.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41308671-136c-11f0-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1744001611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744001611, "uuid": "0deb52dd-8ea3-4694-a54c-eb43400b1485", "comment": "Malware payload (RedLineStealer)", "value": "f206d7ff566d76b89717e97df804dc70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744001611, "uuid": "17e10beb-0c81-4c08-bd3c-4a884f4e42ba", "comment": "Malware payload (RedLineStealer)", "value": "4730b48f2b7ebfc6041022b947cd3ecc9dc61fa3c82dc7a368e787b61ac3d24d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744001611, "uuid": "9de8b905-a3f2-4587-b3c3-4716de45f0e4", "comment": "Malware payload (RedLineStealer)", "value": "ff0a58ed8d698bdda82fded8c7d8038993e519d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744001611, "uuid": "7b63ecad-f333-4036-9dbd-1cef2901ef9e", "comment": "Malware payload (RedLineStealer)", "value": "c462dd40180c1eff2695114b50ee96319c348758db4a6103a0b1b54047beb0f248e54def8592f0bacdfc002aab5e87b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744001611, "uuid": "00ad84a6-327e-4c56-b212-db6e770bba7b", "value": "T19445CF2273DDC360CB669173BF29B7016EBF7C654630B95B2F880D7DA960162162C7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744001611, "uuid": "adaed100-ae88-489a-a1fc-45625af483bf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744001611, "uuid": "4929cab1-4da6-4ee2-b253-c489c6f37f5f", "value": "24576:Zu6J33O0c+JY5UZ+XC0kGso6FanFLD2cfo13qxWY:bu0c++OCvkGs9FanhD2SArY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744001611, "uuid": "23bd1e7e-1f75-4fde-9e7c-e7832fed09bf", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744001611, "uuid": "61f19cad-e5e9-4d37-93fa-0a1655d5cf89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744001611, "uuid": "7b9cbd8d-b38c-4e8c-bebd-392b1f1c9a71", "value": "AGENCY APPOINTMENT - 07.04.2025.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f92ad5e-1367-11f0-ad17-42010a9c0004", "comment": "Malware payload (TrickBot)", "timestamp": 1743999595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999595, "uuid": "e3058fbe-e1db-40da-a346-3ae49e94e561", "comment": "Malware payload (TrickBot)", "value": "d8e816c76ab1b9bc76e73b1aa0f88f2d", "object_relation": "md5", "Tag": [ { "name": "bad", "colour": "#07DE1F", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999595, "uuid": "11516d9d-9c8d-4627-80f3-aed0e096d62d", "comment": "Malware payload (TrickBot)", "value": "487f4dd9bdbe94a9cf1a04a8fdec19f16f86864d05d06f0511544b3ff68c850c", "object_relation": "sha256", "Tag": [ { "name": "bad", "colour": "#07DE1F", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999595, "uuid": "04159442-596c-4994-b4a0-60cec63c1bd7", "comment": "Malware payload (TrickBot)", "value": "da193bad12f1b79f8c938d62e8029ba948433859", "object_relation": "sha1", "Tag": [ { "name": "bad", "colour": "#07DE1F", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999595, "uuid": "9ea3f277-37a2-4a55-b6d2-65826b6f2736", "comment": "Malware payload (TrickBot)", "value": "4ad6b325e7e2420b324f52ee4ac1b4be563a94557d5716bceb668f367c720b0bf95d2ca34611836d277618de9b598306", "object_relation": "sha3-384", "Tag": [ { "name": "bad", "colour": "#07DE1F", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999595, "uuid": "55e29b6f-af3e-46f7-8984-85444fda534d", "value": "T12B17339590E4E71AC422E5A3E4F5E7C94FB461B988344CCA6DB45FE3A0A30FC3BD6419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999595, "uuid": "a9f4868b-f6da-4283-a5d1-8df3bf5dbe77", "value": "393216:ThCblxXJLB2mW/RxHedw0OZnq0NyWl9Hh9H2KAm4zI:ThSDZLI5xHea9Zf5XHD4zI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743999595, "uuid": "57f5034e-caa9-4ea6-a856-1f24b9415c14", "value": 19987747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743999595, "uuid": "ebaccbf8-3008-4143-b6a3-1b251115d95c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999595, "uuid": "84b6449e-a07c-4fd4-bc01-5d01b1ada693", "value": "malware_samples.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf149fa-13c8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744041172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041172, "uuid": "d6abbd81-052f-4937-a314-a08b7284c05c", "comment": "Malware payload (Prometei)", "value": "9a31620ad115c90f35fee05a3056643c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041172, "uuid": "604c70ea-42e6-42fc-a326-950dff35f6cc", "comment": "Malware payload (Prometei)", "value": "48a69d108cd961515157129b6701f72492c6bf6f606358fae2a66e76bb8dbe3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041172, "uuid": "a7a132b8-8625-4072-bc13-9bbe83de4489", "comment": "Malware payload (Prometei)", "value": "96260a0549778250e233ec39c4a45b6c5e6e1097", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041172, "uuid": "713b7aa8-33d6-4766-b30d-c88855227190", "comment": "Malware payload (Prometei)", "value": "5a187f8aec173011b4ae3487f2c75f3299e777253df49fb7c1712eba4bd6b466d90f7a107273e2e451df94f10ede309f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041172, "uuid": "364328d2-a9ce-4f40-8165-0ec4e791fc2f", "value": "T1979423F8C83D2E30D8169B3CBB5A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041172, "uuid": "d7312f07-83e7-4016-9e89-4ddc13e0ca58", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgW:25WOSACZSV6eKRH5EPiamb4DsDwwcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744041172, "uuid": "6ce8f8ed-8dff-42a6-830a-295dbae61c34", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744041172, "uuid": "07ddd3a3-dc91-46e2-aa2f-43dfeeaf4b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041172, "uuid": "d0cb8ac1-7642-4ca0-a8b0-f85ea9a9928d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80fcd43-134b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743987745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987745, "uuid": "13084484-42e3-4647-a7a8-2bdcbc8e66c1", "comment": "Malware payload (Mirai)", "value": "89ca0b70b1d7dbd72502e4057fff62b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987745, "uuid": "3a33e731-bd3c-4ebd-ab8f-142e12b2a995", "comment": "Malware payload (Mirai)", "value": "48e12a5d75f9c85ea741a3a01ea26fa69f436b387c8d1cdfcaf15ca6a1a19606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987745, "uuid": "e20a3d38-0aa3-4e55-b3af-2761191602e2", "comment": "Malware payload (Mirai)", "value": "4200a6d98bf242e8831e46a0649925143dc19425", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987745, "uuid": "e07a9d81-5179-4491-87f2-97080e9d9198", "comment": "Malware payload (Mirai)", "value": "ac4c7ab4c92257f2f583b0dcf5744431a8532f1a1aa68b68900aabd15b31be65b0113df506a18d3d57b6fb850bffacb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987745, "uuid": "f9a2b41e-3d93-4c13-8c1d-ce969909b336", "value": "T12F4302D9130A163DECCB80B902840B356ED11BD49A03699BA7CC2467F7BE9597A673C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987745, "uuid": "b41e4a97-cd90-4ceb-aa45-cc1fe3d04793", "value": "1536:N8TzM4m51WTQ/uqJ1J483TNrwXuex9xcX/zVJuk:i+51W8PFZwXB9xEzVQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743987745, "uuid": "6faa3242-d0f2-41eb-ae4e-adbfab09b3a8", "value": 59784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743987745, "uuid": "aa7ef7ca-be03-41b5-ac27-17d38cdd4979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987745, "uuid": "56673c13-85b6-401c-b950-1aa906c3bc68", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f26ae8b-1362-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743997340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997340, "uuid": "07df45e5-83d0-4b09-acef-b0b9f1785364", "comment": "Malware payload (Prometei)", "value": "4a47dcd81d8b18ae2e7ef73619997b68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997340, "uuid": "a25aeb00-3fc0-4b37-acc4-16e257f1f4a3", "comment": "Malware payload (Prometei)", "value": "49083c677f4264b48f39739622b16e773b51f9a80ecea57b073a50db58b9b264", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997340, "uuid": "9c1494b5-fd1f-41aa-9c7c-1aae2af5317f", "comment": "Malware payload (Prometei)", "value": "cf793387b731390c85c3181554b8b6f2f77b772b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997340, "uuid": "f4928c21-ba76-4b67-b752-393578da7463", "comment": "Malware payload (Prometei)", "value": "39b9787261d109ce05b422ca651b73de46d8fbff8f761fe5801b4e24894489b14bd383d34d3ad4fd71bcf3ffef9be515", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997340, "uuid": "a0baf79e-7f2e-45bc-8906-4c8aa888e857", "value": "T1A89423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997340, "uuid": "063f4a8b-3401-4318-9dc4-8d2a45a4cd21", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgz:25WOSACZSV6eKRH5EPiamb4DsDwwcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743997340, "uuid": "02c12132-8c51-4653-acf6-6b8ee71aeba4", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743997340, "uuid": "51da00e7-7f02-4c69-b5db-2d039fe1f538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997340, "uuid": "ce72d337-c799-42b8-8fdf-4d18ad495ae6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0783a0-13b3-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1744032040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032040, "uuid": "aa28a420-b173-446a-96ed-43a59ec70792", "comment": "Malware payload (MassLogger)", "value": "327af0286a2d76c249f2f35d840c9dc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032040, "uuid": "43960b87-fa43-46d6-9dc1-acc8d8493e5e", "comment": "Malware payload (MassLogger)", "value": "490cc57557d9617b7da8acc7453f39a6250d7939730d9fe99409b8f8603769ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032040, "uuid": "cc565c30-4cac-4275-ba00-3e0fbec98df7", "comment": "Malware payload (MassLogger)", "value": "45a29afe36707e8470e4907399d265b892d9d18c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744032040, "uuid": "d6b874e3-d815-4cee-afe2-ed2f1e7f774c", "comment": "Malware payload (MassLogger)", "value": "21763bcd996b13e6f274cf6190b3d46d7b22aa1d1411c6f192573d64453e24739c09b5be0d32f7a226093c7347d09b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032040, "uuid": "5f9c1751-a86f-4446-88a2-3c2549e1312f", "value": "T17F25AD2273DEC361CB669173BF69B7016EBF3C210630B95B2F980D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032040, "uuid": "2fc28ade-62b8-4225-975a-6b1a0f1a1a26", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032040, "uuid": "47216c14-15eb-47ae-814d-66d47a50283b", "value": "24576:Eu6J33O0c+JY5UZ+XC0kGso6Fats1V0y2LEvoWY:+u0c++OCvkGs9Fats1VpVzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744032040, "uuid": "c798c12d-f266-4c03-b390-d9a98b893442", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744032040, "uuid": "e0b3437c-aeee-412f-bf4c-784fb32cfbdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744032040, "uuid": "b0ce6ec5-0334-4107-a85a-16db70cb4b13", "value": "Air Waybill no 6979374150.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0997108-137d-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744009207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009207, "uuid": "04a79760-7057-4a2a-b7c3-3be64daa6e38", "comment": "Malware payload", "value": "fa232a6aaa2362233d9c8a296d1bbfff", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009207, "uuid": "e0389523-4ca2-4fcf-9083-e722138c2f85", "comment": "Malware payload", "value": "49dbd22affff8a7f6c9c6b4a283dc6bffdc7c4109f0de5b5df198dd6e71f6c63", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009207, "uuid": "8669b99a-4c62-4e7f-83e3-c014bab907ed", "comment": "Malware payload", "value": "d54ab638c010870a7d45276cb92595d5fbe32baf", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009207, "uuid": "526700c7-d1d5-40ea-8b72-a29710f5085c", "comment": "Malware payload", "value": "62399d1415c45ec052abdf89446388d96b8b47abf7a06cf48daf13743a66d8792ca326f1affa5ed7555e78eff27eee4e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009207, "uuid": "37cbbea7-fa01-4da7-bfcd-d2ff8c98ddf7", "value": "T17865F1A4332CD807C57642F95860D3B403B56EAD7621E3C6AEDEBCCB39E5F841A40697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009207, "uuid": "f7d1ca25-3082-486e-a045-40faf10f0809", "value": "12288:cYHKYqBCCwfCSMya0vfVn2nM3Z61Ed/ZFljY2DzskmGJkmecun2LgfjQjlvZYxC5:vf6Vya0HV2w0q/RM+z3mWkxco2LgBEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744009207, "uuid": "c84ee6f5-ef0b-4e42-87f5-6d233ce403dc", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744009207, "uuid": "c1e23853-cdf7-43e3-9f9c-ffb82ff28835", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009207, "uuid": "d493e374-ba71-42ff-8e7f-bcaf45348110", "value": "nSwiftsend04072025-pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1416d4b9-13fc-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744063383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063383, "uuid": "5bdb96a9-fa0c-4371-9419-fcdd31098079", "comment": "Malware payload (Prometei)", "value": "50c74016d8d5af13f71b7873bb779054", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063383, "uuid": "46f4a3f5-1741-47f7-a450-cd8376b65e92", "comment": "Malware payload (Prometei)", "value": "4a428fb05cd2c9d9a8196cedd91cdad191a577ae2bcd68d6e898593d93834e5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063383, "uuid": "09ce7b23-14ca-46ce-b9d7-8e1074a30466", "comment": "Malware payload (Prometei)", "value": "2dddf32c584191e22dfbb8db44f35286c07ee4b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063383, "uuid": "e7a22acc-e9cf-468a-9dee-a3f5250978b4", "comment": "Malware payload (Prometei)", "value": "d186e94de7cc89faf14ffd390d0626c3af8c136534ea97085f1483822b8891936c384b9ba32fa7bf17dbb74c732e68d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063383, "uuid": "c9518c5c-2d3c-4bca-a062-cd150078189f", "value": "T14C155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063383, "uuid": "9770a09a-aba3-410c-8687-ca15defb5a13", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplm:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744063383, "uuid": "295eec20-a3f8-4b21-bce9-5f21ca289a31", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744063383, "uuid": "1f343e79-9e97-42fd-bc5d-797323062f81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063383, "uuid": "b36e0f23-8141-4752-95e6-d15943ecfa08", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4c05dd-13b1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Koadic)", "timestamp": 1744031564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031564, "uuid": "44aa139a-aab5-465d-a086-0aba5487b2af", "comment": "Malware payload (Koadic)", "value": "43fdb37c093f67231ae16f0cc69576c9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031564, "uuid": "86113b54-135c-46b4-9fc8-107575fea912", "comment": "Malware payload (Koadic)", "value": "4a43dd566dc5054ba6e7dc93dc70e02b4479f8ec5464605223ada47ff87720fc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031564, "uuid": "807c520a-f19b-4539-8867-3e319729d483", "comment": "Malware payload (Koadic)", "value": "df807d39f393a0db071c698c18857d8c4a23b713", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031564, "uuid": "9c583b74-e084-4cd7-816a-49e5970437df", "comment": "Malware payload (Koadic)", "value": "3e0606245a2543a4897fca7d0e3dcc1c385726f5ebd650e03aed521f9fd00cad9a2a6761229b250b0ec851c80de3d985", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031564, "uuid": "61107156-12d9-455a-9885-ecea043ada68", "value": "T16F1332321EE38ACE7108841A9342F5273E4FECBEB82634BF840D7D5748D534B966A756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031564, "uuid": "900fb62b-cba6-4bc0-841a-7bec74bbe2f6", "value": "384:Fmg1sHhExho55+p2fuBPU1plQPUrBRTWVabtyE9/dVz/004L+PpDWpeBYGzPlDlM:tGmGYgZWKcM6A8pdmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031564, "uuid": "5ff3a312-a174-4191-9270-ecf53edcac57", "value": 42791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031564, "uuid": "4c30377d-55c7-4b06-9db4-1fe8ddd10492", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031564, "uuid": "df9b3bc7-fa09-4739-9167-fadd7968c3dd", "value": "klm.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd4d183-13dd-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744050246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050246, "uuid": "f32c7e87-8065-4f57-a822-22630b261c49", "comment": "Malware payload", "value": "71de53c2f421e88ed5d83c057e7c17c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050246, "uuid": "52a8191f-c19c-4baa-a999-c05b046185c3", "comment": "Malware payload", "value": "4ab7461880ae803d92288a860a5307e532da2249399e575b9bc651662a0bc80d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050246, "uuid": "fca7531a-4672-4bab-80c8-dd231cd1eadc", "comment": "Malware payload", "value": "84c11e713a7beb5dd3294335898af0227b9f56ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050246, "uuid": "31cd53a8-83e8-479b-8071-86fae2b5b452", "comment": "Malware payload", "value": "bee5b402da110088feb316c17fe2647992a3076b7c28b89c0e54e5f7e71ade9f197dee9dd0802725ce076192110b85bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050246, "uuid": "76aff076-dbbf-4758-96ff-35f348c38bac", "value": "T1CB85BE23F3CBE43EE05D1B3305B2A05894F76A616923BE5686ECB4ACCF751501E3E646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050246, "uuid": "42669ca4-563d-4473-b5b7-3519329bc19e", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050246, "uuid": "21ec4f91-a220-40ff-95ec-dcc9a07960b0", "value": "24576:gawwKusHwEwS2EGqK2zO6I6h6gEGe/NIsWvMyCShxGE:wwREDg3Shv2NuMsGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050246, "uuid": "318020de-5139-45d7-833b-8ae44bfc5518", "value": 1727069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050246, "uuid": "0c263ca5-3c31-4257-96d1-79e3e9607b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050246, "uuid": "8f7d9ba8-e42c-41a0-b52c-cca2eb269356", "value": "71de53c2f421e88ed5d83c057e7c17c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0549e3e2-1360-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1743996357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996357, "uuid": "8756694a-158c-477b-8388-75a6023e1cbd", "comment": "Malware payload (MassLogger)", "value": "e9f9b3542e0a5c105a2828fbede30785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996357, "uuid": "f5676b31-1c04-43ff-906d-f1586e4e27fb", "comment": "Malware payload (MassLogger)", "value": "4b3ed5cefa81dc79adf5fc75cbe448da1b89f9937e642fac40b4295714d2aad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996357, "uuid": "ffdc1334-9b23-4680-b9a2-ba86c51c5010", "comment": "Malware payload (MassLogger)", "value": "3b2654716b58eeeff018a4b612ceb19d13deb872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996357, "uuid": "d7b00528-5a64-43bd-b536-6c45c6cd37cc", "comment": "Malware payload (MassLogger)", "value": "dfa7481680ca8f3786b99b3f298669bb330d9aac85a90efc9d0176b745c1630ee3889c0e29ac757f0487760fe1bb5b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996357, "uuid": "2fbe5e52-2b27-4996-b7ec-c0dd8f5eb437", "value": "T161D4E0A43268DD23D1BA47F10960D37407B6EE9D6920D3CACEE66CDBB8E4F011A50767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996357, "uuid": "a168c027-f0aa-48ee-a008-819cb6c0b7f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996357, "uuid": "c053e6dc-3034-4c65-8b7c-a1f35316b962", "value": "12288:IYrYqBCCwf2Bj0WveLrlpXPmE1PWhkOex4u9kR:8fAjjeLrlpXuE1urV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743996357, "uuid": "4bbc2e0f-88dc-4891-add8-e5bd85692e9c", "value": 654856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743996357, "uuid": "94b0a5b0-4116-4f6d-bda4-8b977d99cb32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996357, "uuid": "cb1a8102-5779-4c6c-9d09-2bbbfdea2210", "value": "SecuriteInfo.com.Win32.CrypterX-gen.17934.32462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9c7950-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028451, "uuid": "c706a1d2-bc70-4deb-bb6c-2cccc665b827", "comment": "Malware payload (Arechclient2)", "value": "9248af81884e42bbe88c68301645ed71", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028451, "uuid": "3279e772-92c4-4e01-ad7c-cc2824cf8ca8", "comment": "Malware payload (Arechclient2)", "value": "4b580fb4ad57c5fc8820fc8b03f10c23e6760e5ae82bfad1e74837eb4cfc1b14", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028451, "uuid": "f3330cff-9204-4c43-bad1-4e61f967ac3c", "comment": "Malware payload (Arechclient2)", "value": "befa771be695135a36f0b01baeddf93d90b001a6", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028451, "uuid": "c5e6ab4a-03c8-440a-8c46-2c740e815766", "comment": "Malware payload (Arechclient2)", "value": "e33d0320380ca0838f2ad37d264f1eb1aa2a6d8225e76794e25d19c5ee72407ddba134cbf97eee6725305e6ea07e6410", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028451, "uuid": "614491ad-94e8-4da5-a474-74ed5dacf261", "value": "T16FC6C0227BC98071D9A71270465DB379927EFCA0173006C363D43BAEAD747C1AE356AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028451, "uuid": "8ea8cab1-6411-481f-a315-0ac1b4dff3d7", "value": "196608:XSvUddiGELiFTAVGahnhyk8N0FFLOnoksRzYlmKEomfEDS6l4crtNXX6i4p9:KUddFo9VGafSaFFL5ch4Drp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028451, "uuid": "2e5eaf62-0bb5-4351-89bf-2442d509314a", "value": 12019692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028451, "uuid": "a7780525-a786-4b2a-90f6-b28f97ea5384", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028451, "uuid": "6cb3ef59-e4ae-4a0a-abb3-458149ddded0", "value": "YTOEOXNI.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd694785-13bd-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744036609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036609, "uuid": "426fa1a6-793e-45b3-b8d3-10f728a25487", "comment": "Malware payload (LummaStealer)", "value": "43b5a01d728901d2d5878b074d89f324", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036609, "uuid": "2a56aa08-ca26-4d3c-bfe7-ef74f4ad3762", "comment": "Malware payload (LummaStealer)", "value": "4bac43798c5927b421e60ce964ff91bca8c2c7031a64028d752a43d0307d2ed6", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036609, "uuid": "a1c3bf80-8bf3-4553-ae8f-8862c6c4c349", "comment": "Malware payload (LummaStealer)", "value": "5064813a3ae4a315b334f5b8bfaa8d18ef7183e4", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036609, "uuid": "7041f24c-ec76-49f2-b4fd-8958f17f22e9", "comment": "Malware payload (LummaStealer)", "value": "ba75e31b17f72c8a564491e2d28d795b1843f68c64a38e06c724ab29660586543533816563063d27f241703522b36e30", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036609, "uuid": "59dcc197-523b-4e2c-8250-a45c655a63de", "value": "T1A915BF80E6B3D1B1D09118B0C56E67F68F3C6F3285299633BFE83F997F636602656244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036609, "uuid": "caea43fc-23d6-49d5-98be-71f6fc75e19b", "value": "4453ca20624a571cd75bdaaa05c63b99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036609, "uuid": "2425a4db-ad62-4cc0-9b21-c8b980c3f59f", "value": "24576:t9H/1mt2hXLRas70Wu/aUZ0FSFUG8Vk8aw:4tu1THuyUZsNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036609, "uuid": "c1a26550-5d9d-44fe-aa88-c4ebfc42a023", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036609, "uuid": "d0820152-87b5-4c25-8877-837a3059487d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036609, "uuid": "6c7277f2-c4f1-427c-893c-1fddbb6e19d9", "value": "SetuP_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43609fed-13a8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744027385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027385, "uuid": "03d495d6-50d0-4e0e-bb33-5e007478d118", "comment": "Malware payload", "value": "acd7d9dfd4063a0fff8f13519f729fed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027385, "uuid": "0d34984d-ffb1-448f-be76-4c662772d55e", "comment": "Malware payload", "value": "4c3efb14015619a3e399bd4ed4e162b20cfce87176c719b54999d7b00f01f5fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027385, "uuid": "7edd8224-87aa-40ba-9b39-57a104f30986", "comment": "Malware payload", "value": "f7f7608bcfd74a645a6c809cd529ef050a008caa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027385, "uuid": "4d6b1d82-4fee-4d6b-a74d-51ed5bb8c995", "comment": "Malware payload", "value": "a048a7cfcadeadd091f5a6d2924ffa63e5ed3dcd10b1cf5f6b8f53988b02f96353a9bd3c61fb7b93de6edbcb78b794c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027385, "uuid": "bdcdc143-4c38-4c5f-b38c-3c74f7b3c4f4", "value": "T1BE03F1D536BACED9D1EDEEFC04B136A05B9237208A4CA27D1D2B55197585B233CC058E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027385, "uuid": "928f8110-9517-4d3f-93ed-0560a93adf88", "value": "768:OlaJCOVrGkNGeESBaMAww9xy2X0bwNw4Tv0Thd+BmtO1FRYYKZe2Pp5:waJCOFGkNGX8AwWg2a6w4Tv0d+oODRRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744027385, "uuid": "fbc6b6fc-1498-4c31-8bd0-27f49f512c2f", "value": 41236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744027385, "uuid": "93a70933-befd-4791-8784-a2369cc1e202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027385, "uuid": "6ede08ae-db4a-4b55-9231-ff977a71d513", "value": "hanoi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546b28c6-134d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743988329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988329, "uuid": "f5622c44-dc50-4d41-ac25-1f7fb2c47fed", "comment": "Malware payload (Mirai)", "value": "ac1c918b876eeeab969a11d94fe96d91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988329, "uuid": "d169e599-814c-457e-b091-cf6a5a7837b7", "comment": "Malware payload (Mirai)", "value": "4c65ec258670513d9c8cafdaa8a02f8b27c499d20a2eaff5b0cd199d25db2ef2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988329, "uuid": "cd133210-fe8f-480f-9062-89ba9c59b103", "comment": "Malware payload (Mirai)", "value": "9eabab9667ff6eaeb27a040b805331278b79cf61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988329, "uuid": "309453b7-71f0-415e-8a37-050455a23a84", "comment": "Malware payload (Mirai)", "value": "ba90690ec714decf28e1a2324bddf51af74daade6cfea37e4b260d8352817b88c2fcc78faa2d4e9978565019d919680a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988329, "uuid": "b2e3fe3d-bf7b-4e77-a9cf-1374c20ac786", "value": "T109C38D73C869AF98C618E0B4B0748FBA2753A515824B0FBE5667C3718087D8DF54E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988329, "uuid": "168ce04a-b501-4ab0-a604-c8b2e6e60886", "value": "1536:5asIsMZV8457qWn7Zr1Yxyd/yxu12CRKBIyYywbJW1lSR6WWRwmQwqfz:5tc7q6Fr1BtqA2FBHCW1E6Wwwms7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743988329, "uuid": "cc0b6510-5647-4b59-bbe0-042c69274a65", "value": 129664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743988329, "uuid": "b30f261d-4bd8-4c29-97ee-8dad280cbe09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988329, "uuid": "717ae1a3-a0b8-4d1c-8cc0-e77b3a4a923c", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefe79ea-13e1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744052154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052154, "uuid": "f6e2eddc-8dc5-4228-bbbb-2524d518c3c3", "comment": "Malware payload", "value": "d60d0b3632c84594d53b258cc348e807", "object_relation": "md5", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Servably", "colour": "#B4D00A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052154, "uuid": "c9a46d02-81d9-41fe-99e4-03ef63145bca", "comment": "Malware payload", "value": "4ceaa0b00be773cfae84067b3077e2160f3869673e0647d8d94130254db3a75d", "object_relation": "sha256", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Servably", "colour": "#B4D00A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052154, "uuid": "324bb91b-dc0d-472a-90e9-914ac323e1ab", "comment": "Malware payload", "value": "79b306a7eb383315faf14972d7b62b791ff4b9ff", "object_relation": "sha1", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Servably", "colour": "#B4D00A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052154, "uuid": "f3266af7-0537-43a2-b6e2-7c8858ecb876", "comment": "Malware payload", "value": "aa807069f8eea6b6e83c3ccbf28d018f52692b82e086935934776d71961fa2fc2786f7c2f064001ffaeec4eb5d797421", "object_relation": "sha3-384", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Servably", "colour": "#B4D00A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052154, "uuid": "c1cf9aa6-4725-48e0-8950-ea46e292b8ff", "value": "T1BCE5120323A7555AD4697AF3B8227081CBB6BE071A2DC67A6171758C0ABC743CF7126F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052154, "uuid": "d4c0f425-70bc-422e-9a94-43852724f098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052154, "uuid": "4bc1116a-862e-43bf-94bf-ef0e9b5df6ac", "value": "98304:wxcaeYZ0kpkqXf0FWvnzmb23pOCy0hgxUrin:wx1tkSIWs25+ICX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744052154, "uuid": "57b070ee-0b4c-4015-be7e-0d0c6b54227a", "value": 3269096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744052154, "uuid": "5ffda151-63d4-4450-a635-27cc71f68854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052154, "uuid": "06a3281b-1c01-41a3-ae85-ad03fd066c0c", "value": "Nf-e25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b17a5b-13bb-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744035809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035809, "uuid": "170de42a-668d-458a-a251-988745f92ffb", "comment": "Malware payload", "value": "90bad2a3a6394caa3a606b213a4150e3", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035809, "uuid": "96830b5a-2cd6-4b7f-8100-fc6c1dddd4f9", "comment": "Malware payload", "value": "4d09fad2630ec33ab6bb45b85455c6a6ac7b52f8dae9b90736db4a5f00f72ea9", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035809, "uuid": "21a488e0-03e3-4957-80cb-a133ad9ae621", "comment": "Malware payload", "value": "6dec78a9a59f5cd2749938bc2d0303f8eeab6e79", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035809, "uuid": "d92141ce-dbbe-4508-832b-7f625b9b8be6", "comment": "Malware payload", "value": "bf89ffebf9aaa0cc5a36b587e7ae37518d4029294a859f8caba9f1196903eaf6e6b13fb4292b95ba1757bf95bc755a2e", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035809, "uuid": "dcc0e06a-f517-468f-90ea-627bebe12c96", "value": "T130542333B34247E782357FEC638A27F4D100B3B9E2AB666C611DECF47AA75952094634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035809, "uuid": "708ded67-6162-441e-8692-28dd7e9db09d", "value": "6144:5GPsXqAhmWvY6GA/LzcDU4fWbk9ltE1rSZB7ZWM4A9QXmiqIkYbBcNv+CsEkHm1r:oPsXqnx6GeLg44W0aSZbH4zXU9YbBcdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744035809, "uuid": "f65a802f-a912-44d7-8c1b-8fac39076829", "value": 295145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744035809, "uuid": "bf9d4d69-28c5-415a-bafc-b17baf158767", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035809, "uuid": "ac3417c3-8b7c-49c5-b3ca-3dda51c7a10a", "value": "dow\u00f3d_wp\u0142aty.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29783493-13c4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744039367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039367, "uuid": "02dc48bd-e9d0-4fb9-b11f-8bcd97c1c41e", "comment": "Malware payload (Prometei)", "value": "b5b07e6ab9fd8897eabf7d58a2245fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039367, "uuid": "5e299d2c-5139-4c4d-8b15-4992f30f47fb", "comment": "Malware payload (Prometei)", "value": "4da779e57993bbda916e17844903b3b76178c27edc6968f48764c7dda0bc8b6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039367, "uuid": "89395fcf-0252-4733-a79e-d8dc3d39a49b", "comment": "Malware payload (Prometei)", "value": "466617110db1bcc51ab2a65496c5d33ba9085dc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039367, "uuid": "68fb609c-7ba9-4c2e-a515-ef3d43c22bb3", "comment": "Malware payload (Prometei)", "value": "ecfd4d05ac3e95595af77af191aaecf1ea7c9dfba47c763acbf15dd5f74f2765c53c114db7053f86276a5fe6db103593", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039367, "uuid": "2cca61d2-a4da-4629-b136-db8fefde71be", "value": "T1539423F8C87D2E3098169B3CBB1A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039367, "uuid": "247adc51-a9ce-46b9-b262-4a809209e4f6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgQ:25WOSACZSV6eKRH5EPiamb4DsDwwcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744039367, "uuid": "ee9d014e-b7bc-4e9a-bebb-acc8f47f6f4a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744039367, "uuid": "b4345379-4eba-445a-aa89-7327beb4714d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039367, "uuid": "1234d965-0c01-4293-9a39-97af9a5f0e17", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e34440c-1346-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743985339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985339, "uuid": "b40abe91-5b56-4179-8acf-c9561e183a07", "comment": "Malware payload (Prometei)", "value": "4429bc94b8f954c79b91836666f79b6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985339, "uuid": "0509fb17-b50a-4749-acdf-e0453867676e", "comment": "Malware payload (Prometei)", "value": "4e2c52af462bdd8be3d81ea302609dae9d3ae8c2b0bf9093ab80feaa254e5ea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985339, "uuid": "42339c32-3cff-4a46-8d8f-27dbb540a3c0", "comment": "Malware payload (Prometei)", "value": "1969b9d18332b7b280107d0ea48e91586f70927d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985339, "uuid": "1eefe2ff-9c07-4245-a0a1-b47f76cf0b34", "comment": "Malware payload (Prometei)", "value": "d0616706856dc61556276553953dc941fa0871287f613e836134ddf11e2603246933219e0457ac3c829bc28440818573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985339, "uuid": "6ca15251-fa5a-4377-996f-518603d80419", "value": "T1C69423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985339, "uuid": "b74d9dac-41fa-42b4-b306-bbb90ada74f3", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg7:25WOSACZSV6eKRH5EPiamb4DsDwwcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743985339, "uuid": "794500e5-82bd-4ffe-b409-902c53d911c7", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743985339, "uuid": "6bf08255-d0d5-41db-a969-e7da4ce4010a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985339, "uuid": "30568cc0-bdd7-488d-8807-bd6604dcc057", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bc381a-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028439, "uuid": "30ef01b1-78a7-4933-b936-19ebf339a9f3", "comment": "Malware payload (Arechclient2)", "value": "0883973200bb9fc4d641690284d6e052", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028439, "uuid": "5c51c92b-6629-4449-a4c7-17986e058cb0", "comment": "Malware payload (Arechclient2)", "value": "4e7243907d83bb073b054ce1eb3508fdd234623b3570c077fa7c0c35ea7e90fc", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028439, "uuid": "30cb4d76-ca95-4e47-86c8-24ea428cf92c", "comment": "Malware payload (Arechclient2)", "value": "50a1aa74fade4aad8dc76f264a73973d2667b17d", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028439, "uuid": "1e9be1b3-1c21-4f7e-bbbd-206619b13570", "comment": "Malware payload (Arechclient2)", "value": "4be33a40d5398f8dc45edc6a6130f5e4a40f2223c2285ef18796bd3997f814e46c5124c2aca932f92528bdd18877bb54", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028439, "uuid": "c839c154-db80-4271-b23a-7b0b1ff744aa", "value": "T110779D13B261907BD4EB0736997AE670553EBFA05A26892777A83F0C6F31680BD17307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028439, "uuid": "35f2ca20-290b-4cb9-918f-0cfa091834de", "value": "393216:O/u6I9kN75OTLwxaEPnrIzIn/y+NLhxaBJ8oWhKUzLkWEKC+5ylVgTKO/fJ+rFOI:jDEPnelVFLWTUvwrp47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028439, "uuid": "b1fe1b4e-95f6-4453-93f8-ab84ca917c26", "value": 34975188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028439, "uuid": "ce244988-01e4-4b2e-8a52-0041efea4200", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028439, "uuid": "0c58029b-5171-4d89-86dd-54b23c607af1", "value": "msi (5).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4c2ceb-139d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744022571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022571, "uuid": "2fd19b4e-28c4-4a02-9061-cce34ce5c54e", "comment": "Malware payload (Mirai)", "value": "1fa2053de8a4f9aa8cecca1d7442a7a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022571, "uuid": "0fb644b0-7e9e-4bbb-8452-e03e3c7ab786", "comment": "Malware payload (Mirai)", "value": "4f35afea56851f9cb966c88293a5a435310c2f7827e421ba37b6461d74258d40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022571, "uuid": "e0fdb4c9-59f9-46be-a808-1fc6665b455b", "comment": "Malware payload (Mirai)", "value": "82f46228ed1c6e2ac6851b1bcff54f20aada4ce0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022571, "uuid": "b322eaaa-6b76-413e-97a7-fa49b28fbce1", "comment": "Malware payload (Mirai)", "value": "30446575df1a79bf73be3efd10861d356509e41fd9a7e12e08c16e5e493f82c332e030d681fa77ace66e8b647ea5acc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022571, "uuid": "af1f730e-9180-4c61-a080-593a4ddc25c4", "value": "T16943011466628DF3EB3C93F5EA0905234349F1D4DE197FCB1A20EBADEA8530295369E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022571, "uuid": "08373b3e-f615-47fe-af7e-a1d3543908a0", "value": "1536:bugRV+Okc3lXrK4RhYn6FaqryRCEb7gDOQUkotsF:flXrdRhYnGaqrSFMvUBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022571, "uuid": "97f68428-c242-4e03-a039-115a387d2c33", "value": 58852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022571, "uuid": "763e01c0-1830-453c-a5af-ecabd244d6f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022571, "uuid": "bb44041c-6e53-49a6-88ec-4ec5cf137947", "value": "hanoi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827189e2-13fd-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744063998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063998, "uuid": "abd8aa06-bf52-4735-883b-6fa5fa37ac0a", "comment": "Malware payload (Prometei)", "value": "cd1421eb3b4bc4461d449cb07f8971a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063998, "uuid": "6dddffb2-1632-4f72-8b3a-5a796f39f698", "comment": "Malware payload (Prometei)", "value": "4f9dfb97fcf4e07eff6340067aa113fbe99782280c9f511f48aba052472ca2b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063998, "uuid": "55fba7f0-cea7-4c01-b295-065e52120d2f", "comment": "Malware payload (Prometei)", "value": "8d521dbc96ce7e8be7b6a4f5713be8b8be8c12d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063998, "uuid": "4f1dc9e7-5676-4179-b012-24f66476aaf8", "comment": "Malware payload (Prometei)", "value": "a6dc531c5d7cb3185927b8bf88fd64072e9e3809ee85b675e5becb1e53ad10c7f95709342e71a393fb47bea52061d153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063998, "uuid": "12e14d50-74fe-4523-a00a-1bc83037aa0b", "value": "T1F39423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063998, "uuid": "3cc9c322-6fd9-4abd-a9fe-22f6acda69dd", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgC:25WOSACZSV6eKRH5EPiamb4DsDwwcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744063998, "uuid": "2519cc0a-de81-45ed-8b51-07122ce3b7b6", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744063998, "uuid": "5cb3d1d4-37b0-4a74-ad02-827fc6783d4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063998, "uuid": "9f8d3434-6238-4a97-9a13-453cbaceb642", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbd7458-13f5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744060635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060635, "uuid": "34dc0a43-3bf9-4d97-8e86-d8f8457edf25", "comment": "Malware payload", "value": "439747324774204bf172a363847d8966", "object_relation": "md5", "Tag": [ { "name": "DraculaStealer", "colour": "#54246B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060635, "uuid": "aed6905b-0937-42ae-82c1-01853fd90eea", "comment": "Malware payload", "value": "4faafea0f38ca06ae2405c470ac79e8e7af610236bc04f3bbc64592c4f0c88aa", "object_relation": "sha256", "Tag": [ { "name": "DraculaStealer", "colour": "#54246B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060635, "uuid": "8c1a27a4-9ac5-4cc7-b9cb-199c7aa42711", "comment": "Malware payload", "value": "f5641e7dc34ff9f9063f4d6060242b3a541791f3", "object_relation": "sha1", "Tag": [ { "name": "DraculaStealer", "colour": "#54246B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060635, "uuid": "655136dd-08a0-4bb5-97fe-afcd9b89f3de", "comment": "Malware payload", "value": "0b75d3860da814ee76722cadb6857fd889b2c2631c3540d98b0490cc42791e7cf14338c3cf5b06227e711a3c99cd062c", "object_relation": "sha3-384", "Tag": [ { "name": "DraculaStealer", "colour": "#54246B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060635, "uuid": "fe6812a4-8145-41a1-9262-f14a9bf8baff", "value": "T10B75336667FE8433CED75F3112F8068B817784A6FAE1BAEE0A5132706A13503D4E5C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060635, "uuid": "0d756851-bc77-4e53-aed3-b6795cce7d0c", "value": "24576:xa9co/c72uHP6tytifSBQZzFtxfRjLStP940v/tZfTp4ZMmYpmCTOwum3KnzdmUp:xaKo7uHaytutRjhs/zp4ZJYpq7gUGYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744060635, "uuid": "a63ec5f9-772a-4fb7-912a-d01c547d2075", "value": 1675264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744060635, "uuid": "70a21021-3334-4ef5-ae89-a6d90c9e946f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060635, "uuid": "cc189eba-3596-4434-8cb4-f3d1e696f735", "value": "Extreme Injector v3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ee8dac-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744028351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028351, "uuid": "28a4f39f-b48a-45ad-8816-7d5f309ddb95", "comment": "Malware payload", "value": "e4998abaa8a530a95f07330247c88783", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028351, "uuid": "64967801-586b-467f-990f-3146b84edd22", "comment": "Malware payload", "value": "4fe2e672e728ebad9e7e2e14df175516f77419c51f35826ca0dff9cdac5386b0", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028351, "uuid": "2a0f1b12-1165-4672-a8b2-1a4a012e01c7", "comment": "Malware payload", "value": "f53c45c4edfa3be73e9f761f579dc71368e41385", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028351, "uuid": "ff84cd47-2689-49c5-b49d-a75fcabd927b", "comment": "Malware payload", "value": "10b94f5f4e0b108f8c9b7f50a8acfa135dd978e9b9a4f1373193e2cb97aa71fe2f7d1602f5563356877718513acc4df7", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028351, "uuid": "30bd7a50-7b71-4675-ab55-be1b83c1d09a", "value": "T13425FD403B99BC8708074732BB2A75FAD11AF515EA8DD4CEE1027C59F0DE971BAC52B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028351, "uuid": "bbb1b3e8-2c6e-4ce4-ac82-0bfd1d879318", "value": "24576:gY6UXpF6TSZbZdHIvrTLoa3/2e4iCy+woqpUnp9ifYYSEUO/BrJujZMkwEXxmwtc:RpFMSZbZa/U8/T4iC9wtmnp9uYBE5fua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028351, "uuid": "028bee60-cbc2-4ed9-b2dd-25f6857dafd6", "value": 978303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028351, "uuid": "61f89a7c-2684-4306-b9b0-fe4859cce2bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028351, "uuid": "64c78be0-5902-413a-bf3c-8b25d13a789d", "value": "ovel.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1372e3-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1744024121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024121, "uuid": "2984d765-79a1-4f91-9384-0b27685a33e6", "comment": "Malware payload (XWorm)", "value": "03453c8e86963aee7e3c13699ae24c89", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024121, "uuid": "dca4f3f8-2490-4286-a41c-5c38cf9673b0", "comment": "Malware payload (XWorm)", "value": "5016d975e5eea21864a73c74e6ef2a4c4b15e7720c1ca2aa46611601ba6e8430", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024121, "uuid": "68984754-936c-4e48-89a4-11bb821597b4", "comment": "Malware payload (XWorm)", "value": "616cebedf46243e63a1acd2daf70ff3d14a395dd", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024121, "uuid": "d9ae5ec2-19f5-484d-bfda-cc52c95d1ca4", "comment": "Malware payload (XWorm)", "value": "d9e68bfef1d2994b07f0caaaaa9f92e297c855fa317dff6eb0443c5fee75cf675f299cb767bb6b000fcbdf9c05cd2c05", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024121, "uuid": "398bc89b-5cd9-4dac-8c83-8f5fc7d30d0d", "value": "T1A363A0313402BDF5627EDD84E21428B1FC55351F56A68E7CBA8388791FB64E08AFD9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024121, "uuid": "f6ca7495-c099-4310-8481-01a76ed9e6f5", "value": "768:FpDi6H5262elERh23pVmXCdWoULqEJ/nb4crRsILJlLvdcTHygSMK7AawaEKCEbp:Fn5P27Ry0oUrJ/72c7gSMdaJLCEbi4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024121, "uuid": "fbeb84e9-72f3-4ff1-a3f4-c4f1b4175c28", "value": 67427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024121, "uuid": "0d845fa6-fb0c-42b7-b7dc-28964482fd41", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024121, "uuid": "d49a3f83-1107-4bd7-b79e-2cc32325523b", "value": "83.147.240.230 (9).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acfff99-1383-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744011479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011479, "uuid": "18e0c0e4-61b3-474f-8b4c-cbed8b5a150d", "comment": "Malware payload (SnakeKeylogger)", "value": "d16e0d55292ed9e80468e522ac25b401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011479, "uuid": "ea75be8d-a618-42bc-b934-d5f27e697932", "comment": "Malware payload (SnakeKeylogger)", "value": "505082a9193543319b0c395de0f7ff33f1ba633359a0ea04f50f2a90bdc8c62a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011479, "uuid": "7c022846-df8e-466d-b950-3e307ba6299c", "comment": "Malware payload (SnakeKeylogger)", "value": "f6400d02f5f8e488dc69f53b9dfc2ba986443577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011479, "uuid": "45dbc71d-cff8-43cb-9b44-9a72ffc8d008", "comment": "Malware payload (SnakeKeylogger)", "value": "c2c2931ef5a0721342ac253918880d7967c0ff5d19a593dec57d6d976f43d55f38ab4172e99c7cd024fda4283d803fc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011479, "uuid": "ed1a3b67-54ce-4938-9da8-4c7448a7c8ea", "value": "T12BF4220FF76DBE65C10D0BB3C8172144C2A945B2D129F69739F94DE12E2BBA4C14AE27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011479, "uuid": "0d7e18cb-87c1-4044-9220-072348da5478", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011479, "uuid": "320b5c6b-5a96-40ea-aab0-c9b2fd3b6a7c", "value": "12288:0BTEhqZf5wQIfSDJIb1VUiHRwlH4WldwVizfCYG1btfXBnVmnx5qONnwz:yTGKwQIfSNg5ofKYKxn6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011479, "uuid": "91b2d2b1-307b-4f0a-a605-6498e2e9029a", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011479, "uuid": "4eb2be23-e1f7-4f55-a31d-4491d88dff43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011479, "uuid": "5bb0efb6-b371-4d9a-9bdb-2acdd48df19a", "value": "PO NO.93053034 400 pieces 02.04.2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd2f1e6-1383-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744011780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011780, "uuid": "599f63e7-6fc6-4902-96ce-c9eb0484bcdd", "comment": "Malware payload (Mirai)", "value": "0134dea55659d03355612f9b55dd0fc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011780, "uuid": "11b0c170-38eb-463f-b3d0-95a8fdc69356", "comment": "Malware payload (Mirai)", "value": "50c7dc45c69ef8361ab0e65e0ed1efa5e15f703dca2ef5592cbe5bf5e6f4921f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011780, "uuid": "11217f1c-bf0b-406e-b4f1-0f9d0169ab3e", "comment": "Malware payload (Mirai)", "value": "616972f2465197d4cb5c6db63183794d61aac8d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011780, "uuid": "65c2632b-1f53-45f8-9cb1-4ffbdcebbc8c", "comment": "Malware payload (Mirai)", "value": "782476f4ac22ad47372554d9674a05856d839bb343738eb5a4cd8599f88fb37248293c362e397c7600ee8c410e086f1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011780, "uuid": "ab8e9c4e-1ca1-4ce9-ad1d-16406049edb1", "value": "T163042945EA404B13C0D627B9F6DF42453333AB94D7EB73069528ABB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011780, "uuid": "35e5a18d-7162-47fd-8209-b1c4b38ddb26", "value": "3072:OLe6vhP1QIruCee+asuTuRebU7IVILZZQy38YhTfYo+M/Rvs1tlLn:ee6vhyIr1r+asuTuReAvLZ738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011780, "uuid": "e1d3059e-c331-4d7a-8128-a777402e8f27", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011780, "uuid": "11b6b25d-468a-406a-8ec8-b4ac34b03f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011780, "uuid": "e4f26cef-1266-4292-b7b4-97493dfceb61", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b912c1-13c5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744039973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039973, "uuid": "bacb8382-27c0-44a8-a500-e0f2168d4661", "comment": "Malware payload (Mirai)", "value": "a9ff84ca46782f75e8ab8a5ca8f53696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039973, "uuid": "c1ca2ea3-5e3f-4439-a102-808ea97d3de4", "comment": "Malware payload (Mirai)", "value": "52e82ca7c6e624af2fc5c939b83b423229ab080ec287912d23578fde1793aa98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039973, "uuid": "022c1f1f-858d-4e53-8e68-a61a87b7a6b5", "comment": "Malware payload (Mirai)", "value": "e0641fe586878229ee6d53338789446429974e26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039973, "uuid": "c0856f44-ff6c-4a54-9b18-4b5403bf8253", "comment": "Malware payload (Mirai)", "value": "5ad732607945a2728725eeff9be7f1ef8659c5e536ea32a33aeb39b2dbd27366637aaee6b482d62ae55d376f0d788ffe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039973, "uuid": "048afc26-33d3-4e6a-8fca-b763f17ccd85", "value": "T18C735C24A97D2E26C0D4A17B62FB8365F2E5230E25B0965D7C720F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039973, "uuid": "3586c404-91ef-4363-90f3-edaac89fd3d7", "value": "1536:pms+geQfvznpCR8ee84cN0AUfAvFQ7XdldPws0K:owfdNu4c+8vFyXlIjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744039973, "uuid": "26815a04-3fd1-46dd-b11f-4a3d1411207f", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744039973, "uuid": "76c0c287-8619-441a-a2ba-582f67bcedf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039973, "uuid": "1e3ab4f0-f854-4bc3-b504-3b0b5020b211", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2a2b59-138b-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744015238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015238, "uuid": "1e9a3a2a-a320-4c60-ba1e-36295fa174ab", "comment": "Malware payload", "value": "f62ea2cbd220596072010e91dd65b673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015238, "uuid": "6aa176b6-df31-44fa-a7aa-89d20a9b4b66", "comment": "Malware payload", "value": "530185fac69e756fb62f23e21e7c0b0828a964b91bbf40f1d04fc2136c1b6dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015238, "uuid": "68ba6032-1c2f-4334-9c72-81f7bfb019e1", "comment": "Malware payload", "value": "7ea7ba5d7ec83cca1a3ab496d2e81e484c6d78e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015238, "uuid": "d9b666b6-0a1b-4cbd-ad2c-19e71170507e", "comment": "Malware payload", "value": "db2535fc1e73078087d39d52f3f974e8956f4f5c527b9a01770dd6d1c9d35db25c84b7dfd16770c43233dc2d3cf60202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015238, "uuid": "0c780083-f591-4d92-a81a-71a955743c7d", "value": "T118F48D6AABF401E9D1B7C138C5469613E7B2B015132097DF06A4CBBA2F13BE25F3A751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015238, "uuid": "b60de025-327d-4ac3-838b-c1904a39568e", "value": "8d7e0a568725d1bfe102aa5adf2e48e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015238, "uuid": "cb9f9d1c-496c-45d8-8d8b-103233edaf09", "value": "12288:YvWtNUrunqsnxjdmpHVLHEIkUbbK5jQ7nGFC/aShu2Gcp43CNod7bOKusy/PsVkP:Y7qqsnxMHEIkUvMQ7nGFC/aShu2Gc23i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015238, "uuid": "f66a1fdb-e7d9-4e56-89e0-15f3b219a4e3", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015238, "uuid": "7767f018-12cd-42d9-857b-a726499aaca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015238, "uuid": "c620ea30-4dac-4461-aaf0-0b541afed7f1", "value": "SysAnalyzer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07dedb47-13b9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034587, "uuid": "00874d92-91a7-41a8-873d-3ddcca08f7ed", "comment": "Malware payload (Formbook)", "value": "cfef9b7ce1650f4caef2a46529df0a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034587, "uuid": "b61d2304-1108-492e-a2d2-7b868e3f82fa", "comment": "Malware payload (Formbook)", "value": "53a0842c502305cb55c9eb7e7490bc5f27b048c3f57d24829b2e6a44bc0b0985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034587, "uuid": "f0cf298f-59d8-4bb6-8551-dc6f0a92bedf", "comment": "Malware payload (Formbook)", "value": "7740b9ebb4715559b31a0e786f1e12efaa881c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034587, "uuid": "77b8c241-f732-4a1f-8154-030251873d16", "comment": "Malware payload (Formbook)", "value": "6e005861079eef9fcaddab6f502a48123cfce46109fec2904721e0347214fa2ac48b828821aca259ffe94b50117934b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034587, "uuid": "38ef1b81-342f-4e48-8e62-3f4934a2400c", "value": "T1F045CF2273DDC360CB769173BF29B7056EBF7C214630B95B2F880D79A960162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034587, "uuid": "6664eb78-6659-478e-98cb-6da7435e402a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034587, "uuid": "5952efb2-19a9-4a90-956c-da5dfa97557f", "value": "24576:Wu6J33O0c+JY5UZ+XC0kGso6Fa58IOEprW9JLMWem/CVZxwWY:4u0c++OCvkGs9Fa5Q8WvMyKpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034587, "uuid": "09c037cc-1cf2-4178-a60b-adbae24f3c0d", "value": 1198080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034587, "uuid": "2c9362a2-dc0d-4f9c-934a-4e810f22d1fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034587, "uuid": "42c40ef6-6bba-48af-a664-bd75e18a4316", "value": "53a0842c502305cb55c9eb7e7490bc5f27b048c3f57d24829b2e6a44bc0b0985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fe34b3-1352-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743990432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990432, "uuid": "c81b0af0-d31d-491c-b865-bff05908fa4d", "comment": "Malware payload (Prometei)", "value": "898a49ea416acbd98e529bea1d0f5633", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990432, "uuid": "fbd149da-5aef-4e0c-93be-2200c3b61af8", "comment": "Malware payload (Prometei)", "value": "53ba6bd279e8ae1a35906cc66ba326ef8fdf1ecde1a58763aa95d2349842312d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990432, "uuid": "7586a415-5ea9-4023-8248-2fb3e4f54939", "comment": "Malware payload (Prometei)", "value": "242dc43f4518af3b5de32ee927b3ec062e38e63d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990432, "uuid": "f4480bcb-c6da-459e-8b14-aee90627d54b", "comment": "Malware payload (Prometei)", "value": "bcff57be552123cf6ea85b70d2a45a6fc72cc2c7bbfd7311f3bcb32500151c62a7768d65c9fda1ad911f522942289a9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743990432, "uuid": "3fd44e9b-cc7a-4383-acee-d783911864bc", "value": "T182155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743990432, "uuid": "e5f61ad5-16b8-40ec-8512-fe2163b41803", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpln:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743990432, "uuid": "223b6f1f-d7b7-472e-8a7f-7fbeb36762ae", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743990432, "uuid": "42478011-d1a3-4672-9032-030a6a7f7ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743990432, "uuid": "e27741f1-5b93-42a0-b1bf-df57a55306bc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d60c8c-13fe-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744064269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744064269, "uuid": "b78f2adf-1a4b-4e5d-b6b9-5717177df034", "comment": "Malware payload (Prometei)", "value": "49aa797b05208546028c81a5c470e3a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744064269, "uuid": "feeabb8c-bfaa-437e-af8c-6c700f4c660e", "comment": "Malware payload (Prometei)", "value": "54f8c3d04aa51a18e1594d6e947218ff3d630e9acac83c2c6b04e95912a322ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744064269, "uuid": "f7583fc0-a6a2-4c4f-87d4-0a0c5d57ffa6", "comment": "Malware payload (Prometei)", "value": "c8c45e7c1d9a20a70a0df0a727279b43b5be23db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744064269, "uuid": "513fe655-eb06-4b17-840f-60d3e6076282", "comment": "Malware payload (Prometei)", "value": "84a45f6987ee051a3b1aa2f39372e3ce4e8327ffca019e1e579361bfae8abffdb9d519d23d81b54e43de20fbf38d7139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744064269, "uuid": "8ff0abf1-ea9a-4aeb-b54f-5cfa55573509", "value": "T16F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744064269, "uuid": "4a3c14ea-3a70-4191-aec5-a628c77975b8", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpla:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744064269, "uuid": "32c0786f-8bb7-4541-8dd9-2695e2b13ee1", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744064269, "uuid": "2a1f399e-e35a-40fe-96ec-6d5b1a831356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744064269, "uuid": "e8d42791-3e06-46eb-8b47-8f4b27509e69", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12fa6d4-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028428, "uuid": "a3c67a0f-2e25-4130-b9da-15189e34d4cb", "comment": "Malware payload (Arechclient2)", "value": "351534e9541bf6e3a431f681f434c035", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028428, "uuid": "b439a494-face-44df-8dd4-60d869295af3", "comment": "Malware payload (Arechclient2)", "value": "5683062408d9b59fe6c9296e4a269eec710e06ed84be38fac698903ea7a78ba0", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028428, "uuid": "a2f0b0bc-db76-4aef-91f7-314257d8c6d5", "comment": "Malware payload (Arechclient2)", "value": "ab20dbc4cbfac36da850ce565802f17174c1c3f9", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028428, "uuid": "d5c615d6-06b0-4b1f-a643-7645da7e95b9", "comment": "Malware payload (Arechclient2)", "value": "d1edd7961edcaf63ddfc9aed7c0abd44be049928a1f8412f5eeed43e47c6fe7eacadfab8105df57a179193cdbb54c81a", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028428, "uuid": "1fd6b891-1d2c-47cc-bdbf-ffd7155dc8c9", "value": "T10D27BF11FA82C135E99F017299BEA7BE953DAE20033485D3E3C869691D71AD33B3135B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028428, "uuid": "df6445bc-bfa7-4714-b762-8ee4cd6a61f7", "value": "393216:CQzQrSX8B1Ph7xmLySZGqM/RrIKo9MGRJ7S4il2:LQrNPh7xMo/RQRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028428, "uuid": "d835addd-2105-4d2d-a634-1d5120c8eb43", "value": 22247084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028428, "uuid": "41c18b13-91f3-428e-96aa-e795dab38c2e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028428, "uuid": "79d9a563-e516-4f6e-bd4b-cc1df63f4387", "value": "msi (6).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf79bda-138d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744015696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015696, "uuid": "87d424a0-9b39-4b8f-a43f-ca0ad71b8f0a", "comment": "Malware payload (Prometei)", "value": "e506a9ce3c9a4568aa1791a089e66aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015696, "uuid": "27c06f97-1180-481f-85b3-c9a5132539b0", "comment": "Malware payload (Prometei)", "value": "56eeca6d4f7a4848f22e651a90f6f6509d646cdce480a73307bf288f80b8602f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015696, "uuid": "539d3df3-c22e-4cd7-a345-cd5365995428", "comment": "Malware payload (Prometei)", "value": "04093e1c54e5f04dd1bbde735c18d3a5ce7beca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015696, "uuid": "945c5b8e-91b0-47a5-b639-9fca7ce4182f", "comment": "Malware payload (Prometei)", "value": "740cccdcdd89535b1f2c5476e842e675195c00f1269cdeb377fa70c480eb2fe757610b34e676c7a327aab87a46721f05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015696, "uuid": "738988a3-c28f-4e79-a664-4fdbccf46833", "value": "T1FE155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015696, "uuid": "6d9dbd6c-ad94-4481-88c5-b7eea28bb50b", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplz:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015696, "uuid": "a235b325-bcda-41cd-a640-7216ea88641a", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015696, "uuid": "1eb47597-f62a-4815-b5d9-6d11912af076", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015696, "uuid": "3f5afa9d-c06f-47ea-a62c-1dc601505c75", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebca4f4-134f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743989232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989232, "uuid": "f3767cf2-6c67-409c-ad30-0fa8059a63fe", "comment": "Malware payload (Prometei)", "value": "3a203c6c86c3fb8db7c2374030971371", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989232, "uuid": "dbea306c-2430-4a5e-8669-af2fd1095f06", "comment": "Malware payload (Prometei)", "value": "572f0b61529a37bfdc376b48ef7e3511868d180653ff555166b97b14e32a8df7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989232, "uuid": "30d757c4-b967-4984-b640-56d471b2b1a5", "comment": "Malware payload (Prometei)", "value": "0874cedffa1ee602df65cbbc29562237f72a7347", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989232, "uuid": "8e2840a3-d028-4dc8-965b-a10d7f7a201d", "comment": "Malware payload (Prometei)", "value": "97866fce877e522b8872c4648a0d0bd2ae02462599fcbb74e1617570b4810461b80c7cc11aeb6721a63324688f6bebc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989232, "uuid": "7d6be657-66b9-4baa-add6-bd842eeb3d60", "value": "T1D89423F8C87D2E3098169B3CBB1A826CF0A15772D9562F7AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989232, "uuid": "33be97d2-6884-4491-91ea-2c517b4843f9", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg3x:25WOSACZSV6eKRH5EPiamb4DsDwwcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743989232, "uuid": "7842ce25-b781-4c76-926b-a3baeb16c15f", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743989232, "uuid": "d77970bb-b786-4e8c-b875-dea208685db4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989232, "uuid": "be7db943-162c-4068-8f52-ecda9da46f33", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9e6cdf-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1744015401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015401, "uuid": "a9b94c7d-dc8d-4c5b-8921-290de48e89c8", "comment": "Malware payload (Gafgyt)", "value": "c9594958934d290d6a200feb6f79e0a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015401, "uuid": "67652620-c5d7-44ee-82f0-92979ab98cd4", "comment": "Malware payload (Gafgyt)", "value": "57c8d032b2a99efc8e18d8f17f98f711d5606c6e02a5f39e311b490a7e170bfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015401, "uuid": "90637302-18d8-46b2-893a-31ae8ebf1b27", "comment": "Malware payload (Gafgyt)", "value": "4d77000407847c2e3e629b26cf5ac03791b1cdf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015401, "uuid": "d6c539da-57c4-4a0b-82e6-96f0996e87e0", "comment": "Malware payload (Gafgyt)", "value": "0f87e1e2603c57e5ab9f25c6cf2f29a3dee958c0ddede89d26331a1b4718a88f24447df7f28bdaef3c8f5b66d829113b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015401, "uuid": "c262682d-15c2-49fe-bbc1-2638b47279f9", "value": "T15EB32901D5518B27C1D2277AFBAF425D37232B68979B33115A24BFF82BC279D1E3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015401, "uuid": "7e626d0d-bd38-4ee2-b451-e0e230fc6a92", "value": "3072:OaKh4ut9WuRg0WyGDa5SMXzfbmNQfPfXv4n:OaKh4uFWyGDobmNQfP/v4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015401, "uuid": "f1da452c-c548-4c23-8a8d-796646102f65", "value": 107843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015401, "uuid": "2ce293cf-d81c-407f-a9af-fdec640e09eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015401, "uuid": "40cf3187-92f4-459d-9836-62c376d0719e", "value": "snype.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bc46b9-13c0-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744037583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037583, "uuid": "c1b85106-566a-4ab0-9dd7-a56458b6422f", "comment": "Malware payload (LummaStealer)", "value": "78bf4917a9a455123e71801dc06540e0", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037583, "uuid": "2fdbd4cf-5d32-466d-806f-4149abcdf2e8", "comment": "Malware payload (LummaStealer)", "value": "57de7d9074a24ceae6c3b748b5f0a049e93d78f27f15c34bb8e02d5b89fe055f", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037583, "uuid": "6ae01f0f-f6b6-4cea-a471-1b6658660c2c", "comment": "Malware payload (LummaStealer)", "value": "f43904650a579e0641f1f63126814e9e45d68e18", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037583, "uuid": "7d68ad03-2d39-4ea6-a1ef-d676b01863c9", "comment": "Malware payload (LummaStealer)", "value": "0972e4c0544fda5f9a2039416cca4945b2ad0d267f3e78a2702a6331bac4178e791812e2e6bae632703cb6d7cc262fdd", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037583, "uuid": "8f15fd9d-fe09-4ab6-baab-5d7e1e59a1b8", "value": "T102A6AF227A81C4B9C2B10271796DB7BE97BDBE600F3151E363883B2D2E705C16E35A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037583, "uuid": "6792a724-617a-4a94-93a6-e2df7060babf", "value": "fed7f0018d82c6d0f11daa2a5f600367", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037583, "uuid": "5b3b24d2-4a3b-450d-be49-ab1d20f0f356", "value": "196608:hKYBzwtvLFGGq9Y+eKDRjzcW2RiNrXtV0IwA0BmY:DwtzFGGq9Y+nDRjzcW3xV0IwAEmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744037583, "uuid": "d976810e-8035-4c48-8368-f28de92dac58", "value": 9728000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744037583, "uuid": "733f5021-af8b-42f6-a0ae-6bd822117809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037583, "uuid": "404d6238-c88b-4b38-9695-101cb0a334af", "value": "Set-up_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55500cd-13bd-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744036676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036676, "uuid": "074ba911-81f2-48d3-99b4-07d8737fe049", "comment": "Malware payload (Prometei)", "value": "188db8d474d7fb66b9bf79fff9f213c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036676, "uuid": "05d3151f-0b33-4669-9a37-c008dbc8ce29", "comment": "Malware payload (Prometei)", "value": "5818884fdaa5e1b7b0452a3b964bea78fd6b8006155d28acb47eb199f39dea76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036676, "uuid": "f88a82fb-e4ab-4cd4-b97f-0ce3cb65cc01", "comment": "Malware payload (Prometei)", "value": "fa74da60a87404783e49d77bc7ba5771826af74b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036676, "uuid": "c882f45b-f3d9-49ad-be29-a06b45fb4d54", "comment": "Malware payload (Prometei)", "value": "2f0a18a5a60734e05d6700b569fc64274f25026150efe8337c37d2dea7e6263f3bd35c67198c59baf4cf490a4b79fb1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036676, "uuid": "0db6fef2-8ba0-4e20-8c4f-7310073a1f57", "value": "T164155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036676, "uuid": "df9491b3-e2a1-40ec-9312-5e84448a06f8", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplQ:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036676, "uuid": "e89d9a9b-79fa-4ee5-a240-b2c332849d79", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036676, "uuid": "ced7ee8a-3341-4e09-b00d-2abe3c7405e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036676, "uuid": "959049f8-d2bc-4fcc-a690-0f3bbe3bd765", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a313aca-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1744015397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015397, "uuid": "9cb62d95-369d-416f-9794-b365736a830d", "comment": "Malware payload (Gafgyt)", "value": "0566ebe426dc34d30c546cd86c172a7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015397, "uuid": "bdfcfce2-0e90-49e6-b015-44f2fd472c67", "comment": "Malware payload (Gafgyt)", "value": "5820051ed89d350596fdc38b4d6dd25bdfac7bc31b3af78450836b539f7d34b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015397, "uuid": "9bfed494-de88-4dac-a19c-de559d8fe4a6", "comment": "Malware payload (Gafgyt)", "value": "52188e1420270a57cd0f2977af23b0b92c640088", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015397, "uuid": "b03f9e42-85e6-4a10-bbf3-ec8dd77f079b", "comment": "Malware payload (Gafgyt)", "value": "2319aa7e9b5edd6f891940e20fb2d22c98d30b38251f1893178d96858b7faebb6c5004c6749543fb43fb44fa1c5887cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015397, "uuid": "a6011dc4-a42b-4041-8292-9ffe18ccef7f", "value": "T1C39329377B230E23C0CA547116F30332A7B5D65938BA5347BA906EAC6F1AAC435177E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015397, "uuid": "471eacd8-24dc-4636-abf0-eb0e1eba6a3c", "value": "1536:QdXkIdNM5hgtpctARWDTrJFcmQ7FhYjDtaeQ4e:nIdN8ecgWrrcmQ7FhY3tab4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015397, "uuid": "b7b86fa0-d029-401e-bd12-f046dc6d5643", "value": 91824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015397, "uuid": "1fc1f647-8d9c-421b-bbb1-a9278a570adb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015397, "uuid": "78608199-c453-4f72-821e-58aac4f2658b", "value": "snype.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5389436-13a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744028005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028005, "uuid": "0cc1a05a-4bae-4d9c-9fc4-dbd74f6f1470", "comment": "Malware payload (GuLoader)", "value": "8b889d5bd26d96b38dae1a58aeb296fa", "object_relation": "md5", "Tag": [ { "name": "fitbabyhotmama-com", "colour": "#B46E70", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028005, "uuid": "9e1d7829-fb9a-4877-8f17-e84b3e08ac05", "comment": "Malware payload (GuLoader)", "value": "58418d0ab74530cc13a36b14a6288916250cdffb664e8cc57293119746993d21", "object_relation": "sha256", "Tag": [ { "name": "fitbabyhotmama-com", "colour": "#B46E70", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028005, "uuid": "71438599-de7d-46a3-8d9c-9635e5d5b44e", "comment": "Malware payload (GuLoader)", "value": "fbafcc56615b6f5650c9e29278a185ccd94773fb", "object_relation": "sha1", "Tag": [ { "name": "fitbabyhotmama-com", "colour": "#B46E70", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028005, "uuid": "f2cc6c83-13f3-4f46-bf20-1c1b71d7ce8d", "comment": "Malware payload (GuLoader)", "value": "545821c5d04bf65ee6aee59cfcf51b98c3851fa8d44fa99abc5944c1997e37de87c42c16e21a913d5dd0000933de17a8", "object_relation": "sha3-384", "Tag": [ { "name": "fitbabyhotmama-com", "colour": "#B46E70", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028005, "uuid": "cffb8fa5-4ae4-49da-bd99-6b26c9e1167b", "value": "T144F26B91FD60066A4D4B23BAEC951B70C5B982160A1700B6FEED734C5406AACF7FE71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028005, "uuid": "de02fb0e-085f-4ac7-8bf9-10da2842d3d0", "value": "768:zeifDm/2ZBfhPM9g2vSJv/FAZTmHoKWQGuiv18mEy3+:NfDPDfhkpSJnaFOoDuW18vy3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028005, "uuid": "2895fc29-a683-42ff-af58-d4f34c347d1e", "value": 34289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028005, "uuid": "1afe1391-d827-4bc5-8d95-fb378f628727", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028005, "uuid": "41b7eb1d-4aa0-4470-9c96-2c3714a10902", "value": "Rendeles nr13252436324563635635464574544545445474.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fe1881-138e-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744016328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016328, "uuid": "eb67496c-33c9-4ac6-aee3-45eef1fbd476", "comment": "Malware payload", "value": "100cd9d907e986ba8d5fc6d0488557d9", "object_relation": "md5", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016328, "uuid": "45aa3b26-aa13-475d-bacb-78155d1fbc77", "comment": "Malware payload", "value": "58b38775f655498b134ce8cd52ab0aba05b710f7611e41cbdffdc3597c5d5f3d", "object_relation": "sha256", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016328, "uuid": "54d384e4-94c4-4ef4-a1f0-8c24268ad63c", "comment": "Malware payload", "value": "ca85284ea6ff1d453eaee43dd2c20f913ba4200c", "object_relation": "sha1", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016328, "uuid": "9815fc1c-ae50-4787-9aa4-4b17c1ac1551", "comment": "Malware payload", "value": "587b6b786f4d18c92984f066c6dd2cb52b7a064394792d612cfb99f8c3c349dc27418629cf7fdefc9e7719c24e71c49e", "object_relation": "sha3-384", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016328, "uuid": "9bbacb2d-7a84-4d5e-baf4-b8f318e63ee9", "value": "T1C1E4233848D4F408E17596B2AB2825A4061F1DD35AF3B0F5CAD7B57282B8F348A15DFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016328, "uuid": "8f4b8cae-ae0c-450a-93de-a654c6cdb9cc", "value": "12288:lwyIleKwf/wl5hbqxd81VxWABJ49GPCCm/ht+Z62+BTwn5sP6ZQxfZ5:lIeShbioVxWABisw+Y2+Bci66Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744016328, "uuid": "a8ae63dc-853d-464e-a069-b7729a214835", "value": 670194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744016328, "uuid": "06777cb4-7560-410c-ad11-8d255e0eb388", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016328, "uuid": "c807d6ce-41be-47ba-b805-0c34b0a45ed5", "value": "100cd9d907e986ba8d5fc6d0488557d9.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abeaf049-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028419, "uuid": "3247bdc0-d0de-4824-a486-c46bc0590d09", "comment": "Malware payload (Arechclient2)", "value": "8496849eda82ac31b355892b6fd86221", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028419, "uuid": "4b14618c-4bae-4f87-b968-fc5253ce1a9a", "comment": "Malware payload (Arechclient2)", "value": "58c7a3273fa1b84cf28226f8b868af3d1a4447ee2e4f0c3dcf4a315061c23b08", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028419, "uuid": "e2afc579-ba17-4def-8187-ce4b3c130d9d", "comment": "Malware payload (Arechclient2)", "value": "bb797b7c49cf6e160affd6e7465251cfc0143ba7", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028419, "uuid": "d4f74463-b542-4432-acc8-a178a669228d", "comment": "Malware payload (Arechclient2)", "value": "b68518835cb07589685389c2ea2bf18ca9ec5a9563f9534cdc3603851c7431fe1d3776a83476f3bc47f15a6f57c466fc", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028419, "uuid": "ea942eb1-2a2d-4e3c-b67f-667ed7f306d7", "value": "T13E278D2137A58621F5DE42358D38AB86823DBC748BF682C7754C69DD28356D27F32B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028419, "uuid": "68d48cf3-747a-467f-b4fc-aa205ff7d6b1", "value": "196608:Eh8QnkCrkuKLCBAIk9a7911FuyuON7NKmiRT5kokS6A4d2mOrGIIX5:jYkC4uK2BP9ZuyuOxNzOko14mGlX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028419, "uuid": "4afea04a-ead8-42b8-98fb-303561e6c2b4", "value": 20845060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028419, "uuid": "3b067217-778c-4962-9966-a934a84f5dba", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028419, "uuid": "3ae203e2-e87e-49dc-b18d-a8552dc511a2", "value": "msi (7).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc82b93c-134e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743988933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988933, "uuid": "f307e94c-0410-4735-bd9b-fbabbb87ffa0", "comment": "Malware payload (Mirai)", "value": "59f4e3382980cf96258dfe51d23041c9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988933, "uuid": "b5b003a9-d5ae-4c95-bb26-ed2655287f7a", "comment": "Malware payload (Mirai)", "value": "591649f539a93cbd660191cb4022f473ea3e836bbc20cf087d7ba95932f40bc5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988933, "uuid": "12faee4c-c9a0-4939-9267-a813c8652c8d", "comment": "Malware payload (Mirai)", "value": "8e13c3588847ba5e52c8051ac06f9562b7a4cb68", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988933, "uuid": "1ce132c0-b3bf-4e0a-8a24-dac07665f4df", "comment": "Malware payload (Mirai)", "value": "5c501a2b947414feea58d7ce792b5e4edb8fae27d8672db56f48dec58e036bf7e78913df96cf7c933b215fdd0c7bb62a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988933, "uuid": "24f63cae-e847-4c31-bead-63fb509ecfff", "value": "T1C8018BDD50705A710748AD1DF623940B5002CDD0F7611E4CEC9C00BD9DF8AA7F126E4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988933, "uuid": "5bf88c6f-aa0e-4ae3-8e1d-69bbcc1b6993", "value": "12:kS3boa+orNIjlTVjo4iKl2XoVoN66of9GmouFG10tDoPmo5hkoX2En:P3V9NIpqKle61+HHIEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743988933, "uuid": "42f50951-27e1-41e2-91cd-136d90cc9c4c", "value": 819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743988933, "uuid": "1a7324ed-e5c3-4093-8d11-7536e1fd1998", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988933, "uuid": "6bd2197b-da86-4679-8321-96b4070272e5", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50452157-13a3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744025259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025259, "uuid": "f1ad3a5b-da8d-430e-9d3b-635bb59dbf6c", "comment": "Malware payload (Prometei)", "value": "de19f1153f58e6c3141e8951aa28221c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025259, "uuid": "4624e1f3-1860-428b-a403-0ed2f78ffacb", "comment": "Malware payload (Prometei)", "value": "597f00165128a115642b3d7b63e044921b1072d1d860bb03822c8cfc71651868", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025259, "uuid": "8c86dbee-ff32-4445-8e59-24a61d089b3e", "comment": "Malware payload (Prometei)", "value": "c814af909cfa4208ae372334240db5a0f9afaaa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025259, "uuid": "39c847dc-4375-4fbe-bece-cb41c5de0c53", "comment": "Malware payload (Prometei)", "value": "8ce27bfa303f44da62d6a613de7b8e8424f13396daa0ffc41f2c68335d17592b85bff1cfdb67b1bbe0481c5dac1d2a03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025259, "uuid": "859804a1-b488-4b71-b211-65d49055773c", "value": "T16F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025259, "uuid": "43035793-950b-4a3d-a88d-31729e4e30a8", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpla:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025259, "uuid": "713efcee-9fd2-4b4c-941c-4b803aaf0a83", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025259, "uuid": "ef6e70d0-7abc-42ed-80a9-c0d496b8f3f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025259, "uuid": "de05f52a-9861-4f46-9269-cc61e4d53484", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3530ca2a-1383-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744011470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011470, "uuid": "7fa1c501-35da-4c1b-bf88-fbdada56b643", "comment": "Malware payload (GuLoader)", "value": "1e2741f2f68609ad56a73fcf592e167e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011470, "uuid": "414fe91e-7abe-4ec7-be5f-f5ebe9f545aa", "comment": "Malware payload (GuLoader)", "value": "59d6b1004c591e6f62bb86d29afa064d1dc7605c5c516afc042e59faf584f7d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011470, "uuid": "edb6d7df-7c5c-4c01-88f4-7c5b68c36f75", "comment": "Malware payload (GuLoader)", "value": "481f7d22ba7546db8915991569bf8072f1f2d3e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011470, "uuid": "bc41c528-d503-49d8-a301-0d6a4622ef99", "comment": "Malware payload (GuLoader)", "value": "7f47434a1ab7cddaaac4441de1af1354201a73c74c9427dd17320c5c8b6e9615fe7f7034a69fff044b4980fd58334bf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011470, "uuid": "ac17a7df-34c3-4e4a-b77a-636136eca01f", "value": "T18EE4229322E2C96FD141A275CDA487FFD60D1CA0C9560A0B5FB07D76BE7A0928B1E342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011470, "uuid": "3f248296-dd9d-47e7-9165-74f1c305661a", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011470, "uuid": "66bbd3df-607c-4e64-9129-2d439161a4f9", "value": "12288:XOQIRQ7v8lpyiaxF6JQiQsoi4inmLiqBHNBmO8J4yW7TPjci1Ghd6BjnhDmCnr9:PEpy/qJQooPDLrHnmQysjcbohDPnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011470, "uuid": "695a5dd4-65ea-4918-9f1e-28a700e473ee", "value": 698219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011470, "uuid": "08033588-a2a3-4cd3-b178-cde814bdfec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011470, "uuid": "540eecb3-45a4-4002-90ea-e0ff8d44d87e", "value": "DHL SHIPPING DELIVERY DOCUMENTS AND INVOICE.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad8679c-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744034511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034511, "uuid": "c123f170-6f97-4a56-8e80-f6f3def13983", "comment": "Malware payload (GuLoader)", "value": "e4cfe387fd3a1423b5718c04e925a239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034511, "uuid": "95fbfa39-2306-4c74-b6e2-8d11ee1fc6da", "comment": "Malware payload (GuLoader)", "value": "5a4715bc3d9f3c70e1c3a6b7703934422c1f36bc49be7f4a321343a9e35123e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034511, "uuid": "55dadf93-742a-4b26-9efd-59365f02b94e", "comment": "Malware payload (GuLoader)", "value": "2b2bc72943c4ef16cfede4299213d8d328d29986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034511, "uuid": "37306e08-a547-4af6-a099-54482fc84914", "comment": "Malware payload (GuLoader)", "value": "5413b3d4b75b55833e6f863d5b46ac2158895cf0edad638fb1d87a41d67a3bb767896ffce2b2602adec0d1a6d52c5cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034511, "uuid": "e2ab5fe9-fc48-47cc-88c4-f39aa51a86ca", "value": "T198D4239A69F2C0E3C3330A30E5752E79ADD6D52203049A3F5755DFBABC70B938A5D142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034511, "uuid": "f95851ef-9d82-4b31-ae8e-b42f18d7733c", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034511, "uuid": "00232c4a-1042-4d2d-aabd-28661bbaa9a2", "value": "12288:QOM1ujoN+17lXujukaSBwYl5sG5mgt1of1D5i+zi4q0R1K0VOYH:fMCEuBSBwYfs+tz21DXi4lO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034511, "uuid": "344d915f-06b6-49db-9489-3e0e2b0a8a3b", "value": 631232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034511, "uuid": "9b68308a-ffac-4165-bd0c-d87de72231dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034511, "uuid": "09711896-ae18-4473-983c-ce3494cd38bc", "value": "5a4715bc3d9f3c70e1c3a6b7703934422c1f36bc49be7f4a321343a9e35123e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eace834-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744015405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015405, "uuid": "c155df30-617c-4d58-b824-089bdd0aa7ca", "comment": "Malware payload (Prometei)", "value": "c59e8151f9d21b0d0adf5f6c1e7cbcfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015405, "uuid": "67753a64-9c58-471e-b17b-6907bf1029a9", "comment": "Malware payload (Prometei)", "value": "5af8ed3949f1506bc9ab95be5137494f9c5d4ae8803d260f986b2efb48670200", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015405, "uuid": "5e1b5cb7-b0f0-4a9c-9dd5-551c3dcc3fa7", "comment": "Malware payload (Prometei)", "value": "4f50d2025337a5397ead6e30df0b9174d480e6a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015405, "uuid": "d7003e10-0a36-479c-a30b-b4905e8a8231", "comment": "Malware payload (Prometei)", "value": "56186713142590322f2bbfb4f3078bb7a6eaba51d5e506f10ffe39b83f34c95d9ccd05142f6db739877f7b556230802f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015405, "uuid": "59650f56-18fe-4c52-9cd8-5599b366515f", "value": "T168155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015405, "uuid": "91ab686a-2ceb-4687-ab7b-07260c690f57", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl8:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015405, "uuid": "77861099-d434-4d4d-827d-0f537509dc20", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015405, "uuid": "742f028e-9731-47ba-8ba1-e76da582dfaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015405, "uuid": "d8c44050-733b-4572-a050-93a7f42bc8cf", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d36701-13bb-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744035496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035496, "uuid": "38149478-40c7-4824-b9d3-794cd0c00ee6", "comment": "Malware payload", "value": "3a384dac264d684cc46d01674a4b3207", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035496, "uuid": "08c5aaf8-0940-4fff-83c5-7affa806f459", "comment": "Malware payload", "value": "5b384675d07686c47440df64ee4f1e4f50737ba1556d070822f139fbd33cf966", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035496, "uuid": "87337ef0-5455-466d-b7c2-58076ee6c27d", "comment": "Malware payload", "value": "ab2075e2a4e0d208e28649da2ceb76b04a765ea7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744035496, "uuid": "d990ba52-5e67-4f51-8ba8-4c875dcff222", "comment": "Malware payload", "value": "c45f45e911a5fbcde06b31ac80eec362638d83ec0ee70fe2f71dfa10adde9df977215652fff94fc3b571bf6212049cc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035496, "uuid": "098011c9-9382-4a6c-935f-a1bcab04d23f", "value": "T1CE373333D6F26AEFE0CB4075F9EB5867B8D070B835238513237FA5DD3A625940AEA411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035496, "uuid": "0b205b32-4251-4aab-abfe-393ccd35c1bf", "value": "393216:ObMmXtMtlXBUUTT/xaTWRcI9YY6FWrSB7m6DMha5aaSOkF9ThKbc63JjZvGi+KD6:ObMm+96oT/539YXwrSM6DhzkPThN2N+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744035496, "uuid": "ad6d40a2-baaf-4930-bbfa-41469251f624", "value": 22675122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744035496, "uuid": "74b24ea9-8ae5-411f-9e05-9254679aa814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744035496, "uuid": "a6da4642-a90c-4673-83d0-656cc4248a5a", "value": "electrum-doge-1.4.2.AppImage", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc20461-13c5-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744039828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039828, "uuid": "6a0bd86e-c604-45db-a72a-bfaa1458faee", "comment": "Malware payload (SnakeKeylogger)", "value": "f391a4eb5405468b227284bbefd3433c", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039828, "uuid": "fd0640b3-fba4-4e23-81c9-27675589a0cc", "comment": "Malware payload (SnakeKeylogger)", "value": "5b844c8187cccf516098fd19ec18d81ea9c764c62dc51ea2455fa4d5186937ca", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039828, "uuid": "363cd1e4-aa65-4e6d-a4b8-182872872c2e", "comment": "Malware payload (SnakeKeylogger)", "value": "232406da1875271565bc4cdd2ed33c68ad5c8ff3", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039828, "uuid": "1cee3573-650e-4f06-8775-81d1da11609c", "comment": "Malware payload (SnakeKeylogger)", "value": "8bdfec7073718695dd206da716d48e5ac52e5f23684228eee725de7e771ec0d22fa949d14f7e2f80580ecfe8b250907f", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039828, "uuid": "6ab2a09c-0087-4b70-a3f5-ad5d30db0ad0", "value": "T1000533A8B0F738B08E945F6A5BF04CED839EDB596058D4B33E5B63E4D18532A18B4433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039828, "uuid": "036d7118-996e-4c43-ae21-234462d1815b", "value": "24576:5hTjgCEPiCgoFtJPBjfeRcwcZJPyGpBBDKxlv:5dToTgWtJacZJKtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744039828, "uuid": "d5572cfa-a38c-49aa-b71f-8035a824922d", "value": 842296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744039828, "uuid": "b6b48f55-4461-4fda-a0fa-ea13a3b06055", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039828, "uuid": "87d59d88-b02e-4e05-98c3-bdb604369371", "value": "nPO_No__25000284.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875be932-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028358, "uuid": "62abb2c2-a587-4109-9881-7a26ecdaf829", "comment": "Malware payload (Arechclient2)", "value": "09804110df4d9f06896591d67851188e", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028358, "uuid": "9dc35c10-9324-40f8-8a30-28d6e9ccace3", "comment": "Malware payload (Arechclient2)", "value": "5b8982176cb4e178640c898395283e2c48a9be4ab21b245c1db2b4a16c2d7306", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028358, "uuid": "aa3d436f-45be-41d4-959c-27f480b45726", "comment": "Malware payload (Arechclient2)", "value": "9d286ec6c7a2395dd70b3b5b989ee416be151b52", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028358, "uuid": "e92bc1c2-253c-4ce2-9f0a-d19fcbf47a17", "comment": "Malware payload (Arechclient2)", "value": "cb57c294d932586cbe76f78eb46e2d8d66bad1c811246a92f188ac136767c29c0d4c41e104bf097446a794abad4fe1c0", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028358, "uuid": "fbacb30a-4b5b-43ab-a7a4-85aad36bd613", "value": "T16AE69E13B28C943BE09E163A58769BC1683FEAB1A7624C9777D4198CCF37580663D34B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028358, "uuid": "31949e4a-3bf4-4f99-9382-0a8e5358dea5", "value": "196608:hX4d1MkqnGnWhoreQOhWZ2zH4/sGxgsnfhYnkS6K4vIw2Hi4Xz:VdhoreQOws4lxgJnX4IjXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028358, "uuid": "bdc442b9-ccf9-4345-a208-663f1699c39b", "value": 14755276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028358, "uuid": "217f60d6-5e4e-4d6e-93d8-cea85de3e80d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028358, "uuid": "158b2e6c-5e3a-4851-99c5-32e8bf8090cf", "value": "ZWXYSMLY.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7061117-139d-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1744022881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022881, "uuid": "8635e3b1-74f3-47a7-b15e-28786ffa37c3", "comment": "Malware payload (RemcosRAT)", "value": "8e13d536db884141396b72340b97860a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022881, "uuid": "676a1468-54b7-4994-b6e9-9c3d78a1db91", "comment": "Malware payload (RemcosRAT)", "value": "5b9a611f5ca531f0794cf9601360e1414c72079689ce107c2ebf4c5bb6fc5f8d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022881, "uuid": "5f524593-8fb8-40b0-a632-1e5cc82fd204", "comment": "Malware payload (RemcosRAT)", "value": "33fb84a1518915b113aaec9506122d76f80b6108", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022881, "uuid": "cb0a5c76-195b-422b-810e-5d544f5c4283", "comment": "Malware payload (RemcosRAT)", "value": "c1099ad74885d2997e2eaa1f826872ee2f2f7eb9cb9766e6ae9562e7f0da095a8eeb5f383136882909c9f2945116a080", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022881, "uuid": "a1a2e6dc-c3ff-4c5c-9244-4ccbe24d1947", "value": "T11231C7537790FDAC0DD0662CD14B806A40C1C9D7706A176FEB8426D0AF2F717C02A1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022881, "uuid": "49f24d00-9930-4de6-8b3d-fcf37f007139", "value": "24:ipfzptxjFChJAA2p/yzz2p5/A7hO7h7hzqpzuzPrpPrupupkx8qHK:inpX94I9QY6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022881, "uuid": "48044420-8b05-4cd2-8c1f-950504b8a6ad", "value": 1557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022881, "uuid": "2c752c7f-fe71-4ee0-a364-7ae0b15c9b07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022881, "uuid": "092c94ca-b574-4a3e-8fbe-18aae9015faf", "value": "PURCHASE ORDER - PI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf01e7dc-1381-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744010869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010869, "uuid": "36411281-fe68-4097-ae15-8ffb18b73861", "comment": "Malware payload (Mirai)", "value": "0bedf177e374873bc8eb78a29d8a98db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010869, "uuid": "bd53b0f8-9435-473b-9927-1e883856ee62", "comment": "Malware payload (Mirai)", "value": "5ba1d8bff4b0014b3544f017e13745a9ad69360eaf673e70f946a98881680e57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010869, "uuid": "010eb39a-f502-473d-9bf5-701a8b9b6cf3", "comment": "Malware payload (Mirai)", "value": "a36b508fbb4071e55dccda905330725fe1c69ed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010869, "uuid": "0a7b4203-4dfc-4eab-afbc-de3291a48054", "comment": "Malware payload (Mirai)", "value": "7427bd618a651ffbf182a7b1f4d5eda427893b5f16773ce85195998e8caeea9aeb581fe994d65359b43f13a5604f312f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010869, "uuid": "fdacef85-96f0-447b-aa77-f03cd787517e", "value": "T18DE329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010869, "uuid": "c06e83f1-a195-4262-8bcd-5e8317177628", "value": "3072:KmPTDH86Jn78rCdV5jAti2id2ow9+aVvjbitLLxGyMYEzj:KWTDH86J5fjAtiHde9+3L4yMPzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744010869, "uuid": "fc5edf99-29e9-4f53-a811-dccc70e6e316", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744010869, "uuid": "dc49d687-d9db-411d-a5dc-950c706d1508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010869, "uuid": "029382da-e74e-43d4-8ab9-a4f16efe4ebf", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d19f995-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744038461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038461, "uuid": "e71db0a5-4a1a-4654-8dd6-b229d9411c97", "comment": "Malware payload (Prometei)", "value": "b1da76dd2124025185d651dccd2289c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038461, "uuid": "7e2949d6-9bd8-41fb-aba2-6631efb84178", "comment": "Malware payload (Prometei)", "value": "5c1830f276265c51f8a12d0d36783564e0465892f4f47bb499d226fb9ddff3f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038461, "uuid": "8036735b-2091-45a7-a822-816f9989e203", "comment": "Malware payload (Prometei)", "value": "0fb29b75978572a557bcf6f0c7dd531e7171ad8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038461, "uuid": "cb64f4d6-ea11-4aed-9c36-6daa416797f3", "comment": "Malware payload (Prometei)", "value": "16dabf6870bba7cfb4d73851caa190bb549e643706e6265a2175aa068fea5acc4ba60338dcc1014726c2fe2bc66e04c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038461, "uuid": "73d016be-34fb-47b4-a0b1-d0198161089c", "value": "T155155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038461, "uuid": "f161d2db-4d38-4889-8da8-f05eba885867", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl9:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038461, "uuid": "826c3948-3187-4ba3-8192-606de4a6cb7b", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038461, "uuid": "c7a6d7f8-5b78-4bb5-9a42-fa34d84ccca7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038461, "uuid": "ca79d9ae-2c37-4ad1-90c1-31bec137390a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c77c38c-1383-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744011482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011482, "uuid": "445a948b-9247-46ea-9ad9-ecd7f341ec1a", "comment": "Malware payload (Formbook)", "value": "72e686a10a6f739fff08a87380597d56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011482, "uuid": "10b1cc3d-efd5-49cb-bbc1-bbdd5205c67f", "comment": "Malware payload (Formbook)", "value": "5c99ba84aa086ec9c96a63dc11bcb36c74c176580b72b5b02278b8744462ed63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011482, "uuid": "84f5e117-326e-49f9-8b39-4d65a020c529", "comment": "Malware payload (Formbook)", "value": "8e1cd8b6511cbf31ec4fe6f972c1f130fc83af4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011482, "uuid": "2a254b0c-29e1-4020-99f5-1642b847dda8", "comment": "Malware payload (Formbook)", "value": "09845793197f195970dca00c5db046b7087467c13a84a290b9f8fbcd3766e934bcc51a7b34b9d9c9c27c70b42103cbbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011482, "uuid": "e329a509-7ffc-4c93-9a1a-131d6e8b4284", "value": "T15545CF22B3DDC360CB669173BF29B7016EBF7C614630B85B2F980D7DA950161262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011482, "uuid": "ffce619c-64c8-470a-925c-d2fcc9639187", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011482, "uuid": "6f310e04-ccfd-4b21-bde0-be7417c26cf8", "value": "24576:Zu6J33O0c+JY5UZ+XC0kGso6FaqVk1w5qB7WRkFY9OWY:bu0c++OCvkGs9FaqVk1w5qdWRkUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011482, "uuid": "5af2a41b-888c-4b79-b583-49265bcb0909", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011482, "uuid": "0fd90eaf-6c76-4f12-8bc5-c17f29769b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011482, "uuid": "8efa1f58-73fa-49c8-9b40-872d73b72058", "value": "proforma invoice & packing list NDY1264 20250324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1671dd-13af-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744030592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030592, "uuid": "46e6f663-b66c-42fa-8f7e-e54680ffc680", "comment": "Malware payload", "value": "0173db852a8535873dbf5d0d61f01919", "object_relation": "md5", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030592, "uuid": "f78db511-550f-4222-8ce4-78d8ed97b178", "comment": "Malware payload", "value": "5cd76e5dbcc1bbb7f61cd74fcaeb2a956e52847938e1b460d3ca6d016d00fe3e", "object_relation": "sha256", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030592, "uuid": "c629b6b0-8231-4445-aed9-efc1d19f7ec1", "comment": "Malware payload", "value": "a68a9ba07b399050028a8499740a87101a51e6b3", "object_relation": "sha1", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030592, "uuid": "b1e3b23f-4fc7-462f-a458-dabf6ca94be7", "comment": "Malware payload", "value": "831ebfd7f23a4fa8ab7faaa46233c798d07a546e2b712fbc0a513fef27a6570118c8189bbed2f48b8f0acaa6b7508771", "object_relation": "sha3-384", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030592, "uuid": "f9a993cd-589a-4f7b-a076-f894c20226d2", "value": "T18635F74C34C2E8CD6A623D75247B9085A23292A6F4479ED9F0DDECF21AF44641937F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030592, "uuid": "fedfb566-aca1-4ed5-a734-ab4dc56943f4", "value": "6144:Wb6NJhIrDjyeLyXyberDq91ItXMIX+CdppUyM4JMRUdt0FjyD0EjpQahloWbGhIt:5DUiZDWiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744030592, "uuid": "a5abde8e-7853-4789-b8cb-6487fe54f0b8", "value": 1094190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744030592, "uuid": "d66d3f59-26ab-4a21-b01f-1a3beab08e12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030592, "uuid": "49e98281-6856-411f-bda4-6bf2d1896001", "value": "Chrome 134.0.6999.43910 (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf10ff4-1399-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744021143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021143, "uuid": "ad507021-61c2-4175-98d4-d1efde29703c", "comment": "Malware payload", "value": "56bcbab3e92755af7f10225d989cceee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021143, "uuid": "9e1ae138-2474-4e74-8f90-697231720917", "comment": "Malware payload", "value": "5cf10ade542d690aa0866aaa6e731c125a04a1b79b0b3dd25f4856f24a07167b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021143, "uuid": "e8cff288-49cd-42c9-9062-642815144b92", "comment": "Malware payload", "value": "1859015ecbf9db87a5407336a342d6155243e221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021143, "uuid": "6514171b-1e29-4912-98c7-ee9c907ab4bc", "comment": "Malware payload", "value": "d324606980a0729ba280a1750a1b18bf274f6c54a50cdd026776e9696f71e6025e690f91f5f0e75f6f6d265a03f5d7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021143, "uuid": "2ce2eb84-48d3-4285-a1c7-d27e82b91ce4", "value": "T12DA5230A726840F1E223C17DCE928646EBB674950721D3DB13748BBB6F17BE0596B723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021143, "uuid": "1d68357c-0e16-4335-999e-bd7cf44ace8e", "value": "08fd62a9d05cc8111782017958ea975d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021143, "uuid": "3d47dec3-2537-4616-9a88-ab1beebaa17d", "value": "49152:Il4h9FVSLXF2GoQJ803dbshdkZg9jrQnJO:JzSLV2GL80N8WO9onJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021143, "uuid": "b3ae6edb-f04a-4ce8-97c1-7f31f0c12963", "value": 2135567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021143, "uuid": "c8e5df0a-01f7-4675-99b9-fd67415187be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021143, "uuid": "aa50b155-3c88-4f01-973e-cdf5b8ff652a", "value": "SecuriteInfo.com.W32.PossibleThreat.7376.3205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fff3ac9-1409-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744069067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069067, "uuid": "12e45f7d-cff2-4cd6-a991-e3d9981570f9", "comment": "Malware payload (Prometei)", "value": "716523f1d9e9da269936d372011c654a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069067, "uuid": "51758a06-c268-466a-9763-c136a97da18f", "comment": "Malware payload (Prometei)", "value": "5f4e221b3a97b32f72a4c6d02810ba9d64b65d0c1c731e24e636f8753c2ac1f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069067, "uuid": "b5d71864-9647-4418-a835-7251037a2931", "comment": "Malware payload (Prometei)", "value": "8f7f21393ee363cd27f86f11b6e0ed889574021a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069067, "uuid": "89950059-8da8-4a95-a415-182f59513030", "comment": "Malware payload (Prometei)", "value": "b0d804828481497dbb09b5c7009ba08b1fdec50ca39c3bded0077fb07fef86be16f327b3f8b83f5f2e1c905467ecfa82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744069067, "uuid": "7061cd74-7d10-49c9-a091-097e39e478f9", "value": "T18E155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744069067, "uuid": "1138b1fd-eac7-44ad-9920-d30d42ddd744", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplG:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744069067, "uuid": "0b4c67c2-4e4e-438f-86a5-7d97551ee85e", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744069067, "uuid": "0902627a-5efd-4215-b149-d712322c49fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744069067, "uuid": "4baf3709-5967-45a1-b090-4c57a8263d86", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb125cd-135d-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743995242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995242, "uuid": "5ee7e39c-b638-4935-a847-e56644a91541", "comment": "Malware payload", "value": "6a539d125281b3041d2bafb4cb12e40f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995242, "uuid": "00053cf7-ddc7-49fe-a180-6c87facb2c59", "comment": "Malware payload", "value": "5f77053b9112f3dcd7c89846f9b6b30e3b935fe4e9427b5d7e7f1f606e62c301", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995242, "uuid": "949e7be4-b6f3-4659-9858-19d9ef26c723", "comment": "Malware payload", "value": "f68033c5b0dd326bca289684a4cd7bbe8d973a3d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995242, "uuid": "1f78c994-c179-47bb-8452-3d8bef4e9396", "comment": "Malware payload", "value": "46bf9cf625c0c4979de1782c4bf780b752611b8aa6ee60b18b0b0cb77f53aa338ca5a17cd73bbcee1e0c5d32d6339a71", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995242, "uuid": "c1c930fb-abac-40ae-af6b-4b554dae24d3", "value": "T11C2166CA16AA0A3B5DA69AD3326D480E35C4E09A3DC69F4469DE38FB40CCD08704D7D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995242, "uuid": "d55f89e9-3a99-4e13-a66b-8deba86f35ce", "value": "24:vw/tw/iaCUd9Jw/gsw/gCRQsw/pmLAlJw/Rw/JLw/fNIn:vyLaCUdLq2cJ+gLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743995242, "uuid": "b621c59f-1b6f-4f5c-813f-3532385863ac", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743995242, "uuid": "cdd6ca83-4134-4d23-8d49-11b3ca287d12", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995242, "uuid": "5f3bb055-5edf-40fb-b018-b531486d6751", "value": "snype.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046242e3-1363-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743997644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997644, "uuid": "7446d16d-4094-48f1-be69-08ca9bccdb6f", "comment": "Malware payload (Mirai)", "value": "97f0283dcd701cd90f12472a2466ef31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997644, "uuid": "2f09707b-26e6-423c-b5c8-e1a3012d0567", "comment": "Malware payload (Mirai)", "value": "600b259fb9673227500015601652856e13f51c44354a27a993e45bf318b840a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997644, "uuid": "27ee8ef2-51fa-409b-a88b-c43b4143b5cf", "comment": "Malware payload (Mirai)", "value": "8adabe90ab04f6b95f90381ac56b69665ee25f17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997644, "uuid": "d33aa44c-5d2e-4fa3-ae23-bfded7571793", "comment": "Malware payload (Mirai)", "value": "4c1b8837b1b17a01184bbba5197e1a6cacc3fad0e7552d0f8ec4f524b41cb82e6d2104c6572d1dbd457bb3cb4b868c79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997644, "uuid": "b413bb41-8509-4fa8-b407-4948dfb92b6b", "value": "T119B2D0857D8265B19FBC2D38DD7EC6C277D94E3C92FB766D312080684DC141B1ABC289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997644, "uuid": "a5c52f22-8d8d-4c08-ba0e-d57e7c063887", "value": "384:JFHc9VD3CvlzIt7t6cJahFjz/AbPKlUY7kXKW9jvg9rh2mIqXI8BTAhymdGUop54:JqP7UkH6rv2WHW9jYthX1BTAs3UozLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743997644, "uuid": "70e84640-4a2f-48dc-8565-338f18e14460", "value": 24516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743997644, "uuid": "ce8de413-eb0e-4ea8-b4e3-1751fc0810f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997644, "uuid": "b40c22ce-6505-4fe0-96f6-7a4183da4ec7", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa12b43-1360-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743996742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996742, "uuid": "ecaa1bfa-636b-45ad-a717-0d0bd4b324b9", "comment": "Malware payload (Prometei)", "value": "8a4e9287be6cdd63fff490a9b192581d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996742, "uuid": "b6e53184-d9e7-4aae-82ab-9faf93b998c2", "comment": "Malware payload (Prometei)", "value": "601d3c0a3cbc9163c0806d746a98c07f8ea818465489de95d4db2a6fdefc10e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996742, "uuid": "50aad1da-d5af-4288-98f2-6b8ef2c38424", "comment": "Malware payload (Prometei)", "value": "afd3e0cf46f27707b7161a25f65b458ce78db522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996742, "uuid": "b19a5f54-f3ad-479c-bf60-755ab58adaad", "comment": "Malware payload (Prometei)", "value": "c526b48ddb0e9e3f7bd2fcb0ed30b2225026491ef49c8c2eb49e72a0defaedd8bb2b4e10659ee5f5902731778c0b0e7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996742, "uuid": "dc7db07f-4ee4-4915-ba8f-33c7d8689c20", "value": "T1719423F8C83D2E3098169F3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996742, "uuid": "530eb53a-4bd6-4ebe-b139-fa981b785e87", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg0:25WOSACZSV6eKRH5EPiamb4DsDwwck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743996742, "uuid": "7cd8d3df-347a-4b2a-8051-5816d1242f99", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743996742, "uuid": "32d7afa5-2f70-4f72-aeb8-ecdd33d7d70a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996742, "uuid": "3eba0f17-ecf6-4bc6-9d9f-6bc3152461ec", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece72415-1383-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744011778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011778, "uuid": "ca84bfc5-f1db-4bc8-82bd-53a90d21e416", "comment": "Malware payload (Mirai)", "value": "3c73dc041ae5633fdc34d1eb5d736b40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011778, "uuid": "162cb0b2-bc1d-4ee6-8c10-7e5c60ce008f", "comment": "Malware payload (Mirai)", "value": "60d2653f35f7d9fd099efa844910e3dd97aa6a0f706aa3d00cd2c7cf3f6af255", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011778, "uuid": "f7e27623-7099-4b23-99ee-ae34675e1381", "comment": "Malware payload (Mirai)", "value": "820eefc6f2bd8b0673b964471891743086897bf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011778, "uuid": "5c2de50f-a3e4-41c3-9433-62586ec8c4e9", "comment": "Malware payload (Mirai)", "value": "41922fd56018f3fecc5c500f29736266186239cd1ce20d6aa09443391fb7cced4731a61f537a16fa0b8540c76b010154", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011778, "uuid": "6869feb9-a049-4682-8b07-b2fb5accf6c2", "value": "T1C0937CC0F683C4F6E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011778, "uuid": "d62b33a6-00a6-493d-96f7-c5669c03a971", "value": "1536:W/QCZaxGdvts3i5BPhoeIxPu++ALtgUIKqI4FrS4LS7:WYCZa8dvm3oBPhTIxP5htSKfUmD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011778, "uuid": "6dac99e3-bb57-4510-8ce8-c26c2ca0ded9", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011778, "uuid": "0ce73c76-8da3-4d86-a0fc-90fbd4c87022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011778, "uuid": "a6a0403c-ed53-46a4-854d-7e7c71363a4d", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132a6b46-13a5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Spora)", "timestamp": 1744026016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026016, "uuid": "6ffa5465-24be-4226-bd4a-cf903c6e1725", "comment": "Malware payload (Spora)", "value": "289273c3e49379642c6c6e13ee60d2cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spora", "colour": "#75969C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026016, "uuid": "77038270-5f49-46d6-a87e-d573cdf0a9dd", "comment": "Malware payload (Spora)", "value": "61127e59a07d048c40097f88d0a7341665693e6650fee73b402c36004926fd2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spora", "colour": "#75969C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026016, "uuid": "dc38365d-aa21-4bac-9e39-d507668a2c5a", "comment": "Malware payload (Spora)", "value": "fe4877b8771d02f93e3939d2cf88ff326531c093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spora", "colour": "#75969C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026016, "uuid": "444bedd6-f1b8-4fa3-b5a1-59127c47c46f", "comment": "Malware payload (Spora)", "value": "f95c12202160fe9f521ad4cfcb00bee7c729c7bb61254e22a25d120713c9eae6aa56490fd0036c324f8b72a43ae20071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spora", "colour": "#75969C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026016, "uuid": "43891291-a19b-4beb-b615-3506ebbc5b53", "value": "T1C545BE307642C132D56191F05E7CEB9A90ACBD344F758ACBB3D85B2E4A311D25E3AE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026016, "uuid": "2365f712-878a-42a3-9993-d558f0e915ed", "value": "f527e8080fac9432953c548a4f7317af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026016, "uuid": "38ae4307-3e7f-444a-96ab-24b100bafadf", "value": "24576:f/vcajY/O9f3DOKxlJ+wzo1e3leYmeYlpkxvYNx8T6z8BvQHBpe/d/GW:Ua8/43DOKrk1smeYleYW6uvMBpe/lGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026016, "uuid": "e1006d82-9c5e-4e3a-bb25-aa2affbc21e2", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026016, "uuid": "998cd5f3-58ff-4b5f-a29f-32c64db981a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026016, "uuid": "2d07baa2-51c6-46e3-a667-dd1448636152", "value": "61127e59a07d048c40097f88d0a7341665693e6650fee73b402c36004926fd2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dc271c-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1744024114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024114, "uuid": "b5e45509-7f07-46cf-86bb-8bca9e44bcd4", "comment": "Malware payload (XWorm)", "value": "84fcbda8bee9c621c5b5d83cba29b1a7", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024114, "uuid": "9c9dc696-a379-4eb2-8fab-703183d37fb4", "comment": "Malware payload (XWorm)", "value": "617f7b16421567433595f3bc7409f984d1513a996a36953a45662d4e8959313c", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024114, "uuid": "024e5cb5-8d5c-49a1-8381-4ff3a3b32de2", "comment": "Malware payload (XWorm)", "value": "9e935f660d150b50378fe7beb0b7cf17dde7779b", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024114, "uuid": "f5082f37-90ec-4db9-b68a-4ce14a9fe3cf", "comment": "Malware payload (XWorm)", "value": "4b547ba308ef70e781560fac3b825caef5e5d188b7816681ec388702c7c59b75ebd08b353159cfcb44412c0559aecc36", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024114, "uuid": "20f9af36-6c7f-4246-9051-5ae21d892780", "value": "T19963B1313402BDF5623EDD84E21428B1FC55351F56A68E7CBA8388781FB64E09AFD9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024114, "uuid": "21531f6d-3886-4817-a602-b72f0e4a9f37", "value": "768:FZDi6H5262elERh23pVmXCdroULqEJ/nb4crRsILJlLvdcT6yKEcY21GApp1lCTt:F35P27RyBoUrJ/72ciKEcBkAp/lCB60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024114, "uuid": "c8ac3add-f0fc-4858-abba-bf0ca84a50c2", "value": 67427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024114, "uuid": "46b57896-0351-4b9f-b028-fbd56e785785", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024114, "uuid": "af6354b4-1dea-4922-843d-956d45096bef", "value": "83.147.240.230 (6).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efa669d-13bd-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744036558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036558, "uuid": "8db462eb-78bf-4b2b-bc42-7b941772ff64", "comment": "Malware payload (LummaStealer)", "value": "fdad0110836bb23f4054825d6bc7d11e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3344", "colour": "#D68F71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036558, "uuid": "167db549-a66b-48c0-9038-cfb2b4ba0be0", "comment": "Malware payload (LummaStealer)", "value": "630f5108597fd73890f659615b7940b590d22106d6361825945b3c684e5cfec0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3344", "colour": "#D68F71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036558, "uuid": "f7c63a35-7e64-4c69-bf64-50dfdd065102", "comment": "Malware payload (LummaStealer)", "value": "088e96f21217f13a54a59e6e9d14214cb1949c2a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3344", "colour": "#D68F71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036558, "uuid": "93b76582-b6d9-4c03-b074-db9c3e972f38", "comment": "Malware payload (LummaStealer)", "value": "de9c7a25517de380eaf5834465731e6451bd5b6991b36e125c6bacc0ef1472824c65210b71edbf6445277d38f0f0a66c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3344", "colour": "#D68F71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036558, "uuid": "a5c438f8-fa62-4af8-b8b8-3ec6c45902c5", "value": "T15D953350EDF95EA4601A77150DC1F7069B22920D0C8AEB0EE4CBF103DA67FBD5AA3647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036558, "uuid": "a2880345-7e06-435b-9442-24efac86c7bd", "value": "24576:IRXZcBtLsaM2YKAk7DCdShhf/8B8IbhtbEOnVpQWjKWwi7z8vpWcR9IQfUJ5fG1c:IJ6i2ckG2/8iIkOnr74vpx9fbIAS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036558, "uuid": "cab66bcf-fbe6-41a5-a67a-743a61d380ec", "value": 1892577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036558, "uuid": "588d35e0-1f5c-460c-9d3e-a3815496be12", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036558, "uuid": "71ae787a-f0b6-4e29-90d2-14f4af6bccd3", "value": "@``FiLe_SeUp-3344_P@SsC0De$$.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c37bb5b-13dd-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744050297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050297, "uuid": "fca96cbd-671b-403a-9693-db5b9e91b33b", "comment": "Malware payload", "value": "d505bf12cc3faa562c9faa32d4deeb03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050297, "uuid": "343bc060-d580-4081-85c7-937fd5060a92", "comment": "Malware payload", "value": "63dd95de6834cc79ee57ce8060b624d6b3baa6456330e7b5c3634e866764277c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050297, "uuid": "c72be77f-0117-4216-a1e7-23e032846af0", "comment": "Malware payload", "value": "41b00141be1baf9761f82713ee835d4ee1d13581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050297, "uuid": "0dd2395d-0857-4054-81dc-cf8fd724081a", "comment": "Malware payload", "value": "b1cec8971bec1b353c633552a4cee7a50e8920e5a000bc9a74800d7bee7785d867ed34fa4848e6e58e5d96b2cdec3113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050297, "uuid": "09d4b39b-7a37-4552-8697-4214c7b86519", "value": "T132733AD9B358C00BDCA6F2FD64739A482B785D22EC19DE457ED075E909B1ACC6C03E86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050297, "uuid": "2fac63e1-99e0-4791-a37f-3c74b2520f62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050297, "uuid": "17487c47-77f2-4060-ac25-14f4863e9eb1", "value": "768:YoXJJErb8Lz0YLxvVbTitqbQASN9J03IpoXWsRPMI/qywdYHiwJamu:zXJJErCv1TiAbbSrJ/pEWsRrrqKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050297, "uuid": "4003c894-6bec-4822-976c-6d83dc67fa5d", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050297, "uuid": "ef8f32cf-61aa-4106-82c6-c63cf2c90393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050297, "uuid": "b2a22a90-724e-48ab-9b3d-1206758deea8", "value": "d505bf12cc3faa562c9faa32d4deeb03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51e49fe-1344-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743984733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984733, "uuid": "fb44062f-29c8-43ef-96de-38d698c391b9", "comment": "Malware payload (SSHdKit)", "value": "d9cd4bcf8d96a2cbf2a352803f9515ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984733, "uuid": "ce3a7c6f-403e-449b-bb87-1a4dbdfbb43d", "comment": "Malware payload (SSHdKit)", "value": "63e47f3cffc0686ed7637f6f1740234daa1b9eb8385a74985e9bd494650ba622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984733, "uuid": "9ac97cfa-5bad-4f9d-b792-7381d0c6bf14", "comment": "Malware payload (SSHdKit)", "value": "c799f8bf8522c45a4479e088f42b29d038f76a73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984733, "uuid": "3f1597ec-c74e-4e53-9641-f39039e38556", "comment": "Malware payload (SSHdKit)", "value": "1580fe1660a28601edf5cd341547efd79bf7c88c10d9a7408b64015b68cc90f10f1f7cd74d34b0164c8a66d711788cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984733, "uuid": "9095e423-d72b-4a9c-aded-a0ebf2b6d6b8", "value": "T1CB356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984733, "uuid": "d85a5188-1130-49c4-b6bc-1a12ee91c4f4", "value": "12288:E8dASOYR1CAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbb0O38+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743984733, "uuid": "5f1cc017-2f90-48fe-a563-cfec55ae464c", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743984733, "uuid": "11e9ae0b-0286-4178-82ad-cd25ff3cb8e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984733, "uuid": "16f60f87-9a40-471a-9ba9-d271c66aa70e", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cce23b7-139d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744022569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022569, "uuid": "32da38cb-b8b3-4c7c-8e78-48b337fc8f62", "comment": "Malware payload (Mirai)", "value": "7a9f026f25e7b00a22983bf44afb634b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022569, "uuid": "af562151-4cf6-4c77-a305-2f882ece3ff5", "comment": "Malware payload (Mirai)", "value": "645e2bcbde97789c6ae98de91ec37bd227f06ab2523f486af3dda75eefa908e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022569, "uuid": "787d357a-151c-41a1-bf60-527da4b9a7d9", "comment": "Malware payload (Mirai)", "value": "a2bc34b86936697886f5cd0e9834488838ed2249", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022569, "uuid": "faa3dbff-2b53-4ed3-a397-e8f532a50a37", "comment": "Malware payload (Mirai)", "value": "30643bbb2ea75d5d25772a31e8ec49a14ec721a2efd225cfa42df581943786b4b3bc3a09222172e6e30fe8db4ba97e8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022569, "uuid": "f6cee24f-7c97-4e1d-85cd-b4e8d55c99b0", "value": "T11FF2E1B64735348AC57ABF320D3E0FE6336D4EA0118A3F0719C5D9E6410A6667943FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022569, "uuid": "1ecd0428-1958-4764-bb6d-9d2742e10199", "value": "768:YLXQRTBosYMr3OLv14UsKchQj0JjvS2nxMdwDMOr6:YLXQRT1YMbOL15chQqS2xMQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022569, "uuid": "e761a975-6543-4d94-b3fd-28c13d18d0c9", "value": 34872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022569, "uuid": "c3da4e2e-4ff3-44d9-b108-cadc635faf9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022569, "uuid": "97ec8c0c-964e-47c2-b4ac-fad9a63b0012", "value": "hanoi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e0fcdc-13ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744043755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043755, "uuid": "07d346e9-7d06-47d5-8a26-3faf3a806800", "comment": "Malware payload", "value": "15ec2e48f2e763f6d7571e5a46e7a1ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043755, "uuid": "26fbf365-0b50-4b36-a653-c6df3b938d0d", "comment": "Malware payload", "value": "649ab34fd2519b87e84db1b59473880bdfed35b28be1fe408bb48bb8f1ad9cc0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043755, "uuid": "45cf1a67-1552-4043-837a-0e3b80d9fda9", "comment": "Malware payload", "value": "ba381e99127f60fd7ae9d1eb17f3ec13a321fe45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043755, "uuid": "fd8400d5-8e18-47fd-9491-5bdf8a28d835", "comment": "Malware payload", "value": "6054a2d72f9a463b63564c0104f1cf114b17601f50d58c72db789692692af98e24059faf41cc223075b019fe3fd7c081", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043755, "uuid": "3802fc3e-fbee-430f-abf3-92f7adddf0d4", "value": "T19616CF15A3D501B5E537DA74CAA28233D6B0B9CA6731C10F0A59E6052FB3EA04B7F736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043755, "uuid": "f41c167b-9ae0-4532-8fcc-30a376876a49", "value": "9c7b4845b7ecdc60d574a567d19c065a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043755, "uuid": "5d34884c-8115-4bda-9e15-cc9727e01c08", "value": "49152:v01uAb9Pn23PQQDfOqiOh/qxn3cQnt4s9sk/IRUnzz3tsSl2XpirSVwLOlmAa:v9LfOGZu3zu/Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744043755, "uuid": "f2420e41-b3f4-462d-b35b-50c29620fe96", "value": 4362240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744043755, "uuid": "01b43bad-7270-46a9-a793-6254ccc8cff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043755, "uuid": "64d43c16-1cc9-4863-a88c-ac2742b792f3", "value": "vstdlib_s64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9df3fc8-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1744038777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038777, "uuid": "8f530972-1a19-4dd9-b280-5c9dcedf8c26", "comment": "Malware payload (Socks5Systemz)", "value": "68ea67b7eb37bdef3140890e0acabecf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038777, "uuid": "dec26807-fcbe-42b5-9293-792dd49bf8a6", "comment": "Malware payload (Socks5Systemz)", "value": "65f2d6dbd4f5d91dce122a51a39c8f5a40713d0ad0964edfa1dc9d6587761ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038777, "uuid": "a4748da4-c99f-4a73-a6d1-6f69d0c82444", "comment": "Malware payload (Socks5Systemz)", "value": "a73e9143e77c6bab82e23f4dca3b959e3e83a671", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038777, "uuid": "f27d6b6a-8acd-4093-8f0d-a7639183350f", "comment": "Malware payload (Socks5Systemz)", "value": "daa5a332feb6c8b9b4f2c16425c4a0a4e24532493e8332580bfd54805f3883c597fd7e2507acdc1dc3265a6a6a5f85a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038777, "uuid": "8409fddc-2e57-4c3b-a630-e877a30f3ada", "value": "T119D7BE11FBE5C1F6E15E0E308DE56AB196A1BD280E2084BF37943E0D3B76E809779716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038777, "uuid": "c69fd426-5345-4339-bee8-d4574922a2a3", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038777, "uuid": "38cefc48-0f4e-4709-b0f4-dc28c9bd28c1", "value": "393216:iywCAqwUBzBwiwxwGwPewgxwUwswMw8wJwVwtwiwPwxwUwfwOwn8GpFkOA:wczx8omZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038777, "uuid": "d541637c-ac34-4363-84d2-8041b36b0138", "value": 59215584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038777, "uuid": "58df33d1-049a-487e-be10-eafee8a654ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038777, "uuid": "34acc336-c534-46dc-9d85-a078a60bc39f", "value": "KMS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b701766c-13b9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744034880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034880, "uuid": "c4429fb5-1767-4bb5-816e-f98c39e339ef", "comment": "Malware payload (Prometei)", "value": "3256659a30a96a53d247d2c8d843428d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034880, "uuid": "e9e379b8-7fc0-4194-aeed-2a160e132f28", "comment": "Malware payload (Prometei)", "value": "66241ffa0794755e7d31faf33ad8f4afc5836be0a8b56640dd0861110ac07fef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034880, "uuid": "fa9aa2e3-6258-4cb9-a361-e2f0fdacab6e", "comment": "Malware payload (Prometei)", "value": "8aea178a85a5eaf3ed25b38d4549b67dfbebc872", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034880, "uuid": "146a10b3-5952-43fc-88cb-ca0fe238f528", "comment": "Malware payload (Prometei)", "value": "bfca1e73f49de0ba866831c216bd549612688d4d8235217eba18b91d03adcae596b7adbd2dd1867a124ebbab7cf10086", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034880, "uuid": "bb237675-b891-4ceb-a80e-cba1d94b5869", "value": "T15F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034880, "uuid": "ddc88dd7-043d-4d71-8362-cd249d1baa37", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpld:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034880, "uuid": "4838cf34-1d0b-4b16-809a-457497e051e4", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034880, "uuid": "4292f1ad-9367-4eaf-a883-d8a47241e82d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034880, "uuid": "4abe1514-a6cd-42c7-a058-219f177d48bf", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dead5b8c-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034517, "uuid": "de9233eb-2be5-483c-b1b5-73f3328d4569", "comment": "Malware payload (Formbook)", "value": "b4cf264cada6196c526d7fa9be6cae87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034517, "uuid": "2c8a6d46-d10f-4ed6-8da1-47af5e8b4c38", "comment": "Malware payload (Formbook)", "value": "682dc44488e7603fa6080495a7f05a0e54b444f00aa10e1d2fb542cd7be9cd92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034517, "uuid": "0c14e6ed-23e8-4f91-96d3-c79b60b2fcfd", "comment": "Malware payload (Formbook)", "value": "b6fc4007addb291ec66da8dcb7323f2dd89b0285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034517, "uuid": "f022e2a6-0a30-48fc-88c6-8d2b2ace5e9e", "comment": "Malware payload (Formbook)", "value": "2c0ef08360d9e3b12bf6b497e5e0fc10cea52b980b74c6c4b56b82b32a210252eb4cedf865d061bf84ed453dd797d3f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034517, "uuid": "4f54b6ee-ef90-47af-b4d0-7df5a264a857", "value": "T19B45CE2273DDC360CB669173BF6AB7016EBF3C614630B95B2F880D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034517, "uuid": "5ba14990-d7f2-4634-9b82-4f08f8772ebc", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034517, "uuid": "8cd447c9-484c-4171-a65f-5305d2a81884", "value": "24576:ku6J33O0c+JY5UZ+XC0kGso6FaTXPWEMcKTDWY:eu0c++OCvkGs9FaTOlJmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034517, "uuid": "dbf4e3c0-86e3-458f-a075-b69ebe015d3a", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034517, "uuid": "139a89dd-9183-4cc5-888c-6663e5acf51d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034517, "uuid": "f1ee5867-684f-4c52-a8ea-639603ed09ce", "value": "682dc44488e7603fa6080495a7f05a0e54b444f00aa10e1d2fb542cd7be9cd92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba97a35-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744011185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011185, "uuid": "bee5d20b-e2e8-408e-a9a7-f3dc8debd39a", "comment": "Malware payload (Mirai)", "value": "25c9c8efa0fe9e4ec3c735d406bb24da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011185, "uuid": "87e48897-fcc7-427d-af2d-f99bf84fc12d", "comment": "Malware payload (Mirai)", "value": "688975e6cd2b0897e692d40578e0ec3d21c486c151a259aac1d7df17f1844d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011185, "uuid": "daca595f-f01b-467b-9959-0d48061a8923", "comment": "Malware payload (Mirai)", "value": "10c6b06756b127970c0d4adc8feb81af3a2228a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011185, "uuid": "b0c38b13-0104-47c1-bef0-d946d0368cb8", "comment": "Malware payload (Mirai)", "value": "cb15343ab0a16eeb5c659fd150036f0b727dc6a96567047ce4a3de6bfa864612e13fdac46757ec577bf6ce9f53122402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011185, "uuid": "513893e3-ea19-4862-8d53-54d72b9cce8b", "value": "T17ED32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011185, "uuid": "4b6e10c8-b4d2-4584-9e83-258c7ec44795", "value": "1536:9roGHNTAZN0MIBUiCxfytiteQInJ7abwko7lj0JvAhhHr5+5uQfqIcv7C8:n2mUiCx5t26wN7lDhLvm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011185, "uuid": "917d4511-78f8-4209-bc23-02578072259a", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011185, "uuid": "6265dd5d-2ede-4a3e-b316-702aeab95bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011185, "uuid": "15f23cd2-98c6-4af2-8476-35333af35600", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b27062-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028407, "uuid": "9115cf71-0d37-476d-8793-d75da1a1e048", "comment": "Malware payload (Arechclient2)", "value": "3101ecfa0802a37677592a003f4005b1", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028407, "uuid": "8c5474dc-c1bb-4c58-b629-1b69456e1f35", "comment": "Malware payload (Arechclient2)", "value": "69a2b85495bbf5fe03c9fa86e6b7b931f52e986a0ad1885583a4486f2b6d39c3", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028407, "uuid": "e3f2f613-e19d-42e2-81b9-88480648a378", "comment": "Malware payload (Arechclient2)", "value": "cf611230456d70127f7541723af162c6a09d6549", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028407, "uuid": "559a9f9c-b140-4226-b3da-2456a2e9b742", "comment": "Malware payload (Arechclient2)", "value": "62a97e91ac8536cef319d4460aac321246591b89677c75f37fa3f1c5e00e3f8a104fb60890b71adebd09e04ccc575270", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028407, "uuid": "ce0a01e0-46a2-4732-977e-bbec5d2a4641", "value": "T1EF278D2137A58621F5DE42758D38AB86823DBC748BF282C7754C69DD28356D27F32B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028407, "uuid": "0966bfff-d189-4a70-8e22-825b661df303", "value": "196608:R8DQnkCru3ZBggTPCBAIk9a7911FuyuON7NKmiRT5kozS6A4d2mOmGhIXA:kYkCwz+BP9ZuyuOxNzOkos4zG2XA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028407, "uuid": "e68903c3-f26f-4e3d-9f89-bd58d3ae0ea2", "value": 20845060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028407, "uuid": "57a325f6-c590-4a25-85f7-99245af6b8c1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028407, "uuid": "312413ec-fb38-4a52-84e6-1f23dea84e12", "value": "msi (8).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c065c66-1400-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744065222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744065222, "uuid": "a24726ca-574b-4f6e-b176-18674de19e78", "comment": "Malware payload (SnakeKeylogger)", "value": "9c3bf234f1bd219de4229966ebdd22aa", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744065222, "uuid": "b65d90d1-457d-40fb-8c87-40ff93868f6f", "comment": "Malware payload (SnakeKeylogger)", "value": "69b180296b9f03fed922f8b9a693e163dc3944bd1b2a33a44fff83a45023c934", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744065222, "uuid": "60a05817-464c-435b-9bdd-2bf41bdef0bf", "comment": "Malware payload (SnakeKeylogger)", "value": "6128dac8498b96a61ee1d3072cb2b7d2d1b0dcf7", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744065222, "uuid": "df2df02e-ddf6-4c40-b73a-1a22e7418c01", "comment": "Malware payload (SnakeKeylogger)", "value": "74093a08b71eb899183b44302dc9c9613d9bcd5f5adac871e327555372a4350a2a4e0dc30e925ae7f418bcd10e803439", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744065222, "uuid": "f0effead-ef54-4942-9060-99e7a4b37c47", "value": "T131F423816FCC44A11931E6EAD2733A3D75861685C32E6C22F8EA72D8D0738E5F77468C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744065222, "uuid": "a9d1c834-8664-469a-84fc-e6fa24413f71", "value": "12288:y0EY7rCSZbEzh++yU+Zv9Szwl7atQGhX0oacjoABgHatEmAvWhJQDiRnND0m4uc:gHabE9CTZv9Szwl7ayW0AUl6tENU/n58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744065222, "uuid": "a620d531-2be9-4bc4-a8f9-9d9634795bc0", "value": 732823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744065222, "uuid": "57c380ec-ad9f-4bed-981c-0b04d8003ffb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744065222, "uuid": "7c59321b-35ec-48f0-9014-fd619d6f1fca", "value": "SHIPPING DOCS PI, BL, PL, CI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6a50a3-1353-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743991029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743991029, "uuid": "c507ae5a-92bc-4d10-97af-94e72f208696", "comment": "Malware payload (Mirai)", "value": "afa671046d87e3d86698a9c9fc4ba9a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743991029, "uuid": "f7a693b9-6fa1-489a-9cd5-40192b919718", "comment": "Malware payload (Mirai)", "value": "6a663f8fbca9d3fb5000b15609fd673b2f9a45a6119030dfd861e0df7edf8f95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743991029, "uuid": "c8700a31-5be4-48fd-b49b-59febb7ffe6d", "comment": "Malware payload (Mirai)", "value": "940908d54e4380c9b7d5b0cd8a2244a53e22ecf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743991029, "uuid": "6f91bc46-f6e7-45ce-98ac-073d5901b8bc", "comment": "Malware payload (Mirai)", "value": "31e40bd18e4bf1469fe89d185ef253d6e74f9d2fe5f62df644f763fd66d207ff0cc179c2c530d977007761eabb28dd02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743991029, "uuid": "823e2d02-2a8e-497e-9c06-9efa6103bd60", "value": "T11713F12BC86A959DF79E1132ECEBF9085948C18E43199164D796A0332544F362F28BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743991029, "uuid": "8054b59b-fd4d-4223-8a68-ebcebb453b0d", "value": "768:Hph1Pr9M9RI6v4o+f9bRcCBErtzc4XhE76QxNjJgtFDoVVIl4nbcuyD7UHQRjk:Hp7P96ClFgox79LJgtFUVjnouy8Hyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743991029, "uuid": "92f53b13-5461-4c87-9f3d-88580ed53353", "value": 44224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743991029, "uuid": "72b4b638-0e25-4f27-b201-f38674562a2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743991029, "uuid": "a0c5d119-549d-4437-b05f-ba4b7e0ec1bb", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b322cb1f-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049477, "uuid": "7868dabd-59be-4198-b654-2d1f64cc79d4", "comment": "Malware payload", "value": "41a18b06ef3929bb92b65fa5f610b07c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049477, "uuid": "0483984f-64f7-431b-a376-737cf98c806d", "comment": "Malware payload", "value": "6aa29a67a38060cfb27d74f2c93c1f4aa9b0213b9d74a6abcd0ebd07354a7c35", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049477, "uuid": "f4b082bf-8556-4625-8c4f-773f25b3db40", "comment": "Malware payload", "value": "59908dab0b04f3f766bbb8e7d06702ef79bb8903", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049477, "uuid": "d245f478-c593-4226-a249-789c9092eb76", "comment": "Malware payload", "value": "1427b48da82db832f65b6ce7d25b0d36350c29c22f62da334128ef6c209039938fba9b2967e5d0d7324c2defaa7d1d5e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049477, "uuid": "ed232af3-aceb-4a98-b897-f58b7920db38", "value": "T172F36A51B4D18032D962153209F4CBB5AE7EFC700FB55ADF6B940B7E0F202D19A35A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049477, "uuid": "c96184c6-1c34-4f9b-89fc-481ba01227ae", "value": "3d5d5760afe23c07a7c6be6e570893a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049477, "uuid": "53ad02a9-0aad-4de8-a27e-3476a263f0d0", "value": "3072:uX3/Od2h1GaKtff1R49qGCXaoJIs6+leKHOxDdbT4Zi45hGejE1gWykunmS:ufHby9R4chXaEAhxF5Dun5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049477, "uuid": "c42205f7-2888-45e5-a848-a1cc1fc05ab4", "value": 167969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049477, "uuid": "c14a9e0c-346a-424a-b535-867a62e183a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049477, "uuid": "538907a4-f564-49bc-9465-d1665a0e7a00", "value": "6aa29a67a38060cfb27d74f2c93c1f4aa9b0213b9d74a6abcd0ebd07354a7c35.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ace078e-1352-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743990434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990434, "uuid": "82709964-1cff-48d0-90ea-cc5e683a70c2", "comment": "Malware payload (Prometei)", "value": "6cd979e1c93d079cf7b20e953dcec530", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990434, "uuid": "4b6213db-a2b3-424f-aff5-4280fcdcb8a3", "comment": "Malware payload (Prometei)", "value": "6b5ada43c04706af50695adbb9e8dffd96947e512644c45ff22657c6f77e7fd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990434, "uuid": "a0e65eba-6349-4f7f-afd3-877ae12f035e", "comment": "Malware payload (Prometei)", "value": "5465c48c037bd7956fa0474dbaaacad6df06debe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990434, "uuid": "fefe599b-ed08-407a-b8cc-9ffc71634733", "comment": "Malware payload (Prometei)", "value": "883ca862a4f1f03fdf6959b7ad02ef4c4c81a924c21c2491be8f42c63ced876a3e4c19aff5ae2f217fe2442c4595f0f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743990434, "uuid": "8f180d32-8851-4bdf-8ad1-54483733457e", "value": "T1E39423F8C87D2E30D8169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743990434, "uuid": "0bf98020-07f9-4182-99b0-30d938f2b985", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitga:25WOSACZSV6eKRH5EPiamb4DsDwwcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743990434, "uuid": "f01dfcc7-5cec-493d-b0c5-268479ad27b3", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743990434, "uuid": "043b20a4-c242-4c3c-b3ce-b875e7b84542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743990434, "uuid": "953f5515-36d1-483f-93cf-61e5cfac0f29", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d54efb-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744028136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028136, "uuid": "18669368-b7a8-4a1a-b39f-e688716916b9", "comment": "Malware payload (Formbook)", "value": "af3643a1885bc0cb0f3c2433dd8833fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028136, "uuid": "a0d79463-dc8c-451e-93e7-b70f592301bd", "comment": "Malware payload (Formbook)", "value": "6c287028bee36eeae4cda12515891ba2fbf69b228a877e1dde512b1bce73356b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028136, "uuid": "cae61c20-32f2-4f81-bbd9-27646dae241b", "comment": "Malware payload (Formbook)", "value": "df07f4b7111ecfd59e5ef53643a01186e63d5d77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028136, "uuid": "5217a5b4-a141-430b-a06e-0f8fe06494ff", "comment": "Malware payload (Formbook)", "value": "711eb036e7bdb448ae95169a5c2cb8643e68efe744ee1de2da7ef0f8fef0cf292541b911d415197f0f3231a3aca016dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028136, "uuid": "9724d347-5025-4491-a55c-c530445b4c64", "value": "T16BF4015433A9EA01C09157B99C71E3F40A3C5E8EB921D3179FEEBCEF787466538842A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028136, "uuid": "5a5d55b9-2be7-4b05-bff1-9d7eb50c3201", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028136, "uuid": "4ffa2994-176a-4629-9e3e-9e5e3c445881", "value": "12288:9YqBCCwfP3tQ4ujNYOP5bje/EVdchmdnHNpvXlDMROpMPV0gG3yu398VSUw7XfcH:yfX94NYiBje/ycgcsMdXGizejfcA8Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028136, "uuid": "f055f864-f8bb-4397-a358-1ee87b7678b9", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028136, "uuid": "6314b016-ae86-4a1b-9ad2-c69194b7ba06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028136, "uuid": "75f0848b-9292-4f15-a25a-6a75ece2811e", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58d95b4-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744050823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050823, "uuid": "a82c84a4-89da-4828-88fb-5c0ec611a190", "comment": "Malware payload", "value": "ca93355d42a5b43fd2c30cdf134ee5d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050823, "uuid": "991ec91a-8178-44bc-a6df-4cae57050205", "comment": "Malware payload", "value": "6c3952451a18ebb89c170699175047ccd325c49198e185bc76143be822da715c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050823, "uuid": "f1a12c78-f8a4-4a2b-b6b6-512fa037331d", "comment": "Malware payload", "value": "aa224ea604d71c6fddc1d42e472fab78912288a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050823, "uuid": "08567d96-bd13-4fce-809f-6c441f54213b", "comment": "Malware payload", "value": "7c9ba806eb7f23df74da426f1cd8f93e16dc857dd79cb8f70e00e636370da053dc8b5726c51ae4995636e07d9ca09967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050823, "uuid": "7ce4eb56-d8a3-4d74-9828-dec82b2bcf64", "value": "T12982E41B3BE49B37C9FD49BA4867164117B0A25B4492DF893CC4A0DE4CF33981692BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050823, "uuid": "e474a749-49fb-494a-9a47-bb117936da4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050823, "uuid": "53c15e72-5ebc-4295-b43b-d51c1e1eb7cc", "value": "192:qXduKMslu3LtJ2zTQQb/qWaz/5wOCPfbINFwxj2otK068t0RUIfO+zP:qXoT2zOz/5wOCLINqp2oSVfLzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050823, "uuid": "99601f60-69e4-4675-a93c-dcd97745147f", "value": 18561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050823, "uuid": "8665e522-8140-431d-91fb-bfe84687e3c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050823, "uuid": "e4a5e82d-26db-4f1b-932a-6bc01380f636", "value": "ca93355d42a5b43fd2c30cdf134ee5d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd353cb-135a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994034, "uuid": "8fdfe641-f678-46d9-a9be-0fedcc0d2ecc", "comment": "Malware payload (Mirai)", "value": "728472a59b01d9c5b20183abc4a319c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994034, "uuid": "9c793deb-a400-4aeb-ac06-db7099f2faac", "comment": "Malware payload (Mirai)", "value": "6c54d128f0072d9852403dfc4cf161d20cae25ffb40bea5629e5a962268d8c38", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994034, "uuid": "692a9fcd-bf89-4656-ab26-1575b776210f", "comment": "Malware payload (Mirai)", "value": "fda69c9e9d764f7304ed47e45a9c5271ffc51240", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994034, "uuid": "eaa3e042-04fd-41b7-bf9d-a068ab6b6927", "comment": "Malware payload (Mirai)", "value": "fb33a06765f323fa1b44072c7b26d1f9d99102be60363e89bf9bd1f78c088e4a26b7bab48b7d864dd794e2fb43e46f76", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994034, "uuid": "b1d4a827-b534-4fdb-9229-dd0af0bd98fa", "value": "T188014CDC427166261B2CCE1DF76F91185482D9D0F7721D08E85804AA9CEC38BF065F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994034, "uuid": "e4bc1598-e532-4cde-baeb-a7698c474988", "value": "12:3J3VS3fAxVaRHxVrNIjlTBAxV4iKl2ExVX1xVedKAxVf9qxVuFG10qxVN6ZxV5hy:3J343fd5NIpOKlL0m1634Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994034, "uuid": "b20aa446-5fc9-41e2-b021-8788d2c3d38e", "value": 776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994034, "uuid": "6f66f002-05c8-4fb9-be72-c93badebc62a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994034, "uuid": "aef75324-0a64-45d6-9aa4-feaa25e88dc7", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9d3133-13ca-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744041982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041982, "uuid": "be952169-ba36-4477-ab0d-14a272bb8c18", "comment": "Malware payload (LummaStealer)", "value": "e188137ed669a5ba15f8397a650b6a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041982, "uuid": "a7dd8546-351c-4b6a-b482-a8185404189e", "comment": "Malware payload (LummaStealer)", "value": "6cb1a58a42a1520c1c899e346302c552a8559209084d25d8cdb42cdaec1223ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041982, "uuid": "b6cc8952-3ecd-4699-ac6f-3887ce2bc1b6", "comment": "Malware payload (LummaStealer)", "value": "0f08342c09993db76b15a4ce7501786b4dbe11e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041982, "uuid": "53670594-f59f-42f5-915e-4006ce23d306", "comment": "Malware payload (LummaStealer)", "value": "0fef161f4ce16b62f78f2e3c36a167d1e6e60ecc1e5d610dfb02ae8813b52ee1bfa493ee2d17df97fb75d1c48c38dcb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041982, "uuid": "75524bff-e64a-4881-aca3-7a9318b4daac", "value": "T188B6F1137650903EE5BA01314C6FAF6491A97D738A318157F6D0FE1D2DF1982BA23B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041982, "uuid": "0fa66375-a84b-4daf-b95a-bbd90c399e48", "value": "f052f84efefe84f64ac7fab273eb8464", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041982, "uuid": "5c5e15c2-cd98-481c-9393-a8cd23a03d86", "value": "196608:2xB27Ydd/FBN+qSmCzZXB4Fa1SStSx0USapM7HxB:ayYT/FBN+cUBZ0Stp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744041982, "uuid": "0a22f9b2-ebd9-40c3-bdac-a1f6cdb7aabd", "value": 10985344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744041982, "uuid": "29c5d40f-5d8c-41e2-b3ff-b33d5648b33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041982, "uuid": "15043cdf-a12e-4a72-8987-789bab0518e9", "value": "e188137ed669a5ba15f8397a650b6a73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a05154-1408-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744068570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068570, "uuid": "d6f6271e-7951-4175-81e9-5f7e04a44bbb", "comment": "Malware payload", "value": "75db568f3c825bfd1b8ad0d1ff9d6593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068570, "uuid": "d1833e9a-71d2-4c43-8026-410b4f5b1b07", "comment": "Malware payload", "value": "6ce1c4d29d34891e0318fc454a58d4b38e2a33dfe17b6d06fd478cfc8836e793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068570, "uuid": "d12c49b5-91fa-4804-9075-89ac9231d6f7", "comment": "Malware payload", "value": "7391de666db2098d870d6fc22e7d10a56c69b3ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068570, "uuid": "9e28fddd-b3e1-4ad1-a334-55517400e324", "comment": "Malware payload", "value": "0d9e1a9969f16181f872f5b32c352420d2d274b47c80190bcb91e737c60f67165eb34f071111f1c97a781cde000db1e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068570, "uuid": "24be3922-76f5-4c31-b20a-84b69720c892", "value": "T1F71439D7B792DC9BD911433846E68326133EFB904B934B172D20B5391A27FD0BE9274A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068570, "uuid": "5aad5b62-3406-4906-a120-2fd65ae81484", "value": "269b9d730f3d29216185b2acb3aa5fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068570, "uuid": "5b90291f-7f2b-4630-a3cc-7a01a08b7559", "value": "3072:aR4svg8GETD2CzhjCfziXgVGcCvQR7saBur:24svgbE7zhG9hur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744068570, "uuid": "9ad0b386-f9e6-4325-842c-d8d7f571ec6a", "value": 196813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744068570, "uuid": "e0f78965-ae84-4e39-99ca-60278da10f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068570, "uuid": "7c97e4bc-6da5-461b-9c25-02389ed8b547", "value": "finale peaceful.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e4e219-1363-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1743998056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998056, "uuid": "20e88025-7daf-42c1-8c35-f073caf6edae", "comment": "Malware payload (AgentTesla)", "value": "21441e71ece97caef7e8e41c94db948c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998056, "uuid": "c9f2a2d2-6712-4263-a220-bbb417f0af26", "comment": "Malware payload (AgentTesla)", "value": "6dc9d0fa317804195eb9e6f6970f746fb01d91b9758964dc722f31728f88d548", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998056, "uuid": "e0f26ee4-6623-46af-b3b6-dc130b777e75", "comment": "Malware payload (AgentTesla)", "value": "e9720a4d1b93988d45278e4f789e76799574564f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998056, "uuid": "33ee5b74-a737-43f6-aa58-95cd947693cf", "comment": "Malware payload (AgentTesla)", "value": "8a28d6d343a27a8c8b2cc6b9e040d1f958d825016447c3f85f7bd2a9f3ccb8f99cc7d5b207edd9fcde74c744a985639b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998056, "uuid": "f9587b16-a80a-4399-9c56-5f5dddb85c85", "value": "T192359D2273DD8360C666C533BF1A7705EEAB7C211530BF5B2E881D7AB9D1161272CA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998056, "uuid": "de2382f0-f21e-4312-a9b2-6a6a9358a4c4", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998056, "uuid": "e0634001-bd83-4404-97fc-2f0c20316b76", "value": "24576:Vu6J33O0c+JY5UZ+XC0kGso6FasUd7PU+mKMc9d+WY:3u0c++OCvkGs9Faso8+mKZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743998056, "uuid": "57f87248-4a62-4316-9d9f-45e68878bde8", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743998056, "uuid": "bbf341b8-b3ef-410e-a22f-48aaa00c7dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998056, "uuid": "bd49a76a-184f-44da-9ebd-8ae04fdd4056", "value": "Offer Inquiry 00125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35e8fb8-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034498, "uuid": "b0cbcbec-adf3-4663-8890-44fa8f230b56", "comment": "Malware payload (Formbook)", "value": "fd631dfce941ecf0a9efb9f4f3333ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034498, "uuid": "ce167062-3ccb-4294-8bfb-31c160b939b3", "comment": "Malware payload (Formbook)", "value": "6dcc8b8a32a5260e35ae720424915650621e777a573a94d74cc28e7a21742abf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034498, "uuid": "91545322-8ac3-45e6-84ef-8e1019d78f57", "comment": "Malware payload (Formbook)", "value": "d529f043fe85492ebca744c29433666790569e17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034498, "uuid": "3f68ee07-1182-4974-9610-20c2c033f0be", "comment": "Malware payload (Formbook)", "value": "d8c3c3ec106a89e581b234a033997fbb6da9dd47cb4ff9a590d95a6d7a31cd963bac3638a25a2f85a9ef495208c70695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034498, "uuid": "ede96750-f809-4819-a8a3-aa1174de4b73", "value": "T17645AE13B3DDC36CCB669173BA3963216EAB7D230630B8573EC85D7DA960161162C6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034498, "uuid": "ab10df9c-2571-4e52-9e25-bd7f7c78114f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034498, "uuid": "769917a6-707d-40ce-8c8c-dce17bd5c708", "value": "24576:yu6J33O0c+JY5UZ+XC0kGso6Fay3YuvRl804hFx7h8WY:0u0c++OCvkGs9Fa6Yw+04TPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034498, "uuid": "e53c5d34-fd5f-4bc3-9b90-4800b3f01fc9", "value": 1242624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034498, "uuid": "495d8dae-954b-453a-8088-cec011683319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034498, "uuid": "c3e54742-4dd2-49a9-a743-39c55c77db8d", "value": "6dcc8b8a32a5260e35ae720424915650621e777a573a94d74cc28e7a21742abf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae227aa-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744024176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024176, "uuid": "43d2cdcf-9f0f-4d66-9842-8a4d8d8a94bf", "comment": "Malware payload", "value": "064e92695a1af94c39c2d1f936fa183f", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024176, "uuid": "b710e52a-135d-42d7-b2a0-369058d211e8", "comment": "Malware payload", "value": "6de1117c5407b0e061856351da89328bf6ef3f09ca59633547b8ea095f36625f", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024176, "uuid": "497aa922-47fb-4bb5-893e-64fd333bef02", "comment": "Malware payload", "value": "25653e3665fa5beee5f2eb4c6cece23b7b0a660a", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024176, "uuid": "f1f8748e-23b9-4e9e-93ab-6b97c2401967", "comment": "Malware payload", "value": "7f3d7e0b23886419ea7923e5e155f97fcaa38adf4b044f468f054e96881fe4993a1b95e332411401a63f9b14daf6f9f9", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024176, "uuid": "a4aa1389-10ea-4d19-a29c-42237827adba", "value": "T1EBD36D1BB6E500FBE5B7A275C8530A45E7B2B84107209B6F03A847661F237D19E3EB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024176, "uuid": "5862ac2f-62c9-417c-b37d-18441fd40b45", "value": "086ddeeaec7d7f2ccae2bd45a6bd3589", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024176, "uuid": "ebb8a2bb-838e-4f9c-8fcb-cc0c93ab9292", "value": "3072:LVVTOhqDnT193DO9YXUCuEy7Yh6Jd2maK1FckPxiTn/FSGj:LyhqDnx936aX3A7g6JhIcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024176, "uuid": "b0807c5a-6923-4bee-a305-462ed37695bc", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024176, "uuid": "847c77ff-648a-4850-ad75-5770c9c64684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024176, "uuid": "f383ad79-4a75-4f0a-b7b4-1dd6be9fb58a", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b0f42c-13e5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744053482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744053482, "uuid": "dcc6b3a0-ae40-4d6d-85d0-7cd6dd2eb441", "comment": "Malware payload (Prometei)", "value": "28d4b722a97c7f116c9f9d2399b755e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744053482, "uuid": "4f7ac0c3-5801-446f-9828-6aa089179de8", "comment": "Malware payload (Prometei)", "value": "6f30a156a34b90040fcd2f9dcd75b9bca8f29e1ad65562fc6b3cc0d83c575d26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744053482, "uuid": "7e6fcda7-d768-4591-91f9-5bf98a8b27d8", "comment": "Malware payload (Prometei)", "value": "275164f4a6ad6daf4a1a8cd6579060dbb36c3003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744053482, "uuid": "42da0826-944d-406b-ab40-6c03b22e8afb", "comment": "Malware payload (Prometei)", "value": "54c6825b9a911b38cd8e9acb8df8a19478e1320739ea8d02778d4eabd321b1353294738b0ae4760aa9d10e551b5d6f84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744053482, "uuid": "acdfea84-4448-4ab5-ab28-75c46c53f174", "value": "T1A29423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744053482, "uuid": "5d8c9205-5b55-4c73-b320-e60675f7d5ac", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg2:25WOSACZSV6eKRH5EPiamb4DsDwwcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744053482, "uuid": "d7711bdc-e8c2-4dbb-a310-a41461156876", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744053482, "uuid": "75953415-caee-4f7a-8755-f87ad29256c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744053482, "uuid": "def8a92a-f33d-4c89-b738-209fcb474636", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c179028a-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049501, "uuid": "17c8f3d5-3d98-4e3b-beb5-ebdd97b488fc", "comment": "Malware payload", "value": "1d2785dfd335a7a409e9db582f085d53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049501, "uuid": "27f3a818-ab1f-4057-8ef2-4febee51d004", "comment": "Malware payload", "value": "705875b2ad72e003028d99d84502d82831e2a6d80ae7ed690f9c02d6f6805d34", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049501, "uuid": "efa4ab75-f329-4173-a0b9-d3c44db2a285", "comment": "Malware payload", "value": "d6b99f4bb82672395554173fcf9dcea70655af16", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049501, "uuid": "2e1092f1-9d8a-4066-bff3-d09f806e2ac2", "comment": "Malware payload", "value": "414ac4b91f11636a7c0a95f683294fa898c9c809c4a9e8cdc69dfc636d7cb7df044353ade855a18e43b18a1de0c87f4f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049501, "uuid": "551e99dd-2580-4b03-8a65-501c13dee9bf", "value": "T184F35A51B4D18072D573153209F4DBB56A3EFD300BB25ADF6B980BBE4F202D19A31A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049501, "uuid": "b63dce54-832d-40b3-987c-a1981eef48c1", "value": "85d2717f3acd3a902295a5164323c06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049501, "uuid": "33b787a4-93ee-43d0-a343-d2d847a5da6f", "value": "3072:GymqMCM7xewQoSsLhXGtvqCJ4jGa2pOKVbdtZw45hGNjAhg3Tfsn:38bd0VsLpUvqOReK5IIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049501, "uuid": "60db38df-3b23-4749-b13a-c9ee49a8c98e", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049501, "uuid": "029ec8d5-4b47-4e23-ac37-919b0b245415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049501, "uuid": "6bf7a913-b98d-4e42-a72e-b22c31fad7c6", "value": "705875b2ad72e003028d99d84502d82831e2a6d80ae7ed690f9c02d6f6805d34.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebb87d1-138e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744016291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016291, "uuid": "cf1d6acf-4d82-4d4f-a053-b90248a2e72b", "comment": "Malware payload (Prometei)", "value": "411b307396e32a80847e75857b7dddba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016291, "uuid": "001184d4-bfa5-43b4-b046-3a78eec80416", "comment": "Malware payload (Prometei)", "value": "70747c6357adb3ca2da15d3c870a0e7a6fd4ac5f1591cd741e4135e8332ddbf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016291, "uuid": "13ea04ca-e362-4a2b-97d7-47cc9043a10b", "comment": "Malware payload (Prometei)", "value": "4df89f130b83bcada5b5a23e801355bacac18803", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016291, "uuid": "dec34df6-381f-44c1-945b-da6cb2a2f76a", "comment": "Malware payload (Prometei)", "value": "854c29bf1cb0a5f4d3ac05894df45b83b69dc437b3df7f7a645b9b27fff3f5c2388b666801004600e554bf09c6128a74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016291, "uuid": "32b7bc8e-d677-468b-8109-5020ce76faa8", "value": "T17C9423F8C87D2E3098169B3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016291, "uuid": "87f89154-ff42-401a-8c7b-87babffc974e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg5:25WOSACZSV6eKRH5EPiamb4DsDwwcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744016291, "uuid": "db280387-864f-46dd-a848-fb64f7497401", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744016291, "uuid": "e89a5d82-d064-4b8b-8ed1-2176492b40e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016291, "uuid": "cf7b47d5-8208-4efc-9b7e-9b1286874fcc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f903676-1366-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743999139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999139, "uuid": "39ba7bde-310c-4cb0-8c77-9632ba748cad", "comment": "Malware payload (Prometei)", "value": "470bc6af09ba2d8ca9f5e38103c5fcd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999139, "uuid": "bbc7d56b-f110-4305-a652-27d7d2eea3d2", "comment": "Malware payload (Prometei)", "value": "70a967ec7f1e51b5fcb029ba6a3b56868a0ec62881222269a7d2b013db095ba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999139, "uuid": "4db74a73-6a81-479d-b768-c9ed7c0393f4", "comment": "Malware payload (Prometei)", "value": "e1b1650d83a79cb1680cde81c87c4b92b328d9e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999139, "uuid": "884dd9b9-2387-4c29-9af0-860c67eb78a6", "comment": "Malware payload (Prometei)", "value": "29056c70013ab90ba8636c92e3e15632203ea80fc83214486f629985fbe6078468ed722526b4e66238c9c11a5ee222cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999139, "uuid": "5af240ad-2219-4321-a7a9-d05f3c94b679", "value": "T17A9423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999139, "uuid": "39aa1c18-65c4-4407-9201-5d0329b91e73", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg2:25WOSACZSV6eKRH5EPiamb4DsDwwcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743999139, "uuid": "a17f3e8e-cfe1-47fc-8c22-ba9d872d9bb5", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743999139, "uuid": "f808e6ed-98d3-4c4f-88c2-4b74226d8221", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999139, "uuid": "4935681a-a236-4662-8800-366da835fd7e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2647759-13c8-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744041315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041315, "uuid": "a1666d0f-e20f-4959-93f8-de7862af2864", "comment": "Malware payload", "value": "1ee3e17398c27ade1818bd8185131b38", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041315, "uuid": "319d4d22-747f-44a0-990d-3f366348e7f0", "comment": "Malware payload", "value": "70bb2c7d9dc6208d1e30d22036e3aa4871a4bc10591fcada50f387f1862999fa", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041315, "uuid": "2de847e2-5f44-4fd4-8075-ea3e1320088e", "comment": "Malware payload", "value": "83e3b08a1421413a62bdf87d1541933c12784151", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041315, "uuid": "37ab918d-fa50-442d-8f6e-e931891c5793", "comment": "Malware payload", "value": "0d08e876545eaf35e1fb517994c4244d8b902f2a271385f258e9d50520db405e09bc4de60ab0dca6120ffc7f1825c797", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041315, "uuid": "d003e6b7-e07f-4b92-af82-a95845e33536", "value": "T189627C69F6215CCECBF644BD929C43F4E46D50461512E20EA88CB6ADB702BD3179BBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041315, "uuid": "39e62300-e623-43bc-ae2d-3fe871c2658a", "value": "192:nIb3U4St/UutEil+9NhfFdpeckWGYRfHIA7DTvlfm7T44MyWD+Az0J:nI3C/C9HjfzfHISle7rMHDxQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744041315, "uuid": "adaf1750-1033-4614-8833-ecfb23b07621", "value": 15479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744041315, "uuid": "0eabab48-fc97-4a08-9e31-76cea2c25840", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041315, "uuid": "3a19f419-5abe-4082-aac9-13988d8d02f4", "value": "MonthlyMembershipGoal Nov 24(1)(1)(1)(1)(1)(1)(1)(1)(1)(1)(1).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4c95bc-13a4-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744025898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025898, "uuid": "b2d509ce-c0bc-4b94-a710-2b3652d808ac", "comment": "Malware payload", "value": "32d07d96b7bf9504a3127d0359cf1af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025898, "uuid": "c08c63ff-aede-4efa-aa0a-d32eae27530d", "comment": "Malware payload", "value": "711d5c83655fbf1a139dcaf91db06d158e1958a1edb8e4885b526c137abf5a69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025898, "uuid": "77abe8cf-862a-4534-92d5-e0d0333366c3", "comment": "Malware payload", "value": "af18edd87d9159362b53349f85b858975919fc56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025898, "uuid": "897de50a-f1c0-48ad-8b80-4d1f9ca30425", "comment": "Malware payload", "value": "c064625bff650f8cfa7b15bf81f48d1e02485373b753d4e4c92d3017a8348ce4b375eb3536c94f83884858cdc92c2160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025898, "uuid": "a1fc1d87-97c6-4dc9-84d3-0e2470f7a08f", "value": "T154D2732ADBF381D8E8F2D17491B222277576BC1CD224DB2FD78987455B20F60E93AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025898, "uuid": "ee741e19-7e94-44a8-bdfb-bfcf143f2d2f", "value": "1c253c2fdb6574e7828dffaa28b935b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025898, "uuid": "8617680f-a79b-4d6c-a068-9bd15cce08a8", "value": "384:EcaXe/EEHaqbG/VsCHpNeAstqxh6xr7be5plBk2hwP9NsTx9M:8e/EEHkVsCHCAsM0r7bexrhC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025898, "uuid": "6432a4bb-a379-4b07-aefa-af6e7f535159", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025898, "uuid": "cf69b8e8-e0c9-4d71-b10f-fbe8aae4e56a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025898, "uuid": "10f5e843-aa17-419a-b292-5e829cd5403c", "value": "711d5c83655fbf1a139dcaf91db06d158e1958a1edb8e4885b526c137abf5a69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73073eb4-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1744050658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050658, "uuid": "dda97e5d-cf2a-4361-bb5b-f93f97adb8ae", "comment": "Malware payload (Socks5Systemz)", "value": "0cc4c571dd7beb0baf48c7a76f3ab1d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050658, "uuid": "356fbcb7-6c5c-459b-92f7-ba09916c7512", "comment": "Malware payload (Socks5Systemz)", "value": "72334eda0fa1761f55a5c170be94105f557785e1d1071a9fb876700b32686799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050658, "uuid": "1a5733a7-5ed1-49ff-bd03-1dcab5c3f99d", "comment": "Malware payload (Socks5Systemz)", "value": "b887d55bdf46831fa924ccc76040d25f56c9b263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050658, "uuid": "02074bdd-f82b-416d-928c-ef85d6bc8e2c", "comment": "Malware payload (Socks5Systemz)", "value": "4b03039a85710cfeb4528c2f4e6860060d09fadab3c6db1db87e9f9f273b773903d31f5973bb0be1e48cf821454b21bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050658, "uuid": "1a620e9b-c461-4885-a9eb-5289c1909f1e", "value": "T177F5336DE2908270E02A0B766E11811E5A7D7E3A3D9880197BEF9C4DCFD367D190E7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050658, "uuid": "a3f2b77e-4741-4566-996a-be9e0b6a9f59", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050658, "uuid": "ad47548d-6e84-4cbb-8332-e99dbe9ce5e6", "value": "98304:N3GzTE4txiO3KL5qWZDwIDpAFjbCicSwk4fl3:J2cO3K1hHDpOhEl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050658, "uuid": "9b267b1b-457b-490f-932f-eaee970beea8", "value": 3524345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050658, "uuid": "0f13d799-795e-4ee4-a5d9-ddede5d52023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050658, "uuid": "23ab86ee-9159-4e0a-9879-7f21ca497d37", "value": "0cc4c571dd7beb0baf48c7a76f3ab1d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae2c12b-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1744050725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050725, "uuid": "47d7fe6f-6907-41ba-bfe2-acdc15b8270e", "comment": "Malware payload (Amadey)", "value": "2a29072e101333ceba9cf14225fb2937", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050725, "uuid": "aaa8d6eb-1fd5-4f1e-b149-a90b32b539bb", "comment": "Malware payload (Amadey)", "value": "72b2c77bc9da721dc2b93ebccd42afeb3f692f36e5cc89c014b957859735c161", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050725, "uuid": "392ee89f-653c-4f10-8ae5-61ec29e67f2c", "comment": "Malware payload (Amadey)", "value": "364c2652d65b063dfa6e9f67681f6dfa4fd66a8e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050725, "uuid": "0d262426-fa22-4bfe-88b8-be21e62777ba", "comment": "Malware payload (Amadey)", "value": "a265e7c87dc7ff7e4e0d2ca8a43e97d84ac35257c45d5917f2dd94c54deef4982967a09f81cc29b93fbbbd996f9c2289", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050725, "uuid": "762c70f3-e090-4aa2-b958-2f7538682573", "value": "T195E52A92BC6771CBD4D9167455ABCE416C1C02FD072988D3BC3AA4796DA7CC32DBAC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050725, "uuid": "a1da842a-5533-4aa7-a265-580283f4eee4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050725, "uuid": "37a77766-7217-496e-a01d-f80bdae26107", "value": "49152:iAQ59MmRxStyDHM1G9cFALODvkF/0nEHQ3jCqKCfKYokusNeMJunL25:j6M19FALODvkpEEw1fKYokuc7unL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050725, "uuid": "de56b35d-bb89-4c1f-b830-fd9292b8aa9c", "value": 3173376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050725, "uuid": "dd2171ec-d870-44c5-a595-58d89fb1d6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050725, "uuid": "1c6c2555-bf78-4d8a-a550-83fd09186341", "value": "2a29072e101333ceba9cf14225fb2937.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74782b34-13ac-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744029185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029185, "uuid": "62b064ea-e610-4b4b-9306-9eae331d53ef", "comment": "Malware payload (Prometei)", "value": "2c39ce2519579bfdd5829ec0385ee7ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029185, "uuid": "3bf36e1a-6dd0-4800-a7f4-27f428bba87f", "comment": "Malware payload (Prometei)", "value": "743013c337b20d0e16f42b1345f62c09fe6dcd6d7944d73c091efd0256f5f721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029185, "uuid": "7adc633d-185c-48bd-adf8-6bb7238d1e82", "comment": "Malware payload (Prometei)", "value": "37188be7bdcc06429690855b974693941495fb83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029185, "uuid": "c56f950e-77d7-42c8-bc80-540478a47ab5", "comment": "Malware payload (Prometei)", "value": "61fcdeb5cc442a0560401cdb3dde8bc05d3b96680044d1a478b79f1f304f40a0484f6d14d1266686baa57c2a5050b640", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029185, "uuid": "b0712f1f-ceff-402d-b169-920e59337ada", "value": "T1809423F8C83D2E30D8169F3CBB5A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029185, "uuid": "9c9accc9-4964-4baf-8ea6-df70ecacc877", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgi:25WOSACZSV6eKRH5EPiamb4DsDwwcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744029185, "uuid": "6686b1b1-3af7-4754-9b95-633a30ca509c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744029185, "uuid": "6d1e1979-dfdd-43f2-9ec8-0bd4e10cf84a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029185, "uuid": "984135f1-84f0-4737-9fd5-ed0eb9834fbc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c9cf55-13bf-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1744037152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037152, "uuid": "ec56cb04-fc4f-43c0-a3aa-4e508d8bdadf", "comment": "Malware payload (MassLogger)", "value": "cc3dd3c5851d55301b5b006df5210653", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037152, "uuid": "ed511181-bba1-4008-b0ef-fe93f6060b21", "comment": "Malware payload (MassLogger)", "value": "74fcd529181753dc556d9d0aae23fb7fb92be02c867140e3fc0d2a54fc98cfea", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037152, "uuid": "c6c5dc23-ff75-4c7f-82f8-ade21c40f245", "comment": "Malware payload (MassLogger)", "value": "1e250372cb1b9788e8ead9f02566f8fc0e6474df", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037152, "uuid": "76b0f805-7411-4d06-b76f-eb3d62f1e66b", "comment": "Malware payload (MassLogger)", "value": "3bb7159a316430d74cda7f796bfcc6c666e21eb2e07018a61c1ba831bd9e9ea64d8c1f1157ade40654008a64fe82770e", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037152, "uuid": "577c0a5d-160a-434e-b01a-6389c6d59076", "value": "T1FEA5E2B195327EEE9DD40847006BBD80BE46185B5C28B5D37DCAF3F95AAC322050ACF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037152, "uuid": "8f997c8e-beb4-4172-8129-37e7c9097f02", "value": "24576:gVA2jgWio4ooSnDK3LViu7vFcl57cvjAJjqNnE17JpmhSwiLXdsJMiZPbr66/SXJ:oX0o4oLDyLwmFcl57c0RZmaRidrU+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744037152, "uuid": "6bfb4d2a-a1b5-4670-994f-fdaebfe76c05", "value": 2111843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744037152, "uuid": "95075f13-549a-4167-9bf8-1937ebfe295c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037152, "uuid": "b8dc3191-79b3-4ffd-a528-38d85459da5b", "value": "RFQ DRAWING AND SPECIFICATIONS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bb09a9-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (SheetRAT)", "timestamp": 1744024106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024106, "uuid": "3bab1bb4-12ba-4f86-ae18-55eb44494cef", "comment": "Malware payload (SheetRAT)", "value": "91c3d13bdfde48158180f4ff36076a7c", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024106, "uuid": "9f884f8c-d292-475b-89a6-881b77a1ad80", "comment": "Malware payload (SheetRAT)", "value": "758f0a2c3d33085644654ab9193d670ddb6a0cf8974187774c0c186b1c7f5dd6", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024106, "uuid": "e3073215-9492-4bd8-a8de-6c6f80f56360", "comment": "Malware payload (SheetRAT)", "value": "9742469f465f16df5d1e9e334006431f53482fac", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024106, "uuid": "e871dbf9-bb96-4cea-a68d-bc049e00f697", "comment": "Malware payload (SheetRAT)", "value": "124835f18a21447d522ea70904aa2bc1451349d33637a89575778ddfd8c551e5e1fafaa4b93c45fea38b934f97846dd3", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024106, "uuid": "4dd984a3-d63f-4547-a1a4-26a3358c0c43", "value": "T134056D103E5455F59BACD90A8459AB1DE3A0420F65226CBEF603DF20AFB61C581FF2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024106, "uuid": "bed44371-2178-4057-bf69-eca29816df8e", "value": "12288:i4rRI7yIW5863bPY8kqzVkOa41pXA+qwwND4SMNPXQDRNGpQ:i4rRI7nLOPY8kSkb4rZqFND4dPANn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024106, "uuid": "d186441e-8fd5-4de4-b160-5b379d468ad8", "value": 825614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024106, "uuid": "c0b39bcf-4807-4b76-ab19-fa121044b649", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024106, "uuid": "6de8f4ab-347f-4b79-84b0-cbe2bc261917", "value": "83.147.240.230 (7).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da135bb-13d8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744048099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048099, "uuid": "ce26d3a7-f785-4727-b963-25f18c2965ad", "comment": "Malware payload (Prometei)", "value": "eeaa2aa16b61e7fa24f76455dbc67574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048099, "uuid": "fd737ba5-d784-4f2f-92e6-593092967772", "comment": "Malware payload (Prometei)", "value": "7592fd628cbe4d080430c575685b56684e7dc22bf982567dde48c1d0df833dbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048099, "uuid": "b24b9b4e-3274-42af-a836-3bf944453548", "comment": "Malware payload (Prometei)", "value": "2b6f48d4126292e9c2269f6511f50c70f10674b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048099, "uuid": "7a6f3e30-066b-438c-aa52-1df1b376bf18", "comment": "Malware payload (Prometei)", "value": "48c470ee384d940f76a0c527244932eeef7980dca78c4c15cf0f3e6d3872c3ad05bcc8024364027613c06fd49e565771", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048099, "uuid": "2b280b3f-e6db-4acf-ac68-6299134a6f46", "value": "T12F9423F8C83D2E30D8169B3CBB1A826CF0A15772D9562F7AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048099, "uuid": "49b906b3-b537-43d5-b64e-6931fc22fe2b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgB:25WOSACZSV6eKRH5EPiamb4DsDwwcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744048099, "uuid": "00a5c9b8-a7c6-4b11-aa6f-e4ae8c65915a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744048099, "uuid": "7cdbce7b-83cb-4468-aef0-f0a0208ccd96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048099, "uuid": "ff818335-041b-457e-8aa6-b961118e2871", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41afc612-13a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744027382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027382, "uuid": "07f9bb7b-df08-4bf9-b01c-4578b9fc97b8", "comment": "Malware payload (Mirai)", "value": "234bfb1e6e4cea0caaacbcb814d0f721", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027382, "uuid": "314bf2a1-8dc8-4c01-8b15-8d75a5bfc231", "comment": "Malware payload (Mirai)", "value": "764ad8c95782f701014e828777eecc76496674a326b06bfb5dd4ec95e4fbf50a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027382, "uuid": "7cf7223c-cd3e-4f33-b464-34f9316a7ca3", "comment": "Malware payload (Mirai)", "value": "ad0d332e88847e56be195fe0608f3612ddf959c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027382, "uuid": "9a30674e-8325-42bd-b246-d084f7871eda", "comment": "Malware payload (Mirai)", "value": "90c385213ef2a805017ab9108affe6b488535b553c50939b26d3be971e8d71efc3169f264cd35e00e000744fe5056548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027382, "uuid": "4324b344-3fc4-4dd5-87ab-92ef4cb16fbb", "value": "T187F2F1E260B59058FB4F5972B17DABE8711B1C728CD2B5181F0B8F98131A9167E2CBB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027382, "uuid": "ac0b0ca3-1f82-437c-be05-0e980cf5ec92", "value": "768:NYewHz7JhXmSTCTjV6xnrMdWPvq94nt4EjbjhAth/4uuU46pgMOrI:LwHz7JhXLTSjkxrNPWgaEXNAthQUhpo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744027382, "uuid": "0c27793e-540b-42b0-8e10-e2b6b3f5f6a8", "value": 34776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744027382, "uuid": "95a23447-ded2-4c80-b04a-ec9da3fd796c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027382, "uuid": "5a273b29-af08-4710-be64-0431507fb01d", "value": "hanoi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6036a40-1396-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744019900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019900, "uuid": "db89ddd8-61ab-4079-9c82-5ad594c89569", "comment": "Malware payload", "value": "4f47ae62d42d2d33eeabfd88556f7efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019900, "uuid": "ec74efd0-1a2e-449b-99ce-0cb965c24537", "comment": "Malware payload", "value": "76d73cb0a56042051a7f891a52ce3e002fb8e823fe1f12ddee35831e34f034a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019900, "uuid": "a424450a-d1c9-4d4f-ac20-d87a4ff6cc64", "comment": "Malware payload", "value": "fe39c6f47de8c8a6415d2dfa36b4761c0c6add6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019900, "uuid": "3d24ec44-454f-476e-8f98-530c2d185922", "comment": "Malware payload", "value": "763c5079b6b93c84cc438950e59e7d1fc3dbde4cc5993756fc65c34018f963a1447c27dfc8b75d9f6e3b5f21ec4a76f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019900, "uuid": "5aacfea9-fac5-4f54-adc4-034905f13b36", "value": "T108F7F107E6B151E4D0BBD0359627A62BFE70385D833467D797A09E422F61BF0AA3E305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019900, "uuid": "ce2016c0-387c-4efd-a1cd-cb3841dcec4a", "value": "8ca08910aa26424f323068e9a2af24e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019900, "uuid": "070ddc34-fa43-4915-b9ef-f6b31743a036", "value": "1572864:vfTUNgoAS9ExZ8dBSFADg2bUI+WT4z5xAGJ+32cX5TjNaxl:v7ogSnyCj+vnAMUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744019900, "uuid": "6f546001-1280-4894-b67b-2bc0324858ec", "value": 70568960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744019900, "uuid": "f0908830-ebc2-4433-a442-df44187d2df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019900, "uuid": "421e389c-8d9e-412a-9671-ca5c1bedc73a", "value": "\u5173\u4e8e\u6e05\u660e\u8282\uff0c\u653e\u5047\u5b89\u6392\uff0c\u5927\u5bb6\u81ea\u5df1\u67e5\u770b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4237067-13c7-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1744040942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040942, "uuid": "0308410e-cb66-4c19-bc42-2a639c43d077", "comment": "Malware payload (RemcosRAT)", "value": "d476d766919d0e65f85c61d96d136e52", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040942, "uuid": "3335702a-a1cc-4923-8009-c80975669b78", "comment": "Malware payload (RemcosRAT)", "value": "775afd37f4b13555ab7c7b457e477039a41e4cc66083eb008af3594127f5ed2b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040942, "uuid": "7ace648e-6b5c-4c72-abc4-ba388cbbacea", "comment": "Malware payload (RemcosRAT)", "value": "75b925e03ca1866553946c4d05910fdd83344bff", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040942, "uuid": "a95b75b8-eece-461d-9e15-79da1cf9aee5", "comment": "Malware payload (RemcosRAT)", "value": "919bd3a8a35b65c1bd025e0ab8145f272cf96388680c8d06bda616ccb7b9b5fa377399e364c3fdcee6aeed4f881209f3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040942, "uuid": "9743691d-8043-4782-b80f-794e1d4c8563", "value": "T1DDE25B95ED54066A4E0723BAFC850970C4BD862A061704F1FEEC779C150AAACF7FE61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040942, "uuid": "78387c78-f8e4-4ad5-9b53-d4a157350f61", "value": "768:MeifDnb2ZBpPMFg2vSJtDNUyTmdmbJZyiMvF1mtQhTd:GfDCDpkhSJlWuum+FF1rTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040942, "uuid": "404d85e2-1411-4527-a9cc-965aa0bbb1cd", "value": 34052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040942, "uuid": "b5544240-edab-4571-ac63-b2c0b7b83bc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040942, "uuid": "ce8745db-c721-4922-b63d-758c4533b0ff", "value": "Iberland_Pd0704025001_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5bb3a6-1357-11f0-ad17-42010a9c0004", "comment": "Malware payload (CanStealer)", "timestamp": 1743992911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992911, "uuid": "0460183c-3598-4d34-bef0-1f8ba867c3bf", "comment": "Malware payload (CanStealer)", "value": "82d2360a2a870c0cff37c1480a579be2", "object_relation": "md5", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992911, "uuid": "9c186e6a-aaf1-4963-a185-feea9e64a5c0", "comment": "Malware payload (CanStealer)", "value": "77999fe551a530ca60e1acec2e013c86f8023013009f77abe6a414c3829711f5", "object_relation": "sha256", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992911, "uuid": "1b5752a9-ab2b-49f3-9415-85a45301d89e", "comment": "Malware payload (CanStealer)", "value": "39e1f43d0fb24f2f36ede3e2b30efeb9f20e1fff", "object_relation": "sha1", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992911, "uuid": "19af6b00-213d-4dd6-8e35-06c184511b71", "comment": "Malware payload (CanStealer)", "value": "2eaeb6e6c8b709b740937c345563b1a99b50ec36426a1e0a6ae57a2ef667b6972020a0007c2ecc6e880fdd6430255468", "object_relation": "sha3-384", "Tag": [ { "name": "CanStealer", "colour": "#FD6137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992911, "uuid": "4449a106-72aa-4c4d-b1af-49623ab97bca", "value": "T10E678D1372A50196E4B7D2388AA74203E773F8675731CBCF326D06152FBBAD0997A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992911, "uuid": "eb2f4c0e-67bf-47d4-b008-9699be6c18eb", "value": "47e33b9538febdf64d5eec782cbecf5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992911, "uuid": "15f7a445-a48e-49d1-967c-fd8f2eab7df4", "value": "393216:Xm+sFHI7EzNFAUYl8XRQo/gCcT5NB35jmxEsYAwD5UWsNWcxjQD:Xm+GCl3KNWclM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743992911, "uuid": "3b853f27-fcf3-4606-9142-6f533a3756f1", "value": 29894247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743992911, "uuid": "1463940a-cf3a-4a5d-a8a8-a5559c4f7cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992911, "uuid": "0e94e36d-f557-4bef-97a5-70fd0081721a", "value": "SecuriteInfo.com.Win64.Malware-gen.7436.28052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df84411c-13e1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744052128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052128, "uuid": "59d600c7-d95b-4142-af33-b333c5514cf8", "comment": "Malware payload", "value": "bbf02819c1db984c88b2d9eb46016a7f", "object_relation": "md5", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Servably", "colour": "#B4D00A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052128, "uuid": "c0aeaa43-a2ce-441b-b098-b7b74989ec4a", "comment": "Malware payload", "value": "77c7554f56d8aaf4666c31610c46bb7edaa11e19bf6905ffa30af127458ff279", "object_relation": "sha256", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Servably", "colour": "#B4D00A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052128, "uuid": "3102b35c-ecb0-4ad2-9db4-4eb27973ad2b", "comment": "Malware payload", "value": "8601f06cbdee2d9a40e5a6710f33677e22c7c13b", "object_relation": "sha1", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Servably", "colour": "#B4D00A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052128, "uuid": "c1106c53-0c96-4c92-9a25-1aa4345761d0", "comment": "Malware payload", "value": "499c541beabdb76d8ff6f7016e2ad97e2344291359f9a5ac4a6060b8a2b639960abea74891a5c2bdfd73d3252dcd9149", "object_relation": "sha3-384", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Servably", "colour": "#B4D00A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052128, "uuid": "8bb80c6a-b47d-4fd5-b1ad-8bd7e9a20dfd", "value": "T13FE5120323A7555AD4697AF3B8227081CBB6BE071A2DC67A6171758C0ABC743CF7126F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052128, "uuid": "10355502-3ce7-4650-b541-b64edc844a08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052128, "uuid": "7d7fe156-459a-4088-ba27-de2baad61036", "value": "98304:KxcaeYZ0kpkqXf0FWvnzmb23pOCy0hgxUriP:Kx1tkSIWs25+IC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744052128, "uuid": "43244c54-278e-477c-a14f-b29caf20af55", "value": 3269096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744052128, "uuid": "3ec9475e-4d39-4858-81ef-df306eee956e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052128, "uuid": "e13d51b4-f7c9-408d-92be-1cf5e99e0a15", "value": "NotaFiscal25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec75417f-13a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744027669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027669, "uuid": "5c1954e4-cfd9-4a1b-9502-c1ade6974fc6", "comment": "Malware payload (Prometei)", "value": "cd6be99d5a1ee3ed18e10db44d1105f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027669, "uuid": "967d0a06-9430-42b8-b20b-927c58ef25d5", "comment": "Malware payload (Prometei)", "value": "77f08d2e7dd5bf77b93a0df54fd4c8b441ea844f55ea7688dfb6bbfd4e48f348", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027669, "uuid": "3c6a909d-a4e6-462d-b17d-63708d2ae936", "comment": "Malware payload (Prometei)", "value": "b97d3e735977bb2ffb2364b71442463cc8bbf3be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027669, "uuid": "15f33db2-b9b3-43da-a1ac-8c361890896c", "comment": "Malware payload (Prometei)", "value": "f05f9c4312fabb23fa69d1fce2af09006f71490a60d548cd0505f13e6dd78189dcc7ad2f26c3da0dc1193131194d0f01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027669, "uuid": "bb3506d7-74cf-4e8e-bab9-ddbadcf0d17c", "value": "T1E5155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027669, "uuid": "3f9e24c5-34d8-4403-bbf8-1d5a7b639b2f", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplw:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744027669, "uuid": "62ce43f8-eb81-4e23-8b27-8e094912b994", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744027669, "uuid": "27336d47-b091-40b7-9763-c20f5d7baa64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027669, "uuid": "83c694ea-d59a-4de9-a199-ca0de57e402a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85bc4f6-13a7-11f0-ad17-42010a9c0004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1744027205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027205, "uuid": "ce38c01b-4523-4ccf-bcd9-34583e8fbe6d", "comment": "Malware payload (VIPKeylogger)", "value": "00cff8a6b7f92680ce6c7f0db3a07914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027205, "uuid": "85d686b5-3af1-4526-a766-5de44be5c045", "comment": "Malware payload (VIPKeylogger)", "value": "784ca29d6e45f56a97d28f11afecc5eb22cdc1114d3dcb75a4beb15823a83d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027205, "uuid": "2b0caeda-8afd-4f97-abc3-bfa53d88a4dd", "comment": "Malware payload (VIPKeylogger)", "value": "96a05471f800ccaee496dfe47ae977f591a0e2c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027205, "uuid": "2748dc6f-fd81-4d89-9c7e-c3b570a5a6ec", "comment": "Malware payload (VIPKeylogger)", "value": "3806c69a56e57717d364743526e5332262c53e6024f0e118834ebb8261e90b3debe47a230f25fb7fba50daf7822101a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027205, "uuid": "5ba3235a-68b4-431c-a313-a4c28c798c76", "value": "T193B423915DB0D1A7E940AF3224B768A76F31D61561719E2F63A0CF9E7E30AC0E80D379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027205, "uuid": "063f56a2-f840-48f1-b41e-4a4b59b37890", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027205, "uuid": "d5694f3c-c410-4ee2-b2a7-c2ef05de7fad", "value": "12288:xggqzQiWr4tMEvQ5ZIRL5GER2IXh8lqsbvPoW2Y:VqQCMKzdUIR8UYvPoWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744027205, "uuid": "0f6b72ae-9123-47ff-b511-df9e58eb2dcb", "value": 500579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744027205, "uuid": "4810f334-68c3-4b30-a37c-0105e20fbb79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027205, "uuid": "00f3bbcc-0ee5-410b-b4a8-74c53f5ebcf1", "value": "rFACTURA005780013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b645572-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1744024097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024097, "uuid": "84cf7d67-97d6-4814-99e4-ce998b407e73", "comment": "Malware payload (XWorm)", "value": "40c6da90679132c7a12f85eed007d9fe", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024097, "uuid": "85d64580-2877-4392-b891-e3652f1a4bdf", "comment": "Malware payload (XWorm)", "value": "78b15b9b54925120b713a52a09c66674463bd689e3b01395801ef58c77651127", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024097, "uuid": "54977659-557f-4ab1-9270-063505e0328a", "comment": "Malware payload (XWorm)", "value": "2c3fd2658e3b8f726d038ae8a954aca3ae6cac50", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024097, "uuid": "33dc437b-b0d0-4bf2-89e9-1fb27e7c2eab", "comment": "Malware payload (XWorm)", "value": "252ab633daf26e0a1e00de9686c032257409cd6460ae1ec648e3b5454a344e985a313c9d5b70c2711c1462f9685be64b", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024097, "uuid": "c1ffdcf8-d850-4880-af1c-bb86866a8244", "value": "T12384EF76934A96C745C8659760F01A2A1A591B82CC4BD234BDC6CA778FEAF031F27F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024097, "uuid": "74308a4b-d055-4d78-b53c-fe8c84afffb4", "value": "6144:JHZ8IPyPVGo6O5X+WMHCv6jjdx1/g/UQGTMlgcoyhTm/su0y2aG8Op74QTXnbbx:JHeIP66Ox+9CijcDOcV5mqywMGHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024097, "uuid": "13db3fb2-99c5-4e42-b9a3-326b2dac7b2c", "value": 381837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024097, "uuid": "840a3d92-a1f2-454f-91b0-011f43e0cc56", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024097, "uuid": "21160652-cb82-4fd4-80c8-0c8677c12e51", "value": "83.147.240.230 (5).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2591da25-13d9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744048380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048380, "uuid": "869d7338-7935-4552-b1c9-8d59d2a477c3", "comment": "Malware payload (Prometei)", "value": "753d455028a579fe649eca9a887eae89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048380, "uuid": "aeaac311-810b-4e7c-a270-7f8bf3c341ed", "comment": "Malware payload (Prometei)", "value": "7a6386e353295231640fe3dfc5d37855d567f3b526ac73163c0d9c2ef70fd235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048380, "uuid": "53c705bb-2a90-4a90-85cc-41cd0ce7b93c", "comment": "Malware payload (Prometei)", "value": "a4928215e5c08d31d90e86ffe9691475dc8db652", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048380, "uuid": "cc39d2eb-a4ad-4cc5-8425-8f646593e622", "comment": "Malware payload (Prometei)", "value": "07b6284063ee7049e023809ac68152899974f2d51b4265d72064e5be7e96792dbf0e1886cb72356de97a11b851135e24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048380, "uuid": "76ec7b97-5d56-4d4a-b18b-c06aa1db9bea", "value": "T12B9423F8C87D2E3098169B3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048380, "uuid": "b4150dba-7103-4cdf-99fd-9a594b0dfa73", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgM:25WOSACZSV6eKRH5EPiamb4DsDwwc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744048380, "uuid": "fc0863eb-e1ef-49c8-9157-29c12b573ecf", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744048380, "uuid": "850d8235-61b0-43bc-9dfb-3dab5e65edcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048380, "uuid": "c5f0b9ec-57fd-4fec-a61c-d8b70cae888c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc40e5f-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Arechclient2)", "timestamp": 1744028394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028394, "uuid": "a7382625-61da-47a2-86d1-a993e049b973", "comment": "Malware payload (Arechclient2)", "value": "e1b11ab17b672dc15339a4eea17d3be7", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028394, "uuid": "38f84b03-4926-4caa-b787-d90df39bf128", "comment": "Malware payload (Arechclient2)", "value": "7a79c311f24811999c14cef556da34f933dfd82b1a568b064034634941314369", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028394, "uuid": "12c7f648-910e-46e0-a3e3-d22eb332106d", "comment": "Malware payload (Arechclient2)", "value": "7dd1111c168f544929caf7e1ba8b2d790aa5ce77", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028394, "uuid": "c673b9e0-ceb4-46fb-b879-ed98d4f37e50", "comment": "Malware payload (Arechclient2)", "value": "f0d7c103e509785ea7f9652a5eff4b4a28b8b43235df53ad59c905d26d52bd6a0feecc5bb47453cd52c6abd0d5df664d", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028394, "uuid": "7dc6d2a3-cdc7-4853-a280-31e0416268b3", "value": "T11A66D00177D48472E55E43318A2DA72456BABD71877083C3B7D87A1E2D726C2EB32B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028394, "uuid": "aa15da85-a1ed-40ed-97cf-92198aa35858", "value": "98304:TRJYyhT6Sug1IPY2hiLOORwc3xyoZMEHGgS6y4wi36gZByUBXGo7FQ3:t9GjoKo/S6y4ZdZsUBXGYQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028394, "uuid": "ccb925c4-f99e-4ea5-9302-80db584e2421", "value": 6509020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028394, "uuid": "08cac682-3143-4884-9f55-f83a3b758430", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028394, "uuid": "91660cc5-fde8-4a83-87b4-36ae96a70f99", "value": "SLAGGGLX.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb92914e-13c5-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744040042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040042, "uuid": "3c819e9d-1a85-4285-aaa2-bf76a4bab77c", "comment": "Malware payload (LummaStealer)", "value": "982dfd3479d8d947eda0793d75e0dc2c", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040042, "uuid": "6feafd45-a16d-4090-900b-cfb3e0bde157", "comment": "Malware payload (LummaStealer)", "value": "7adfd8c6dffa2424d9d69f6b82695191f87d14d77dbc84e633ee1bac04380506", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040042, "uuid": "d36ca278-306e-40d6-80bd-17dbeba40281", "comment": "Malware payload (LummaStealer)", "value": "9c3d78a5e78b0bc9e6561a6cd9f6bb0ba31b6d03", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040042, "uuid": "80a93ec5-961b-4ffa-aede-c1585dee89d0", "comment": "Malware payload (LummaStealer)", "value": "ac083689019a6052c14c510ef23f68b33bb9f0984679097c22f56a1e9a1c3b25d80e513b0958d29f01804d0c78013df3", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040042, "uuid": "09430ca9-de3f-4918-baa3-799c73182098", "value": "T12825BE32F2A08837D1B31E789D1B82955936FD113F38A5A736E91F0C4F796817A272D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040042, "uuid": "097c7432-07ec-415b-a555-997f246b9df3", "value": "5ee7bf9f6582eaac86f806e2514790aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040042, "uuid": "85f5d514-41f7-449a-826d-790619a38d30", "value": "24576:XIZg9uiirPO37fzH4A6haDbcUZEbdT9TaWwtQ2FyxyRENaGW1m1HOu:XvqrPO37fzH4A6ha3cJ28FWuuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040042, "uuid": "dfe404f2-74db-4efa-be39-76ce9c1fdd86", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040042, "uuid": "0972db43-0e5b-4442-b526-8518de94bcb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040042, "uuid": "e03482ee-558c-4513-9913-50c3e0844e31", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508a6f76-1362-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743997342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997342, "uuid": "4a3e1bf0-9de5-40a5-9927-b20ca80b7c5a", "comment": "Malware payload", "value": "3aef01e5457d74163730d4de9b770ede", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997342, "uuid": "c3d9d913-1504-4489-80e7-6f6d5ed3274d", "comment": "Malware payload", "value": "7b7e46ba9db73dcb4c80e134cdff51f4da834f40459012dd61d12eddf2694e98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997342, "uuid": "0c7becc2-e09c-4cd4-afce-65bda9474188", "comment": "Malware payload", "value": "d4c8e0e29b782abc98f46902fafce976dd00a5dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997342, "uuid": "954ec1a3-2afb-4ea9-aa13-bf4010922399", "comment": "Malware payload", "value": "ae6314ead49fbf79f70d3b6a8270670e51108bfe73f0c58f7067ffa9eaa40d1f3211c71038a604138f86af042308cc35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997342, "uuid": "48a77815-48b7-4e93-a20b-1ac6ef74203e", "value": "T1BE935C31AA7A2F2BC0D0A17A61F74766F2F507491478CA1F7D610E9EAF29960320737D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997342, "uuid": "060c1b32-f1e0-46de-a321-87362d0ba64d", "value": "1536:RqSXd9wJootEq9zHN2DImW/Q837XyVO2WotxRKX1UCj:RDdOJoQ9prkCyuoIX1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743997342, "uuid": "2633c02f-1a22-4791-9ae5-9670af937d19", "value": 92364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743997342, "uuid": "ae4c6064-8e5c-49e0-b4f4-6d23304c4bd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997342, "uuid": "99c9d479-8aea-45eb-a17b-73246083ad1e", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecb8a75-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049416, "uuid": "9f486154-f1db-4667-ba4d-c847ddff85cc", "comment": "Malware payload", "value": "bb991dafdd848f8b335a301fc965f467", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049416, "uuid": "525491d4-31f8-4786-9cd7-17f4b7be67c9", "comment": "Malware payload", "value": "7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049416, "uuid": "a69c3250-5803-477d-b510-6356d4f4bef8", "comment": "Malware payload", "value": "ebb30fd99c2e6cbae392c337df5876759e53730d", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049416, "uuid": "b33debac-35ff-4170-a14b-3e87e0f118cb", "comment": "Malware payload", "value": "0e60c1ea66d7f060bbf484a883614f5ce4ba01b7aa7bdc12e68c00550e879d477b6d8a9f40f6b466f7b51c3d3ca05bf1", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049416, "uuid": "f294c7f8-5415-4b42-ba4b-2bba9235084c", "value": "T125746B3E74409F5AC46B4A72DAB6BF78D62AAE49D1C94847DAA0FBD731700E0081F477", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049416, "uuid": "7d0b8758-9f76-49b5-bb22-775729338523", "value": "6144:xZ+RwPONXoRjDhIcp0fDlavx+W26nAESeZT3hUrrFoAUzW4ZhUsvfmLlnhm3NBnA:nSehqrdUzWch5fKnc9BNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049416, "uuid": "15aced65-5dac-43db-8775-63439220e792", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049416, "uuid": "839dc8b8-9145-47a8-8412-992f7b7585fa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049416, "uuid": "8c36c507-c890-43b3-8262-366724e152cf", "value": "7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f454173-1396-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744019620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019620, "uuid": "01386765-0bd7-4a86-b460-f0cd6fb1ffdc", "comment": "Malware payload", "value": "0a04fa05e21d52e3e143c159f4d7ff15", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019620, "uuid": "89f3f14a-7669-432c-997f-bd78b0a2fb74", "comment": "Malware payload", "value": "7c66e462325232e88681b37e73f118d35ac23f54da59e3786f89c88da193f729", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019620, "uuid": "369912c7-fa21-4377-9e50-789124a7aa93", "comment": "Malware payload", "value": "c4c7be133db2c3673bd7fcc9d73c37a2c069b328", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019620, "uuid": "45d67372-922c-4d52-88bf-b1107e146c3e", "comment": "Malware payload", "value": "6666d14ff588117fc010657cf0422a33090d93fe3bebd0b582bea863e78ef4b31b13fe91ffe463264a3a3335249b33dd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019620, "uuid": "d18255cd-d44f-4f5c-9a88-3b98a31a9ba9", "value": "T1A405D0CDEE62A132D7E606B554979E3ACF727C0D0F31530A0B4872AE5D3B7442126BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019620, "uuid": "ded750d8-9068-45a4-9c5d-a356a902ce24", "value": "12288:1wHL0D7qztuKnmCCjQX7NKxRLmSBwrUKR/famOI6nqcCdA/auS:6HL0SwKnmjjQL0RySarlR/famUn3C/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744019620, "uuid": "62845f41-5578-4957-8b81-eda2f2f681ef", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744019620, "uuid": "aa39b1a9-b271-4258-a72e-81dd96dfd2f3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019620, "uuid": "50843f36-2e67-46d4-a7f4-c75fd577a00f", "value": "installer (1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85db49c5-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049401, "uuid": "9a21b2f6-1eec-4214-b82b-23c8b6c3a916", "comment": "Malware payload", "value": "4cd697cbc293336d443dc3db0d104de5", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049401, "uuid": "c20dac8f-1564-48e7-b1d6-68f0942a32c9", "comment": "Malware payload", "value": "7c8b4b560a8f2286eca7d65d9a9ee043cb3a5feb1ef5a26154cb8e48af975b72", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049401, "uuid": "fb24de7c-622b-421c-a512-7580f10914eb", "comment": "Malware payload", "value": "e37070f68abfc7465ed1799a898949d6ef24b0a0", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049401, "uuid": "4bda9a80-76e3-49d2-8e4a-4e62d2b2c07c", "comment": "Malware payload", "value": "790226c68800d8a89d128273fb65112f7725e5b1c444843645d049f3106c5e347875c625d74331d5c00060c259fcbe40", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049401, "uuid": "158555ee-9dc4-4432-b78b-596eaa16076a", "value": "T128B41261F144A227C557C6B2C8D1CB5F4BB2BC141B5AE45B639873FC0435FACAB2B868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049401, "uuid": "fe147b96-5f29-47f6-bd91-ec205972d188", "value": "12288:vshijFLuYNWwrJqWqoulSB/wKD+2upveGK7eLPHLGFLpB:vVjFLuaVqzouU8FeJeLPqFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049401, "uuid": "3af7b29e-4cb5-45d7-bc85-63ab4fba184d", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049401, "uuid": "0a459c50-586a-448b-9d7e-236f5437e700", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049401, "uuid": "cccff651-63e2-4525-94d7-1e34df2e9e9e", "value": "7c8b4b560a8f2286eca7d65d9a9ee043cb3a5feb1ef5a26154cb8e48af975b72.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961ebe61-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1744024088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024088, "uuid": "57c6bfc6-8c01-4fc2-8721-1a159b07c71c", "comment": "Malware payload (XWorm)", "value": "f1f94b0f9cba91cc35a9e5f0f0963f9f", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024088, "uuid": "edc5b045-0aa5-4dee-8dc8-27aa7049aba3", "comment": "Malware payload (XWorm)", "value": "7cd62b603bafabfa299f4823866cec33ad4caab2f549bf1837f119b93c3f645c", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024088, "uuid": "8ecdbde4-180b-4d6e-b717-1ec121ca419d", "comment": "Malware payload (XWorm)", "value": "7a2919a0b3215b55530835624e396fb83237a88f", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024088, "uuid": "dd369843-0d11-424e-92d4-7c1f6fb886a7", "comment": "Malware payload (XWorm)", "value": "878bb7f572be21fb1247bc7185219becc446f8419346a4cf0dc124f61bc8e2fe9e9a1b302532e3413a11ff36c19ef770", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024088, "uuid": "354bc36b-5164-4e2c-b0dc-60592e7248a1", "value": "T1ED63A0313402BDF5627ECD84E21428B1FC55351F56A68E7CBA8388781FB64E09AFD8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024088, "uuid": "3c3e3fc6-799a-49da-925b-bb69819c9227", "value": "768:FoDi6H5262elERh23pVmXCdroULqEJ/nb4crRsILJlLvdcTUJyKEcY21G3pp1lC7:F25P27RyBoUrJ/72cv0KEcBk3p/lC0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024088, "uuid": "8bc8527e-0941-430d-a8e9-2bf71d9a2b3c", "value": 67427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024088, "uuid": "d36f35d7-a235-41ad-9d0a-5939c5887fda", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024088, "uuid": "9f0c1e79-ad99-4b59-ad54-a0a18bb16f32", "value": "83.147.240.230 (3).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80a2552-1345-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743985034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985034, "uuid": "39ab4138-d277-4914-9b3d-327c74d889a7", "comment": "Malware payload (SSHdKit)", "value": "9283a779e406acb2718a77aa7d803895", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985034, "uuid": "1e4c3503-8cfe-4523-8f23-ea997ab194c7", "comment": "Malware payload (SSHdKit)", "value": "7d5d64e06cc9ad419efe9d366cd63c8f73ec2b428e177c0fc236977a36024111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985034, "uuid": "f4df42d4-9ce2-4bd0-aa50-792eb46bf2a1", "comment": "Malware payload (SSHdKit)", "value": "a8578e7a0e461406167cfea1127103018dda8b82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985034, "uuid": "f16c5397-6794-418d-8076-cb6258e76cf3", "comment": "Malware payload (SSHdKit)", "value": "26a960cb486569e8c2dfcda9fb56c89c203010515df7e6b7498107ab2b898514fe0278266cf34b14d3a7325cfd2d3d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985034, "uuid": "c6ed2629-be90-4814-8dcc-58c8d9464dce", "value": "T165356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985034, "uuid": "c3a25172-ff46-4ed7-85f2-02eb882b9581", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVL7bLv:E8dbbsO38+TfgRinIVnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743985034, "uuid": "a5d967ec-833d-4c66-8794-16fed879ea2c", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743985034, "uuid": "f654940b-0f46-4c2f-9701-6b08795e7be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985034, "uuid": "819fe076-66df-415b-accb-da2e3865ce49", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e4f4c0-1409-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744069069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069069, "uuid": "da3c0655-c743-4197-a493-c7701c16393a", "comment": "Malware payload (Prometei)", "value": "d9a10e900cff9f9cf21a672ea9853d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069069, "uuid": "18c8a034-863c-4c8f-9a48-cf39d33126de", "comment": "Malware payload (Prometei)", "value": "7e35b82a7ab2870f1428e750a9f4170a7e463b81458d3a733706ac6d4a51f92a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069069, "uuid": "2096c7e0-dfb9-4231-894c-ec92dd0fedad", "comment": "Malware payload (Prometei)", "value": "52dfa196530cc6057da057275e2301566eb6a59a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069069, "uuid": "5c781ed1-8335-4c7f-aa33-a12b60265be2", "comment": "Malware payload (Prometei)", "value": "c492cb3872ceb26d4345cb688658df41ee965307085ca3ff67b2b40e26b1e43a7a778bcee738099952404c96373ecabe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744069069, "uuid": "3ddfa2e0-5cd6-4650-982b-b7c90e1e06c3", "value": "T1549423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744069069, "uuid": "3ee0c39d-5ad6-487c-8ccc-8784503f5398", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg9:25WOSACZSV6eKRH5EPiamb4DsDwwcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744069069, "uuid": "d4bf876c-defb-4faa-a248-ea71d68a7978", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744069069, "uuid": "820f4acc-4fe9-4816-bffa-9dba30e8fca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744069069, "uuid": "bc730d05-3308-421f-a9af-59afb20d4d8b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eaf6549-13ef-11f0-ad17-42010a9c0004", "comment": "Malware payload (Loki)", "timestamp": 1744057898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057898, "uuid": "dcd565e0-a715-47ae-8116-cd8452803c64", "comment": "Malware payload (Loki)", "value": "b5f1b1e2ed61f80eda38ff8263732d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057898, "uuid": "e09bab1c-be38-4963-bcc2-acf21c84a73c", "comment": "Malware payload (Loki)", "value": "7e9e014b4127363351ff22d500de90a9872a8d8fcab328277fabd7fc1f4b5c6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057898, "uuid": "e7a5154d-31a8-44d2-a480-ca19d950c9ad", "comment": "Malware payload (Loki)", "value": "53a0a8f4b6e589cc2054b741a7f32415aa92f8c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057898, "uuid": "326dad46-02b1-43c2-8f1f-531b6dd25c62", "comment": "Malware payload (Loki)", "value": "02ec03218379e0febdc750fa7807df8ffcb3bf9b1f6d8c462983a457a8ef877204d281da0d73d21e1720a46cb8bef0f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057898, "uuid": "4a6618e3-eebe-489a-a609-4b0a2b11c20a", "value": "T1E4D4E0A4326CDD13C4B653F22960D27403B5AE9D6921D3CACEE67CEBB8E4F411A10767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057898, "uuid": "24ce53d3-0912-4c90-83fc-f9dda0be80d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057898, "uuid": "897122e7-9fd3-4b31-8b47-b1eac4cc9481", "value": "12288:qYkYqBCCwfje+MmxC+zOWEDFYig4jVDUVIg5ilC0i:jfbrCUgNgyg58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744057898, "uuid": "937f33de-fa6e-4cc1-b110-455f743fb79e", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744057898, "uuid": "4dec8c0a-2ad0-45a3-b17d-713deec8898f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057898, "uuid": "69bbf10d-807f-4626-8320-594e2774696a", "value": "tfqHNUJxJdFp8T0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcde8a3-13ac-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744029040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029040, "uuid": "ec4ebd70-162f-4341-9ed1-1b2cc1047694", "comment": "Malware payload", "value": "41e269cef3bd9fbdb91b8efeee228c73", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029040, "uuid": "091dce94-152a-4d99-8578-38f55f5d4afb", "comment": "Malware payload", "value": "7ea3dfe39c60b8e3cba65cb573df1a4c774c5c299340612cd230afde7ac334a2", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029040, "uuid": "375159d3-cf1e-49c9-863b-97ef9f656aa6", "comment": "Malware payload", "value": "d029ea68e2678a4245bd802ac5a468d516e250bc", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029040, "uuid": "6c527202-31ab-4628-be0c-d3dbcd71b770", "comment": "Malware payload", "value": "569c7e3ecaddf09a728c00d2f96a2bd35c0d56f73bd6c7efbd1a4791419f7ad7ac1fff4997f775e134f66b93fa586296", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029040, "uuid": "a7489da0-24c6-43e5-b679-159bae5c7420", "value": "T148610EEE674B24E03378ECB1664825C58B4F776315DA6534722884A70EBC07BB4638DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029040, "uuid": "4315b5ac-c3ad-4d8b-96dd-c485d57eaa4a", "value": "96:g1N4in6oaNGwk0mLP/YFMyfmf4Jib1sBJ2j7ddpF4aRu:gPneXZUoaRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744029040, "uuid": "370d4c8d-2027-47ea-8523-252ea0464f37", "value": 3403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744029040, "uuid": "5963f884-15db-42cf-842e-0756b0a1b545", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029040, "uuid": "1f01d552-4ce6-4698-8feb-a874bcf5e190", "value": "a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f653a4-13b9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744034879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034879, "uuid": "7e99d51f-5559-4b2a-93b0-fd313e728d7e", "comment": "Malware payload", "value": "d79eadb297aa658ecc5d1a7d48355c64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034879, "uuid": "9f0f688d-97b0-4b20-88b5-3967d51bd5b5", "comment": "Malware payload", "value": "7fa4524e1a162434f89479ab4b925696ff2940ce79ce796698927f74cefe0f82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034879, "uuid": "44541cb4-8e27-43b8-98a0-a121224c2db2", "comment": "Malware payload", "value": "2c6079273ee74fc490c517ff233975640250219a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034879, "uuid": "194d0712-2519-403c-9e34-c1146045b02f", "comment": "Malware payload", "value": "028b8cfce41a4bcc84601d4674e785511b0fc590202aa046e2d69906330ec7460252346e82f10458ea5116ffa5765a94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034879, "uuid": "31fe4ad0-a2ed-47db-a256-06a72416d3a6", "value": "T1A4831229135914E5DA2585F193FD1B84BD981FA9CEE2EC156C12BC88EE333AD3CD2618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034879, "uuid": "98279740-bda5-485a-92a3-f30e18045c0d", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgsaVEfyq8PxlRkp2K3/J1V+uBNu:yYI0ARqw1qAEv7UIFM8oJorFiyjkRkpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034879, "uuid": "99789910-65ab-46c6-955b-50f5f4932515", "value": 85232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034879, "uuid": "62202c47-e871-420c-9a53-6ffb5446b18a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034879, "uuid": "d3402323-e9f6-48d5-99d8-5ffd5290a339", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571c1d9d-13d6-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1744047175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744047175, "uuid": "aaa7df8c-fdac-4e43-80df-babc898558ad", "comment": "Malware payload (SSHdKit)", "value": "3eff4ab0822c17c566dc181bd41c5124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744047175, "uuid": "ae1236d9-7ae4-45b9-97ba-606f2b25c609", "comment": "Malware payload (SSHdKit)", "value": "8083ff1ecdef3eda1a4ac7a49e83cec18b6a4895c6d1e63a30e199f8f04e6aaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744047175, "uuid": "d0a5450b-1c5f-4aa3-9753-23b4eeb5da9c", "comment": "Malware payload (SSHdKit)", "value": "26ed7c4d5120a0fc12b046743b8baaa49a181648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744047175, "uuid": "4d891a00-68dc-49f7-978a-fe83adeeb09f", "comment": "Malware payload (SSHdKit)", "value": "7f011024758eebd3002f46ffaf829beeada5849f5aa0dd0e677be25ad5d1c8ae401bd83cc0d704a25a4b4a1b82f0028b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744047175, "uuid": "b50a0012-2d5f-4c9d-ad7a-1a003c823b6d", "value": "T164356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744047175, "uuid": "88561145-5394-4cd3-9309-c484306a15e1", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlEaUxQ5TVFQGl9eLtRajZa6ZTxIVr7bLv:E8dbbsO3E+TfgRinIVHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744047175, "uuid": "5668beee-4d7a-425e-b811-b5268d04c673", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744047175, "uuid": "3a5f08e6-1ea9-424d-9df6-bedb2541bf0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744047175, "uuid": "de612e24-b99d-448b-9a0b-d8144c0d4488", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d814ea2-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744050514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050514, "uuid": "3273e73c-9747-45ee-9d76-cf006bddad7d", "comment": "Malware payload", "value": "560de4a8debc0d6375c082d8ac710f2b", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050514, "uuid": "048bb8eb-a46d-49f4-8377-9d49136962de", "comment": "Malware payload", "value": "80a5003312673420f18356b8cf721a9e4fdeb705c6a9bedf516356dad29b92a5", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050514, "uuid": "a37bd249-d2e4-4cf1-8f97-e8510ea0fbb4", "comment": "Malware payload", "value": "cea5122e49eea9d5828131ad44668f1e7f2abb27", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050514, "uuid": "ecc43017-b292-4fae-8fae-7b7599be5b4f", "comment": "Malware payload", "value": "7c38b959714fcbaa811a9f639e9ea5d2e1a7131c0a62a00563c7e390ae5de1b52d6cc1edf9f540d3e1e220092ca62f9b", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050514, "uuid": "676b9ea1-de27-4148-8984-6facf6f03ea5", "value": "T15A5523247DD4C916D0DE337E49CAD4911324AC542F78949F3EAAB32B6C347F229C6AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050514, "uuid": "6d4996b3-06ac-47d6-b490-dbf32b83fdb9", "value": "24576:Sr6mDiqxiZNecvW3G0l2H769koBl5la0aByuaYbP+:otD4ZNtW3G42Hk1M0aB+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050514, "uuid": "4625b39e-b673-4d52-93bc-ed07ccb36faf", "value": 1297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050514, "uuid": "b642a2fb-b859-42ed-a338-b2bf54c87b83", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050514, "uuid": "699c88b4-05c9-49bf-b191-ddb5db9a3568", "value": "PO#4500550389.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e969d4-137a-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744007762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007762, "uuid": "752b3667-4e18-48d2-a05f-9b94238b2574", "comment": "Malware payload (SnakeKeylogger)", "value": "83792964e40a22bcfc1e2f1306b0bf45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007762, "uuid": "353fbf9f-cb6c-43c0-8646-8b3ce163afac", "comment": "Malware payload (SnakeKeylogger)", "value": "80b9229be143dc6f0ced2e037e4b3354bd364c90bc39b47ef5e65d6bd196a91a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007762, "uuid": "2ab221ab-05b9-44c1-a181-d4c9f067b054", "comment": "Malware payload (SnakeKeylogger)", "value": "d63bd6e28a9121437b7058a7431e47f646a2eb24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007762, "uuid": "7560df68-9cce-46c6-8e4b-43fbdbcd82d0", "comment": "Malware payload (SnakeKeylogger)", "value": "75cb56c34efb4a8274ad6bb3d139336d31117a85aa816f302f377dda1841b713394a5201771e16f81888b0127ebec214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007762, "uuid": "2cb1193c-c64a-4347-a51c-70d7e4a97e82", "value": "T145C25C17F6AC4A22D16AC77EC49BD5033328A2869B13C91F759B3F833C02326DA35657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007762, "uuid": "0f829eba-359d-4897-a619-49f1bb8457dc", "value": "768:FGs3AsCroTuXk3Uos9Ewn0KSePu8whZx2zC+:FZdTB3BYH0lCu8wcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744007762, "uuid": "91816f5b-7055-4f96-bae9-cbb5bb40a6e4", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744007762, "uuid": "60e474ed-9b52-4ceb-9203-b161bf742bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007762, "uuid": "47dfaa3e-6e94-4364-b004-afcd26e53025", "value": "zam\u00f3wienie 12832025_pdf .scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57874ce-13c7-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744040998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040998, "uuid": "cd7c9f67-4e24-4a06-ae63-7437cb7585c7", "comment": "Malware payload", "value": "bc1ce5e50d421f5d6568c884a1fdc4c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040998, "uuid": "ebd93800-e4ae-411b-877a-9c41422417d7", "comment": "Malware payload", "value": "80bd4b9a29abcddab1446544af56cbcfa21739de5abad95f9d33215a263a8a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040998, "uuid": "63f8d685-a066-4bf0-a4cf-068d04025d97", "comment": "Malware payload", "value": "65c346f4a1a898e346b1e53a132e4644e3df9bde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040998, "uuid": "27bae7bf-5890-4a25-853f-68087ac2da3b", "comment": "Malware payload", "value": "4fb7551f1d74bcdfa2712b96158387761c56a62e2821abefd8ba184ce490f58df1745114e4cd9a960a9a48dace2a26b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040998, "uuid": "086522ea-deb5-4f41-a6d2-9007e83ec245", "value": "T1921733A6A4D811DCFFB38B31B2DB2255B68135366F75885D36CD28032533887DA86D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040998, "uuid": "cd2a354b-6aa1-4615-877d-e0d420f96418", "value": "6259b85283a9c282defcb5bc7f59791f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040998, "uuid": "42030712-e20c-4d0b-aea3-c796afc12072", "value": "393216:PGEiQCGkghFbWqFSb0Ja5xx7O4ywN7gsqVxqJEsoaU:PNlkWFSb0Jix9yW7dkRsoaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040998, "uuid": "1d15b2ab-83e1-42fc-aba3-479f1814c2d4", "value": 18871296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040998, "uuid": "b476bf8f-5e2b-44b2-8255-dad8e33d7812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040998, "uuid": "bdf5a825-cf11-4f42-9145-e94ff36fc71b", "value": "bc1ce5e50d421f5d6568c884a1fdc4c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b1f2bc-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (PureCrypter)", "timestamp": 1744034536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034536, "uuid": "06e4c652-d3f4-4c9b-8ca9-c0d4613ab697", "comment": "Malware payload (PureCrypter)", "value": "a3436daba6606664e9b0d00d6465ed80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034536, "uuid": "0cf35ade-c9d2-4382-8db0-d487ddde343c", "comment": "Malware payload (PureCrypter)", "value": "80d82a8d5d67347b0e4d5de53f5849ead260a28ac74b347aab00520293ae2b4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034536, "uuid": "3aeaca82-6c58-4545-aa1d-63d3d2417eb7", "comment": "Malware payload (PureCrypter)", "value": "e5b95ffb762aa67002bf97457a6ecb777e019677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034536, "uuid": "b96ccb8a-ed80-4007-b196-c65978cfa5b3", "comment": "Malware payload (PureCrypter)", "value": "6f7a3458a03562e345528cf3ef0bf66ea96162e4baf3a72d10f5e18ff242dd0574a18794fde063572586a09377ca69a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034536, "uuid": "95901612-9f9f-42df-a471-a14c3fed8a90", "value": "T119E32973BAFBC863C645477AE98A451013F4ED87EE43C31AF54A1F2A09073FA5A4116B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034536, "uuid": "a5209556-5996-4f91-9f92-7562f71418d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034536, "uuid": "72644b9b-d452-410e-b95c-83a50831d30f", "value": "1536:2hWvonms5sISHF7tmwfZKKS4sdZ5SfXRyxL2mcndTyssajcStBuQFZQ7j5Q7QVR6:1YSyvdSfXRypcnwssaTu36sT578", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034536, "uuid": "1fce56ad-7dfe-4c39-abc1-c700c9cbc46d", "value": 155512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034536, "uuid": "cbad8e0b-13f0-4c5d-adc0-374dcc6b0ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034536, "uuid": "fd27509d-2fe6-40ea-8b78-4688cfb073c3", "value": "80d82a8d5d67347b0e4d5de53f5849ead260a28ac74b347aab00520293ae2b4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4929cc31-1365-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1743998618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998618, "uuid": "3b6ab600-8041-4444-afd5-1232a8242688", "comment": "Malware payload (MassLogger)", "value": "488e421f0a5d2912620f7453c844527f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998618, "uuid": "43c24c0b-ae56-409a-8ce1-a8d5dc30e96b", "comment": "Malware payload (MassLogger)", "value": "80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998618, "uuid": "3e075d9c-5bcf-42ca-901e-0e8d330d31c1", "comment": "Malware payload (MassLogger)", "value": "0b08a3b0117479d50e8f7c47cbe280cf696ef659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998618, "uuid": "e99b62c5-6140-439d-ab02-58f86abcf0d4", "comment": "Malware payload (MassLogger)", "value": "0207a01cf126022cc7368be1c627e404f629c3d3f89b0203b5c883cfef3d4217f1d1a0f989f04b8b0943a1825cb877c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998618, "uuid": "cb859315-e6c3-4bf1-8ab5-05f2ca4d59ae", "value": "T1BFD4DF6433ADEC03C4B652F54820D27403B59DAA7A22E3C6ADDABDDB7CE0F4559007A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998618, "uuid": "5f90e7d0-11ee-4716-9297-3b3169cd8771", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998618, "uuid": "27da8f5e-1d12-4c32-a6c3-3497dacea040", "value": "12288:zYJYqBCCwfGs6MP6ObgU+NknkzZzmLHokVlm4BmpKckU/Q2Ddtu:xf+HO+CnkzYLHokl4VBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743998618, "uuid": "2e0fb330-5cf8-4a1e-a3b4-6edda383b01e", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743998618, "uuid": "66045e9e-627c-4618-a5d6-d2afa76bd197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998618, "uuid": "bd100e9a-7537-4f08-988e-199d50898159", "value": "REQ NO. 88484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d106c0-13c4-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744039599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039599, "uuid": "152fd425-082b-4454-b8a4-e48d91926eb8", "comment": "Malware payload", "value": "1ffe88a6242836d88b17c986461fa469", "object_relation": "md5", "Tag": [ { "name": "191-235-90-134", "colour": "#2CB71B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039599, "uuid": "6be0b2e6-e325-48da-a93e-c775c5539452", "comment": "Malware payload", "value": "819726e4261d836ac4d9d1b0c12b2d8bff008a2dc111c9457dca0d5eca6cd5b1", "object_relation": "sha256", "Tag": [ { "name": "191-235-90-134", "colour": "#2CB71B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039599, "uuid": "f28c1f56-fd77-48bd-b065-0d184a5e0066", "comment": "Malware payload", "value": "6a6fc00f745ad43499dad9d409ae1a5f57786bd9", "object_relation": "sha1", "Tag": [ { "name": "191-235-90-134", "colour": "#2CB71B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039599, "uuid": "2ef0a0c2-293a-45af-a5cf-b74e1eb5a79d", "comment": "Malware payload", "value": "1c82307373089309bb32d4d0577828ce53c131ee9c8f9f3438abacb18f44bf9fab5484220a8e323c8d77ebc591bcf97f", "object_relation": "sha3-384", "Tag": [ { "name": "191-235-90-134", "colour": "#2CB71B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039599, "uuid": "2a65059e-b6ac-4ddf-8aed-b129170c2e17", "value": "T156372381B982A4B3FC44F3FB00260A0EA3698571BF45D74739AFC5A46F4E6E4AD954CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039599, "uuid": "ddd25261-7be1-4586-b3ba-4b9caeb2f5b6", "value": "393216:FzQgKYzyxdXr/lrkpzrY+aHN21SHd0KuPIZm9Uc9x19uWYUW/3s:Bhzu7/1ovitAKruPBd1E/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744039599, "uuid": "58de1567-8f22-4297-a405-4daad48ceb5f", "value": 23241982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744039599, "uuid": "d4b34f1e-94c1-4006-978c-81ace3ec994f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039599, "uuid": "fcdc8bb4-e9be-40c7-b355-b06547db33cc", "value": "GetBrowser.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a4b0f6-1363-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743997643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997643, "uuid": "06f4698e-eb68-4715-ac7d-869030b16253", "comment": "Malware payload (Mirai)", "value": "2b1c2001798fb2ad1cd0c6657c6e316e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997643, "uuid": "ea8236c4-4401-4fd2-9de7-b76ad5462570", "comment": "Malware payload (Mirai)", "value": "81d240a5d99bc948a58d3d7c746b39c4f36848bb4a6c488fff2558a9ad17c1ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997643, "uuid": "98530638-42ab-4365-ae07-07f24a0b7651", "comment": "Malware payload (Mirai)", "value": "727265261893349f5b40a4e149b492733ef16aa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743997643, "uuid": "3f070bf2-f7de-451c-af79-b6b36d447bbc", "comment": "Malware payload (Mirai)", "value": "62ad219878f191797a37495fd1b191659dd89ea5c072792a4e0235b46d05631318ce3cf5ef5dda5ff3b32378bda0078f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997643, "uuid": "71f769fd-70b0-4548-8530-b452a33d1d51", "value": "T167833A4ABD829B61C9D52279FA1E518E33131778D3EF72128E201F2477CE96B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997643, "uuid": "db41be75-c0de-4d37-8d1c-0dc82c1707e2", "value": "1536:MlnybjYPYLDsbow5XDwiYwowNTmRnMrlLfRZQsyJbMM1i4Y/OJf9:54PYLbw5XDhrvmsdfR6Y/OJf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743997643, "uuid": "c2567475-744c-40b5-9f3d-d3a6cd880562", "value": 84300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743997643, "uuid": "1fc93b17-171f-4af3-ae5a-97159efc529b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743997643, "uuid": "3b2c09ad-7990-4725-8bd3-4583d0285c5d", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd66dc28-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994948, "uuid": "f9935e73-593a-48a0-8638-d6c246bf54f9", "comment": "Malware payload (Mirai)", "value": "3266ae597d5a38efde17cbd1db98f71f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994948, "uuid": "15920a68-76ae-41df-839e-fee40c89c3d4", "comment": "Malware payload (Mirai)", "value": "827dcbd314ca7580f5be57866e233d7006ab43c43d83883fecf3bb59f74b5b96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994948, "uuid": "cec959cf-0e6f-4149-ac61-e9adf045cb4d", "comment": "Malware payload (Mirai)", "value": "9731495b1cf746e903c6f66d1e63948c1f2546c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994948, "uuid": "19f3ddbb-db96-40fc-9fe8-b83a2c6ef41d", "comment": "Malware payload (Mirai)", "value": "aa1a88e1b932b11bf2bb76c770edb41f82bf54611260cfdd38973ff22650373d7e9a95e4a46791cf157995212a468462", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994948, "uuid": "f27d72c2-c16f-44a2-97e9-7325929c3d20", "value": "T1A4434A03604151FCC8CAD6F95A9F9A66D973F4782373B12673C07A1B3E5CE606FAA244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994948, "uuid": "0bdbe21f-b6f1-4ca3-918d-381b178afab6", "value": "768:eUB+PvK+9xCrr7BXBIkuXXJbJU/iyCuvp4Zh3jk9I00Iq7:/uLPC/NXBPuPU/Xvp4s9I00d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994948, "uuid": "b4a063ee-9fb1-422b-ad55-c902fa685267", "value": 59184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994948, "uuid": "4a61c44f-1600-4f1e-b6e4-6ab66c158568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994948, "uuid": "c0bf6617-78c8-4def-983f-c8b75feebe6c", "value": "resgod.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad575869-139b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744021979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021979, "uuid": "ece075a6-89f9-4092-905a-9102fdc917b3", "comment": "Malware payload (Mirai)", "value": "1e3360b456490d16449a9b6e9aad2e6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021979, "uuid": "8cded10a-6325-4f29-8b31-1bc3aba67686", "comment": "Malware payload (Mirai)", "value": "82d2ee2d0284823d5b90328c55a5642e6599a382d2bd23576ebf17d448a97480", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021979, "uuid": "101f9046-e6d6-4047-b65d-33780a84539b", "comment": "Malware payload (Mirai)", "value": "d246a4ff42d9d578af0b7538744f26d340564c48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021979, "uuid": "607deffa-a5c4-48dd-a1f9-c6bd4bb54f71", "comment": "Malware payload (Mirai)", "value": "cc68b6e899a715a083fb563112a809bc809336602ea09143bc9cd85b658907ecf5b9d379ff9e24897918f48306a8caa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021979, "uuid": "ed6b2a39-7c2d-4f80-9044-b033793795e7", "value": "T1FAF2F2875D39D285D812D7F072780B536923E362212752AB67D85FE1DF13EE6608EF40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021979, "uuid": "906671e5-f300-4db5-9e70-1daf41cc3a01", "value": "768:xd3gu8DtN93CtChX7x2f4CjxE4qxtDua5BNKmLMTgiVAHFyIW:JEtn3+CFejx457Kzf6lyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021979, "uuid": "b6d4f5b9-4021-493f-92a1-eab2f8bc34f4", "value": 36668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021979, "uuid": "82f2fb8c-3062-4c51-91cc-d3017822ca83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021979, "uuid": "2795c3bf-ff54-4145-b1aa-5f2b20467528", "value": "hanoi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6ce120-1346-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743985338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985338, "uuid": "1d6de98f-c262-47da-9cfd-301a6c758601", "comment": "Malware payload (Prometei)", "value": "77170b9953adfb427f41988b3373d7bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985338, "uuid": "3bdc31d7-6905-4736-a2c1-9a9760fdf59b", "comment": "Malware payload (Prometei)", "value": "8360038df59be2925409fdd42618f60ca5a2b2afb3bb73365b4145a63a3a3a69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985338, "uuid": "beec949c-c05b-414f-809c-2b0967aa0a1e", "comment": "Malware payload (Prometei)", "value": "f0f8ce825576f6de4f7a1ca7c457d61a5d552198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985338, "uuid": "39bffe78-63f4-425e-bb8e-9bb53424410b", "comment": "Malware payload (Prometei)", "value": "732f8cef717fd147f36f78f403add5e329be134bd4354b19fcc90e4b70b702056510aaeeb8030eb78c529bf2cb0e273b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985338, "uuid": "ec172525-601e-4449-a316-25a5af7955de", "value": "T13C9423F8C83D2E3098169B3CBB1A826CF0E15772D9562B7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985338, "uuid": "c019b65d-dc63-4539-b037-244ad864897a", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgM:25WOSACZSV6eKRH5EPiamb4DsDwwc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743985338, "uuid": "5f933dfa-5c5e-490d-8593-4a9f3bb992a1", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743985338, "uuid": "57aacef8-cef2-4457-8d5c-c920d0237200", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985338, "uuid": "e9d597c5-cadf-44d7-8555-95d0dcd49fd8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8dac94-13e1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744052096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052096, "uuid": "dd841aae-4a14-4b52-aab1-0f72be4fb1d0", "comment": "Malware payload", "value": "c1568382ff7e057efe1c02e3a590e017", "object_relation": "md5", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052096, "uuid": "5b8a1d3a-eab3-4154-a2d5-66e552920a3e", "comment": "Malware payload", "value": "84463241f0b57598e336497a4f221f2b2a447eea56ee37a9a14f48a2af800029", "object_relation": "sha256", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052096, "uuid": "f49cc680-6a06-48a1-a870-b59f901d460c", "comment": "Malware payload", "value": "65dc515a91fa57be682874257da817631b7f2cbf", "object_relation": "sha1", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052096, "uuid": "b045f64b-5952-455f-ad11-a3edf221422d", "comment": "Malware payload", "value": "cf6be0cbcd7f37186dd019c9b91661b8d044a2ab3a2eab193e4e8ac4a1f7cff2e74ae9bd2b7e76d14580abd72d374703", "object_relation": "sha3-384", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052096, "uuid": "418ffc75-d49a-4d0a-9fba-f83c254eb6a4", "value": "T1B7F38C0A67F821A6E8B7577584F602838E327CA15B3842FF12D4D57A1E336D0A932F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052096, "uuid": "c543e11c-dff6-48a0-90da-c7475aef51c0", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052096, "uuid": "64805697-2c3c-4b1f-8e39-f6d9627d5aa6", "value": "3072:PahKyd2n31D5GWp1icKAArDZz4N9GhbkrNEkpS4oR:PahOfp0yN90QEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744052096, "uuid": "5948ecb9-2a77-443b-86f1-66144c545164", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744052096, "uuid": "6a138fc6-3a12-438b-8972-e339a2426e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052096, "uuid": "b815fe1c-b42c-412a-bc3d-78fb3a2e786c", "value": "bola.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db78896-13ce-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1744043696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043696, "uuid": "75c5c329-8d8c-4187-b76d-e56c032daad7", "comment": "Malware payload (AsyncRAT)", "value": "6c0b740a341f15c8b1f087aea0538b73", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043696, "uuid": "a50f8353-b8b1-45d1-a60e-ced30e2c41d2", "comment": "Malware payload (AsyncRAT)", "value": "84925db18aa418d28558258bc52e68bbb8747143623ce2ab7fb1f0a1034d67bf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043696, "uuid": "4b85a228-f362-4858-8e2a-2a35459972c0", "comment": "Malware payload (AsyncRAT)", "value": "610fcac620efeafb356399c146331339fdda4371", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043696, "uuid": "af7b15f8-ead8-413b-8f11-69a8ca0fb963", "comment": "Malware payload (AsyncRAT)", "value": "93fa3211da2689338c676ac22e1ed0c7d42fd57e3bc6d125936d386bea247a45f6ad73b0269a138f0f2a29a79258688a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043696, "uuid": "239663fb-74e7-45a4-9bdf-456ab67b3b52", "value": "T143B633180CFD0E8E85B46925D87CDEDA7B6441B39C978B1A607C526225FBFE112CD23B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043696, "uuid": "4994f8de-762e-4639-b522-f41d713b6972", "value": "196608:cm4wujehTaDdmaNkXOKueSmCPUwhpCVGI5xjSWXXasyfmZ7D1xJR4zvJpTe/ieec:c3jeFSdxoO9/K00Z5xLvwe75RSJkiNfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744043696, "uuid": "239d0468-e2aa-45b7-8ce5-171255acb1b2", "value": 11455041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744043696, "uuid": "94f822bd-4ecf-4d57-b0eb-990e2d38ae1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043696, "uuid": "37310d59-4a6d-487b-bbc0-2b382222f5a7", "value": "newweb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45da9e51-1344-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743984439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984439, "uuid": "29f30a86-63c2-471e-b364-bd936b377d93", "comment": "Malware payload", "value": "25465f22ff1045dfabe68259cbc706b7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984439, "uuid": "d6958ed4-1e2c-4d31-899b-89b5f5ab74fc", "comment": "Malware payload", "value": "84b61fea1459639c970fd32c0f60e82c86b8ef2691360e9b2e2ff34b24334a4b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984439, "uuid": "7acb2cb0-a0dd-4d43-8c01-9dca4eed5da2", "comment": "Malware payload", "value": "4a84c87620be097e3045748ffd26835cd13c5818", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984439, "uuid": "6597a7da-b5e0-4d6b-9323-12ed0ee6e6c9", "comment": "Malware payload", "value": "3d6312c84f3096362b93c0c44d2f123329105b87a8ba928b2fad4fdbfab534b6318d55e51a8915cee48812410be7b734", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984439, "uuid": "ff721f90-e196-4937-aa8c-cd067f48e55b", "value": "T1BBC08C261AC0512A1200064085792118B06AA2839344082002D240B984F0CE1AA39822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984439, "uuid": "897c0196-a6a1-43a3-a7c9-5494a9a513b7", "value": "3:mKDDTazjy9oFqCK3Hrr9FWOvuXbIZ8WAIRSloYazdg:h6z+GqzP9mbIBETazi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743984439, "uuid": "5f6029fa-6f6f-45f1-97f6-fb59cc9b24a0", "value": 135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743984439, "uuid": "d4026551-63a2-4523-bf73-5a880548b4d5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984439, "uuid": "119b8139-e3c1-451f-82a2-b3ed4b4ab864", "value": "AyoHeeHee.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6315d7-13d4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744046273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046273, "uuid": "88395b90-e916-441e-82e0-e4b1512c175f", "comment": "Malware payload (Prometei)", "value": "9a70de48cc1db8e29cb9650df2698a84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046273, "uuid": "38b725ce-90ad-4a80-abfb-9e1cd9578238", "comment": "Malware payload (Prometei)", "value": "84efb984be7de70b320df6bfe1fb9bacbfdbcad42d6b78240b5120d86be77937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046273, "uuid": "17c1892a-dad1-4f4e-af95-e3395a5419ef", "comment": "Malware payload (Prometei)", "value": "679d28b7fa8d3a0374de7bfee1122731b2e8906c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046273, "uuid": "59747799-e24a-4139-a6b9-b644acf43a01", "comment": "Malware payload (Prometei)", "value": "652f3c4880a625fe7da31e99a04704fa4c082a50793c1a6d69559fab88708a1594c6c1a1b8bf742905943b3a102b9ff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046273, "uuid": "7497c5e8-744c-41fb-8323-ac8d2a143a39", "value": "T13D9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046273, "uuid": "c0104b6c-f718-4247-9ffa-703c849b5f46", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitge:25WOSACZSV6eKRH5EPiamb4DsDwwcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744046273, "uuid": "bb75df79-a1d4-4c4c-9050-de8976ca73af", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744046273, "uuid": "1b1aa333-4f78-4182-900c-dea840af109d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046273, "uuid": "26ddc0e4-cb94-4356-90c0-6f32409a5fca", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa24781-1400-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744065228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744065228, "uuid": "f60f7517-c51d-4dff-9043-2cdbdbb5b86d", "comment": "Malware payload (SnakeKeylogger)", "value": "5494ae4b3125ba40f255ed05aabbefd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744065228, "uuid": "5fb04414-271a-43bc-bada-63c9eeaa544e", "comment": "Malware payload (SnakeKeylogger)", "value": "857416bdd969432866d6b165291bcb4292daba38df0e9a227bed97a34e2ef7d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744065228, "uuid": "7a53b2d7-dbd7-4d6b-8b11-16c0a5200f24", "comment": "Malware payload (SnakeKeylogger)", "value": "528f87404112cae3edf91af19052c1a885462f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744065228, "uuid": "85ad1b77-6408-41bd-98c9-ef03b7b05e1e", "comment": "Malware payload (SnakeKeylogger)", "value": "1219c33dc274005f9fa5f56e0309d91d9aa8448b4a4de113b20850ff989745c333b70480b221d684e2ae5eec2d630f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744065228, "uuid": "95044443-5bce-4110-9362-baf488c0c16a", "value": "T13B05E060336CC803C07683F55571D27803B65D9EA621E3C6ADEA7CDB78B2F80AA50797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744065228, "uuid": "a2fb8526-09c7-4159-ab05-546b5588aae0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744065228, "uuid": "ff46bd59-a8c0-4978-b008-2902fefc2978", "value": "24576:9fiEqtEh6P3v9SzwX7aKO0yWlUtEvoxbLgE:Kt3P357ilW+tEvoLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744065228, "uuid": "0dbad676-6fb4-4472-b6dd-26a8a9648f94", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744065228, "uuid": "2b078eaf-a929-4a68-99bf-6a474cdf1c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744065228, "uuid": "6ddfdf5a-7f89-4998-9c6e-87ec302108fc", "value": "SHIPPING DOCS PI, BL, PL, CI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2acf78-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Tofsee)", "timestamp": 1744038812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038812, "uuid": "8515a22b-5a03-4d65-aa01-87db58cf3397", "comment": "Malware payload (Tofsee)", "value": "b8ee97b46c97d3914ff3d299f5d61199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038812, "uuid": "fb551469-027f-428a-b46b-7d1058a633f0", "comment": "Malware payload (Tofsee)", "value": "85f7a7f3e8326dac84b47045e322864aaaa924ef9f638d09d87233e5a3820b82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038812, "uuid": "8da76282-f18a-4ed3-8c3d-f32c25e96239", "comment": "Malware payload (Tofsee)", "value": "b1b14199b31378226dc4ddeed181a216398a38e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038812, "uuid": "36d63a24-59ce-44e5-8c76-a76d621453d8", "comment": "Malware payload (Tofsee)", "value": "b027a4c5e3db13bf33dc04b205c693444874547d60a73feadc3f756c4cf03d6f7c02cb95c1eb915f60663ba5555bac5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038812, "uuid": "5b801fbb-2bb8-446c-ba86-8b8fa79082bd", "value": "T1EDB7DF05DB75E5F2C42E0DB95C6282215B25B97C253008BE5FE43A8C3B74F416BF92BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038812, "uuid": "9e648832-4784-4614-a493-fda2c0ac2509", "value": "2d41405b78fbc537c2fe2f0e515c7a66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038812, "uuid": "4db6a551-8984-4e20-97d5-40a811d0a71d", "value": "98304:uNiS3Wgc3ygCjCjSmJNb/KyVdBAJ1Jbho2a6FmI3oqmG:u8GyycSmJNb//rMJbI6P3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038812, "uuid": "686fc712-67a9-4248-9945-97a8113a8100", "value": 50000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038812, "uuid": "06480415-6a0b-4696-9bd2-50870687e746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038812, "uuid": "cc28c09d-e577-4783-bb60-ecef0c665b40", "value": "uniqq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa95264-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049382, "uuid": "ff55d69d-471a-42d0-970e-2b8667b75c64", "comment": "Malware payload", "value": "129130ae3c7c8adecbda42a62d1bbb94", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049382, "uuid": "d4f095fd-4ee1-4796-aae1-deeebdf1bf6f", "comment": "Malware payload", "value": "87532f55608bf0cc07247ab5282030335feeaf7923b9d0e1872a0daf71b8fd16", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049382, "uuid": "d963d11b-0ed0-4a85-bc78-7e5b8c30b016", "comment": "Malware payload", "value": "26568893c23a12164130cae2842a520a8561dd8d", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049382, "uuid": "1bbbbf9c-666e-408a-b230-6c2024308d25", "comment": "Malware payload", "value": "d940c6297957435f386842860fa0c7596c30a53676b80cd9dc10937c533dd3339a0e5d2a6c6771f1831d1ca7fb8d0fe6", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049382, "uuid": "bd74b709-3822-4ffd-9685-0e937a98b219", "value": "T15CB44F23D26DC512C40E9B3CE6738EE96B31FC0C47D2258FA64E722F9CE2941D7956A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049382, "uuid": "1ee24558-1ff2-4f9f-9f4c-a64732defed1", "value": "6144:3cKoSsxzNDZLDZjlbR868O8Kz5LLxEtjPOtioVjDGUU1qfDlavx+W2Qn14yLxCPT:NonD9JH3jO7AefiDmUL4eIPGQW0hv5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049382, "uuid": "139fe46a-f7c9-438f-9282-2572bbf07d14", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049382, "uuid": "40327dd2-ea37-4e11-a0b7-c2d79157272d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049382, "uuid": "e6d72803-cddc-4374-8fcc-22d1586aed94", "value": "87532f55608bf0cc07247ab5282030335feeaf7923b9d0e1872a0daf71b8fd16.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425d0261-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744011062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011062, "uuid": "ec8564f0-182f-4d0e-8dd1-a96f2c724ebb", "comment": "Malware payload (DarkCloud)", "value": "300a1a4c6fa884067ec51709c0809800", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011062, "uuid": "c41e2331-d356-4f86-b79c-3d243b265b7c", "comment": "Malware payload (DarkCloud)", "value": "880bf273e120e2d8db5bb6ab9fb8e64aca9d20a52177138c14093c70bb7460a6", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011062, "uuid": "4cb899f1-8f27-445a-852e-59ea3ae0f93e", "comment": "Malware payload (DarkCloud)", "value": "2134ed93a1e6e938419dbadd77c87d39cee65688", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011062, "uuid": "40072852-7036-4dc9-8512-cba31ee18cb2", "comment": "Malware payload (DarkCloud)", "value": "0602f07cd10c3bf15c29d83fc1f3de51dbf6d07bc4befef80d371fb93cb0e92b5c3dd2b77f099378756e859f8f6479f4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011062, "uuid": "6fe52851-4aa7-4438-ae55-3fe89e9c2dbc", "value": "T1D437336CD1F23A62499DF9D42A937F6872C530E2F791ACF6E800486731D76E1508BC6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011062, "uuid": "b389d773-96ac-42db-8973-01787f34ca4c", "value": "393216:uslBgDri4l/O6GNiY20FE0XwZK09tDtmB4W4UURw+7ir8QLrMbAZAXlCUBaC/A7M:uslBgXi4l5GNiY2pTD9tD0B4ok2vyAMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011062, "uuid": "d2191f6a-3797-47a5-87bf-a8c042be6168", "value": 24315808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011062, "uuid": "d4a3ed3c-5cb7-43d0-b94d-b948e3206902", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011062, "uuid": "a699d824-f4b2-4f69-9d99-e28b8b8391c6", "value": "Payment Remittance Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e02a611-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1744024074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024074, "uuid": "0188bc5e-2d7e-42ec-9a25-5835773be899", "comment": "Malware payload (XWorm)", "value": "287c9e74da646c50c4d1988f7db67d06", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024074, "uuid": "5174baff-d92d-42f3-800a-4e5394d01b50", "comment": "Malware payload (XWorm)", "value": "88502ddda4ea16f7c1d8929e681902e67895cbee56f31ce2fc77c8420de0a8ac", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024074, "uuid": "6c3f479e-9a9e-497f-9cde-7cafb5bb4425", "comment": "Malware payload (XWorm)", "value": "2f79c415b681cf7e6a95a6f71bca35831f167907", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024074, "uuid": "a0e3a5ad-35bf-4bff-bf95-85d1260c97fd", "comment": "Malware payload (XWorm)", "value": "1f5e77ab81ce915496aa826e90c47eca7a835382c5f8d34efbf2e541a2039918e19a3110c37b817b9cc738ad71dd43ed", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024074, "uuid": "45da9792-b90c-45bc-a18c-0c4b37d3f7f4", "value": "T10B54CEC2B67B252583FFFA33B2CD9F60C6C80B5521898ACD9EA261477C0E7557D01A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024074, "uuid": "3261e0f5-4e1e-49fa-9596-e70f0faee48d", "value": "6144:nT4ah35xpC8v08Msr72w7SA62t2V+ILmZXFXKzZC9Xi/+AedbV:nT4k39CJujSAPt2AILyFXYQX0wV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024074, "uuid": "fb16e298-b75b-4a45-9230-29bcb8f860b2", "value": 284780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024074, "uuid": "90de8b46-dca6-40f2-9a81-ae9354e55bb7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024074, "uuid": "3888b8fd-60f8-47fc-9404-0041d07afb10", "value": "83.147.240.230 (10).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abced90-13e3-11f0-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1744052872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052872, "uuid": "914486e4-852d-4b50-a5c2-9a71afff0d7c", "comment": "Malware payload (Hajime)", "value": "fa36da374b5950236d69d1542dfe0c46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052872, "uuid": "0989f799-f6ab-400b-9fca-fcf054512ed8", "comment": "Malware payload (Hajime)", "value": "890349ac69777b34f13a25e15f9d7492cff6bc620d998c1d383c909c975e7764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052872, "uuid": "c1f6a699-e03e-4a24-bf61-1e8544d6dd95", "comment": "Malware payload (Hajime)", "value": "6aee19dc27763b9167a31cdcda3adf81d559eadd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052872, "uuid": "0ee366e6-7f79-4cd4-9abd-85c053f6af07", "comment": "Malware payload (Hajime)", "value": "189fc7cc6f1c3a8db340a68ceff7966a4ce07c04c32759dae62efea53b060bb5fc6275baf9284496cff7506f4d1dfbd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052872, "uuid": "f7bb707b-fe91-4fc5-b405-270656599667", "value": "T11023028223653F72D52148F4D7BCEF8A614A7E54AFE6181F7C113A94B47135C28C9C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052872, "uuid": "f42d3b8c-68e8-4918-9c92-ebee68ac061c", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEsDm1X3:yYI0ARqw1qAEW67UIWi7M8gmfmJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744052872, "uuid": "8f7a71d5-9c64-47c1-80e6-40b386c43052", "value": 46512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744052872, "uuid": "4febd634-0ef7-4e64-8c8c-ce0a0b7a69d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052872, "uuid": "45f268f9-963d-429d-8702-5bd27a6f579f", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58c65b6-13f4-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1744060245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060245, "uuid": "a3a2bb5c-3a66-4dd1-a56b-839e51f2ca77", "comment": "Malware payload (SSHdKit)", "value": "2a57c5ff08f0a744bf4bec1aa86adeed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060245, "uuid": "96b6b86a-91ad-4c95-9c92-80d094d4e48f", "comment": "Malware payload (SSHdKit)", "value": "898da139ca3147ab7539703e56593e6ac3746e9bb6dfe957f1f6c4e08fa7f506", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060245, "uuid": "0eafc9e5-ccf5-4368-aea5-bbaa52571002", "comment": "Malware payload (SSHdKit)", "value": "cce58ad3482ba2942e754663dbb625cb14100a75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060245, "uuid": "dee1c426-a46b-453a-9031-94efdfa10bbb", "comment": "Malware payload (SSHdKit)", "value": "8435ee08b883d079652e90dd00b805d674df44819619fbce7b5afbe5a82077800444b050164f11e23dcf6f7c0cb07fae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060245, "uuid": "8b68d012-bb8a-4601-867d-4dc73997249e", "value": "T1FD356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060245, "uuid": "c83b24a8-3631-41f7-b5f2-b8e1c220d29c", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaU5Q5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO3k+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744060245, "uuid": "0ff8e95c-5e60-48c5-a3bc-2364d7c6cec9", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744060245, "uuid": "1373345e-12a9-4ec6-8c0b-b5c0361ab75b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060245, "uuid": "d792a5f8-a850-4472-b553-f92cb6a42643", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8729e831-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (PureCrypter)", "timestamp": 1744017191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017191, "uuid": "6a03297c-6eb5-472f-b14f-211713226351", "comment": "Malware payload (PureCrypter)", "value": "e314fa4ca0af43cb23921d6b0d028371", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017191, "uuid": "acbc478f-ea77-4973-a0d5-331eea302d89", "comment": "Malware payload (PureCrypter)", "value": "8a3e2e7cd5516dd414ddf136b739753b48dbe230e09c006b94c652e4d2306f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017191, "uuid": "cd30cb3a-f1c6-4d8a-8f6a-94e2c3d0a67f", "comment": "Malware payload (PureCrypter)", "value": "d03664932d56aaef343ea0182f1e7222002bd82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017191, "uuid": "b48b47f8-3d43-44db-ac0b-21849f931bbe", "comment": "Malware payload (PureCrypter)", "value": "e5b3a000609be3fc1ba3a9dea36213c4adee55feb042701c91f48c1603b342d62745c30a28b696b1bf5cd5451fbef6ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017191, "uuid": "ef819319-0b03-4047-bf3d-3f5b659af86d", "value": "T132043B5463E88A57F1B96BB4E07051108BF4FA66633EDB8E5D14A4EE0C27B90D811B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017191, "uuid": "33846d79-2fbe-4438-b9b9-5fb959d9b412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017191, "uuid": "05d96f10-45ee-47b2-8357-007edaee1004", "value": "3072:5bKaVUZga1uN1iJIqIMgJ/6ZCS/W82Q9/iSSlcNkL7ayDwVsSrgIN4ftR/8Fa4:1jfNyIJsCS+xs/WbLuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017191, "uuid": "e4c9d1e4-617f-4006-9866-9d63ca66cd5f", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017191, "uuid": "7c5093c7-550c-4657-8450-80ed3a99f2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017191, "uuid": "c0cfd654-e6cb-4b0d-bd31-292ebd3ca8b7", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.1151.26258.16080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f882662-13f0-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744058275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058275, "uuid": "b82bf98b-85cb-468d-8abb-42c6966c9115", "comment": "Malware payload (Prometei)", "value": "10da694b1abb13f5f6faa97a90bac0ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058275, "uuid": "606525a1-75f7-493d-be5f-e4f1b7d989dd", "comment": "Malware payload (Prometei)", "value": "8b89a89038b4f543d8acbaa58931562eeed12625bf8cd570466cb363cf50ae9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058275, "uuid": "56dd2fe9-9cee-407a-a860-419453d065d4", "comment": "Malware payload (Prometei)", "value": "bc6af7533ba1ac7b0660c2fae9e8beb53bdd295a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058275, "uuid": "bffbe763-8972-41c4-9111-fe1b8480547b", "comment": "Malware payload (Prometei)", "value": "921c665f331aefc14d45e76186912d529e060bc6088cb477e2f7a81f84e22a44307a8f06034172bb43a7318e50ce1a5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058275, "uuid": "294f9972-1e7c-4322-9a1d-3ed5bbe46a68", "value": "T1069423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058275, "uuid": "e8067278-3534-433f-84ca-96522dcbab5f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgP:25WOSACZSV6eKRH5EPiamb4DsDwwcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058275, "uuid": "335c05df-731f-440c-9df1-0da79a4b1f66", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058275, "uuid": "6b33ea52-52f5-4765-ba7f-d9e578de9cfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058275, "uuid": "d46b435c-87e5-4a48-8a62-f02e3c2bef06", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba3a7af-13df-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744051075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051075, "uuid": "abea78bd-086b-459d-8e34-4fafb17bd3a9", "comment": "Malware payload (Prometei)", "value": "67c37a0593c16f893bdf7ec98019ce80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051075, "uuid": "89d3f1a5-b2ae-4b00-86b4-6724cd9b2851", "comment": "Malware payload (Prometei)", "value": "8bfc2a823ac9af4bad441e828fcc59b38e7dc840c2c9cb865441f62b71bbffbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051075, "uuid": "83b82bb3-946d-4e51-9f01-7b78d32b2322", "comment": "Malware payload (Prometei)", "value": "ba3f46b26eeef04e189ef4b8fdf343d7136550ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051075, "uuid": "3ab5e854-8217-4177-bf3d-6ec564ff9a2e", "comment": "Malware payload (Prometei)", "value": "4f5bbfbef3699e8ba56596ded337e5be08d6287f0b8b1c188d206f93648578c1937239837d4da1f3fc0d0444b05999a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051075, "uuid": "7e20e19d-74d0-424c-8ad5-57ccc3291574", "value": "T1949423F8C83D2E30D8169F3CBB1A826CF0A15772D9562F6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051075, "uuid": "700d5687-20ba-4596-a2c8-9173a6d91f8b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgQK:25WOSACZSV6eKRH5EPiamb4DsDwwcgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744051075, "uuid": "a4e930cd-65cb-49c0-be54-d48e85051d77", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744051075, "uuid": "479352aa-c741-452e-89f0-d9ee59f70179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051075, "uuid": "26d3ab1a-9910-433c-90fa-ca1111e45eaf", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1656637-13bc-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744036186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036186, "uuid": "ec7e274f-ef6e-451c-9966-ecbb7aa84be4", "comment": "Malware payload", "value": "fa253086069ee68d2b64101ea8e24061", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036186, "uuid": "7bad2682-8bc0-4ac6-ace5-7cff67c55c86", "comment": "Malware payload", "value": "8c03f11507d40e8eb18db80aecf07b527ebcdfd7dfca157e6dc3bb6a722a6c64", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036186, "uuid": "29f3df7a-e78a-48d4-9914-a549d1a66213", "comment": "Malware payload", "value": "2bc6128ee30c76fd6f6801db49d065f941f5f29a", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036186, "uuid": "2399f7c0-9e2f-4646-a5a1-97248a4f14d5", "comment": "Malware payload", "value": "f70278cdec262da7ad5daa86e347b911afa7ecc78f0ed39dd0d4b0041e382d414f6c78889beb2c56f987c1922204d63c", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036186, "uuid": "abad149d-fac4-487f-b534-7d94cb229e5a", "value": "T131D423BF4AEABD7CC40DA1E3580375723118AE275978B152D92393CD4E3248D99920FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036186, "uuid": "bd9092fc-3e66-4752-904a-357119a8f39c", "value": "12288:Fr5DIVKDSnArNOoJOPnQdPxq3UA0OrY6ie6rVMhel2s0mXTrv/Eu11f:Fr5UVX6OPnyJqOOE6XsMcB0mXTrv/Ekt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036186, "uuid": "aebf8cb7-2b82-43bf-85ba-a0afc747cba0", "value": 638155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036186, "uuid": "9f745f45-0b3a-4e52-a3ae-41b1fa2fb5c9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036186, "uuid": "9dfc1a59-86f7-46b4-8ff6-c0232ed95a07", "value": "Quote_NF#003.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a237605-13e9-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744055314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744055314, "uuid": "9a49af70-144b-428a-b0d2-470fc368c4c2", "comment": "Malware payload (DarkCloud)", "value": "728f62165039dd75043a028a1be2d840", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744055314, "uuid": "8ae9afcd-5619-4a46-bf31-342f2a4c1e6b", "comment": "Malware payload (DarkCloud)", "value": "8c369f40b853f01d6bfcef936aa63b314711daf3473937d741048f32658aed02", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744055314, "uuid": "4f54c859-74ae-4161-972a-29a167d9b5c0", "comment": "Malware payload (DarkCloud)", "value": "9e2ff0ffebcf513a11a0394998e70a03cff6de2a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744055314, "uuid": "95371014-824c-4243-9a69-7ff8a239085f", "comment": "Malware payload (DarkCloud)", "value": "158c7461c21fe48827b43df32f80b8a96e7eb71cfe29d746ca657aab140af8f85c63aae204757b5e104c91d9150e8932", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744055314, "uuid": "6c25386b-9fa1-4c71-bf83-45d6b972ff5c", "value": "T1E7E43332CF814ABBA70E9D33D97E90B5E0E8DC1653E5905A88FC9DEF2331819D45C964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744055314, "uuid": "66e42b5e-badd-444c-bac7-adc7d74cf2c4", "value": "12288:0Yz+1u8jORSb4vFx1UBzu9KJRFQKfkZ7vR9DKwLPSX9Kx7Rgk5iHJPku9dFpPWfX:T8u8CRSk7qBi9KrXO7viIPw90DcDWfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744055314, "uuid": "9d5756f6-e585-439e-aeff-021021d40778", "value": 712944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744055314, "uuid": "b360ef01-d813-4ff8-ad99-e057f84ce8a0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744055314, "uuid": "bf360010-e1d4-4215-835c-48ab1ee9a709", "value": "EFT_Remittance_Copy_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8e4286-13dc-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049623, "uuid": "a6f12ed9-6b6f-407a-b2ef-5f3a9f5ec9aa", "comment": "Malware payload", "value": "89eca5e793b925035d9f8cbe55bf4109", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049623, "uuid": "7b84dd54-e902-403e-b372-ccf05f4e3b56", "comment": "Malware payload", "value": "8d7ad2faa1c6e04a837798655fbfeca37b93a11f0b6e81779282621c04287c69", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049623, "uuid": "5bfddc81-bf72-4917-a1aa-880e5ea21d87", "comment": "Malware payload", "value": "6eee6aa42d2f7dc51303fc54ee9da947a576d3a4", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049623, "uuid": "df031c31-ac51-4b5a-8910-a96708d9069f", "comment": "Malware payload", "value": "4bbbb34929734f0f8b0cf7fe5527934f995f91de8e22875e7dd1bb69589459be8035abfa383fe5a3461ae903dd445dbc", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049623, "uuid": "2fc16e24-ec1c-401c-ac51-428906821b9b", "value": "T113319C463DE471A467FB9AB2583B60C9FA56CD8E75F8104F812071C23C55426E6E3E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049623, "uuid": "b4283a44-5e00-46a3-ab0b-cc5470fbd113", "value": "24:7mbD8Vr8R9Fv10arKEJQAnv3D7Qurj2Zyu3Ha1VAPu6CuWPHlfvBd4HPMv:7KUYR9Fvia3JQAnvM0Ekq22WPHpvBO0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049623, "uuid": "66a47d11-490f-4d1e-8637-95125e959736", "value": 1479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049623, "uuid": "950196c5-b4dc-4a17-9400-ed798ff4f509", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049623, "uuid": "3253a9bb-4263-4efc-958c-61d07341d3ce", "value": "AP check remittance90881.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a10cd23-139c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744022269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022269, "uuid": "2afe1e09-2c0f-4451-844f-c1c1990a21da", "comment": "Malware payload (Mirai)", "value": "837a29718b43802a96394b5931994598", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022269, "uuid": "c11c1e66-5113-4c17-bcd0-1c048058d98a", "comment": "Malware payload (Mirai)", "value": "8e314f2dd47feeeb35d14b9389e37bf59ff5fe88b06fb076398969b4a169ef9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022269, "uuid": "132c9e36-890b-46b8-bbb6-232e62e371d6", "comment": "Malware payload (Mirai)", "value": "9c47785aa6699fb39f4fdbb9839a823d066eddab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022269, "uuid": "f3446da5-5cf5-4ca9-802b-5feeff483eab", "comment": "Malware payload (Mirai)", "value": "de95d99960d0df9f0480147abf2b6278a627dcba6627307d967c3f3c71f4d89c6980d187d3a2191a56d6225481391119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022269, "uuid": "e373f8a5-1cf0-4ff8-bb14-8ecf2bc7624a", "value": "T137B38CDFF38B1561C89382F013C74F9E3D2323809F1395E76D6A267968752DB5A05B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022269, "uuid": "48063e34-a9a7-46a2-9438-240f69084d55", "value": "1536:yerW6R0Ujr04q9pTiMBOxXYoiiaQUxVM1wkgsL1/LWnE:NRLq9pT3KXXaQzwkgsL1qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022269, "uuid": "d962125f-e0fa-402c-85a0-c5cf700d1c1e", "value": 108312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022269, "uuid": "fd37ad3a-62cd-4b80-8530-089d8ae58caf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022269, "uuid": "4a4c6e92-62ef-4a06-b2a7-80bb7ad5392a", "value": "hanoi.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8a8577-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1744017198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017198, "uuid": "811700fd-a3c1-401a-80d0-369aa6b5b6bd", "comment": "Malware payload (VIPKeylogger)", "value": "a1f831ac2629cc1ec7e71a81d8c17168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017198, "uuid": "8db30540-29a5-46b4-b78b-f6a2b00f48d4", "comment": "Malware payload (VIPKeylogger)", "value": "8e3597809d7eacf0111320aafeed81dd846ee96abf52c660a94bc48ef7a99662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017198, "uuid": "32e86c12-40c1-4cf1-8c84-d402d1d313f2", "comment": "Malware payload (VIPKeylogger)", "value": "e10a7dbd569dfa593e7d91fd0113360c95a2b0df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017198, "uuid": "34f2024a-c7ac-45d2-89c1-f92f4d8a5b7d", "comment": "Malware payload (VIPKeylogger)", "value": "f8b07c11cc11060cbe7b6c315e15fd48abc70dd639a82488bb69032b0fbb15477c5c7bf724a49db5ee2a78cb9c129ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017198, "uuid": "9a9f8e59-6a49-4401-bf65-2a3e66b15eaa", "value": "T155E4F13B1B3B6912F87CA031BAE7E57363344CB1192DB51931D0FE1724B2A7A1A1E58D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017198, "uuid": "48190636-c1c7-4770-9c13-c8fc4ed6b20c", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017198, "uuid": "a5016e82-2b71-49fd-adc2-45db3e209466", "value": "12288:2tqNqN76HrFA3Qe9h6ThGKgyJ80FtEeLyjWBEBi+fX028wpkrGkgFge/9yic:62HryQeOThGKdJ8pBi+fX0uXb9wic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017198, "uuid": "0e36195a-f022-4699-a4a4-b0579fa396ae", "value": 680670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017198, "uuid": "3d6dac09-41b1-4db5-a2db-ea9a13c35012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017198, "uuid": "76d620e4-0d13-4a0b-ba75-dc1567ec5099", "value": "SecuriteInfo.com.Win32.MalwareX-gen.8261.25530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ebde44-13a9-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkTortilla)", "timestamp": 1744028032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028032, "uuid": "e8cce153-6aee-4c7b-8b57-08164f78de68", "comment": "Malware payload (DarkTortilla)", "value": "bd38fe8f419e134c1f94922b45502e23", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "tredwqasdgghnbvgtredsw-ydns-eu", "colour": "#22FDBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028032, "uuid": "73d7948d-d2f7-48fb-b3d9-a831c5f57531", "comment": "Malware payload (DarkTortilla)", "value": "9022a3a4c7db906db144ebaaa2acaf9badd964877e5c82493fd60a08d3fa38be", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "tredwqasdgghnbvgtredsw-ydns-eu", "colour": "#22FDBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028032, "uuid": "a1cb8fca-1170-499d-b133-79bd928e3c92", "comment": "Malware payload (DarkTortilla)", "value": "29514e8989eeac76fb749975e4e78edd9df66eb5", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "tredwqasdgghnbvgtredsw-ydns-eu", "colour": "#22FDBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028032, "uuid": "88f31090-755e-4fb7-b8cf-19673be7529d", "comment": "Malware payload (DarkTortilla)", "value": "dd2261f2c6596bcf6eea75e318e361ecc4d850736154e53fc649bd064de38df04ca1a6c6d0930eb9050b8ed84c552340", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "tredwqasdgghnbvgtredsw-ydns-eu", "colour": "#22FDBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028032, "uuid": "84b97083-7c8b-4dbd-826f-8cc596af8144", "value": "T1F546233D6B965044DDBE4EB8413C92843376B347EF56E34D62C822EC4E4138BAE1D76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028032, "uuid": "dfd89c01-983a-4ca6-be27-284c2ef8387e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028032, "uuid": "2c17c230-61fd-47b3-ba3b-2cda09253758", "value": "98304:vz90tu0M+YXATT6t8VWaysYaH1Gcmzny1M3PWf2tn2:r90tu1+YXAn6t8D1a2aufZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028032, "uuid": "e7581e3c-ccc2-4bce-8056-374d669050bf", "value": 5436416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028032, "uuid": "da646ec6-ccb2-4707-95c7-02c435d31b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028032, "uuid": "313ad585-73d1-493c-9daf-ad773f115e73", "value": "Neutarra_Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4badd8-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744017199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017199, "uuid": "3f11995c-fe9d-4bbc-abad-20da134aaa01", "comment": "Malware payload (GuLoader)", "value": "cd57a4178a1f317c66b8460750165ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017199, "uuid": "d7b575d8-796b-42c8-8a38-4386f62d7b8d", "comment": "Malware payload (GuLoader)", "value": "916e864369f0d60c15d10111e0df9d53ebaca6186481aacb71802b48e76b43ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017199, "uuid": "5892bf23-1945-47ea-b3f8-c93c3934d51e", "comment": "Malware payload (GuLoader)", "value": "881ada6dd3d6c7f07dce3ccee9491a1381ad7f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017199, "uuid": "bdd10fde-e4b9-410e-a63b-e23715cd9b93", "comment": "Malware payload (GuLoader)", "value": "947ead27e52375529a9492913361177ee13721fd3e0fe59ee74dfbccb63b5bdbaa7fd2eaadaaac3128db38343ac2a619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017199, "uuid": "57cf824e-c8d6-449c-887b-74dcfade178d", "value": "T16BC4221A6A40E8D2D3630730143E4FB689E6F38079E5D77F2391571EBA13626A91F393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017199, "uuid": "24ae85b3-e02c-4fbc-85d8-8fb4e200a4aa", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017199, "uuid": "2c091987-2e13-4bd5-a695-eb04b2021d69", "value": "12288:PYcmdTdG7K9wEAlphlUUm5COBfS5SWzV335egmSD4sKho1QYTvsOAL7:PYfdMKO/lpMUm5NBfS5S45wgQZoHxAL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017199, "uuid": "c9ee6f89-ef1d-46a8-bacf-a0407fd5f341", "value": 559272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017199, "uuid": "6e7f70c2-de0d-4d9e-b6d8-5f68ee9c2210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017199, "uuid": "070ccfb3-9d4b-4a2b-811c-b6ac641d7d50", "value": "SecuriteInfo.com.FileRepMalware.23769.9138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33472f38-13c1-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1744038095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038095, "uuid": "96b989d1-fb1a-4063-ad0d-00e31a17391d", "comment": "Malware payload (AsyncRAT)", "value": "f4be71beaf208bc8dc797feee93bd768", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038095, "uuid": "705381d4-1afb-44cc-a715-d9609bfe50bf", "comment": "Malware payload (AsyncRAT)", "value": "923b51a8e59ac5dc4db026988ec3f205f21cbb6590cd14b0e68b9cb0d8114ad7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038095, "uuid": "0905cad6-d76f-4d33-90cc-04b39f01c08f", "comment": "Malware payload (AsyncRAT)", "value": "2289f05bd13cafc219391c1669d67ee21ccf2f08", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038095, "uuid": "b53ac7e5-01df-4c68-86dc-a05bc48468bc", "comment": "Malware payload (AsyncRAT)", "value": "7a47eba1518364dc7ae091279d102a8afaa277157b7359fa54637f677548d56f7d72937a87f6f979baeebb8d251b6694", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038095, "uuid": "e075432a-8980-4b9f-b7ec-34eec35eac5c", "value": "T15F31F3343D11C3E5322571473036DAAF9F6671AD989CBB66CFC5AB809FE521400D13B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038095, "uuid": "83ca0ea6-5f77-4e1a-98b6-d9c03641d880", "value": "24:ijfT9ThTEzugTlCjTUTUTg5TtT9kTTZTZTg5TzTtTUTXTmTXTXTZTETZTeT6TTTy:ExV/gxCjwwU5hmFFU5nhwDSDDFAFKuHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038095, "uuid": "f20efbe3-53b1-4b2b-8317-cdda8a48e9c2", "value": 1528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038095, "uuid": "b2e474f1-566c-436d-ab28-ed9e4f030c31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038095, "uuid": "a9e8fe6f-fff7-4851-9844-8745e0568179", "value": "Invoice647848.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41612a26-139a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744021369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021369, "uuid": "0aa977d2-ef9b-4fb8-bf03-d146ee41f6e7", "comment": "Malware payload (Mirai)", "value": "df2e1e7ed995c979655c9135bcf1ac4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021369, "uuid": "ac938e15-fdb7-4c14-996e-f61a7ad637ed", "comment": "Malware payload (Mirai)", "value": "92727dfadca5bb7bcc57a1415cfbabda425b61260f7ff6c937ea94c0552f55c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021369, "uuid": "4b110a7c-93ff-4361-8238-47ca5b71fb14", "comment": "Malware payload (Mirai)", "value": "4e39d36f19519439dd1552cf69aaccb8ef5f9ca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021369, "uuid": "8d963a57-716f-41f2-88f8-50cf4afd1da8", "comment": "Malware payload (Mirai)", "value": "546b6298c7794d7192ec8f7bb95c4e955cf6c2e064dc7a2e930a9c2437485de846588395436c10e62277a30f2eb7c8ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021369, "uuid": "ee28adc3-2225-40e9-af7b-81b0cadfc96d", "value": "T1A1F2F1FF877CA92BE53580FF586E5A1B2F81512C174F72049012CAA50A91EF91FCCDA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021369, "uuid": "f3656e47-0c9a-4e44-a644-fda2b47ab34e", "value": "768:tVk/tI4gUTtzulj5OPquaEzjUuCbLuom0eu+VAHFyIx:3k/aUT4j5iq/Vjuv6lyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021369, "uuid": "707967c1-d069-4a97-8d87-fd2f2c5f822e", "value": 36308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021369, "uuid": "180d0989-4cce-4016-bb40-6610589de8d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021369, "uuid": "315f0c9f-422d-4000-baf1-4e37804d0d5c", "value": "hanoi.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71f0fd1-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034505, "uuid": "db2718a0-e55b-487d-b555-6fe4deea90e3", "comment": "Malware payload (Formbook)", "value": "3d5852171b3cd662f5db11c11d576a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034505, "uuid": "e952a399-aded-4a25-a8e9-ae2f71f7b6e5", "comment": "Malware payload (Formbook)", "value": "9346d78536c98204d965ce517fcaf639ed6e3243eeebbc31f4bbffb3d81da41e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034505, "uuid": "51ba9b3a-7303-482d-b79d-9d324a5a4f6e", "comment": "Malware payload (Formbook)", "value": "1509584e75d35c5f4322959e84c5f26750e5143f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034505, "uuid": "a086df86-9f3c-4d85-9633-30383b86e021", "comment": "Malware payload (Formbook)", "value": "15c96d715747f4dcc81581d99bb833ad7d8800cdd50924c07b341f4af1e3f0cfc531896fcbaa3fac5f4eb9f4237d2b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034505, "uuid": "a2b435eb-0ab9-4aa0-80d3-f5c1971c2a1a", "value": "T1D245BE22B3DDC361CB669173BF69B7016EBF7C610630B85B2F880D7DA950161262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034505, "uuid": "ecec544b-6238-4c9a-80d7-c909a064aa1b", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034505, "uuid": "24fca7bc-f589-46fb-abba-87e097b95b33", "value": "24576:su6J33O0c+JY5UZ+XC0kGso6FaBemloaofua8fBBbcSWY:2u0c++OCvkGs9FaBy9fuakvEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034505, "uuid": "ec119c9c-41ce-4720-9cf2-f4292151c63c", "value": 1181696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034505, "uuid": "be37eec8-94d2-4936-80a4-eccd9b46e1af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034505, "uuid": "ef893c22-43c5-475f-8c8b-5dd5c8e7d076", "value": "9346d78536c98204d965ce517fcaf639ed6e3243eeebbc31f4bbffb3d81da41e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1155cb4a-13fd-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744063808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063808, "uuid": "e2e7a2cb-d33e-41fe-b01f-4f4e40076b94", "comment": "Malware payload", "value": "0f240507a66c6b5349b79999ff1fd8de", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063808, "uuid": "17009bbd-1c59-4cc9-881c-146e2025a81f", "comment": "Malware payload", "value": "93a679ae8e6bea27b387dad483571274cf66689891a7ffdf292953e9ac53ef1c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063808, "uuid": "6ada2224-a2ce-46bf-93ed-ce6c7ee460a8", "comment": "Malware payload", "value": "7f1edf4f4c3f45f71cf11e4d55e16e4a34b25d58", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063808, "uuid": "52e4515d-5317-4658-8c88-ba627cfc1a52", "comment": "Malware payload", "value": "85ef2e6e4578311ff37513be9c6e03dc7a831c912fac7998a6b19b6bf4d501deb02772d0207e4620e1f97e3731c0c69c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063808, "uuid": "d6abdd42-7f09-4da0-b44c-4e0ba15f19be", "value": "T1433110193A030421E5C069A898BFA80AB76B15CF1175ED6437E690BF4C628C4DB2FDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063808, "uuid": "a7383db3-e936-4db6-95bd-63ab6a3fce46", "value": "24:uemHAsOi93pSzLd3n+qgV1PKVgZY1gZOBASWVWIWsBWTtWpGWGWl63W/WoW4mWny:uemHAJi93pSVX+qgzKiEgZPSWVWIWKWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744063808, "uuid": "4a9c4b28-aa44-4c30-9bae-a948312733b0", "value": 1457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744063808, "uuid": "9c0086e9-ca1f-4257-a4c5-4f375475c81c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063808, "uuid": "9e433bde-649c-4335-b006-d5db89ae09f6", "value": "HEEHEE.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41c663c-1344-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743984732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984732, "uuid": "066104fe-4ce6-4a16-a9f7-56982a5df5e0", "comment": "Malware payload (Mirai)", "value": "a1bbc43f6165479f76ea6eceff81aa68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984732, "uuid": "9b445650-3976-4093-b247-4847823bdd07", "comment": "Malware payload (Mirai)", "value": "93cbdd40048eb0e622db6f3ed6cb65c0065befed917df14c4d85754695f49d0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984732, "uuid": "0d5845fa-d716-4fa3-985d-2d4627ac64a7", "comment": "Malware payload (Mirai)", "value": "2eccc19fd7fec0650ec6e7d2ccb29d5337d510b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984732, "uuid": "5d9ffdb1-12c2-4fe9-bf52-d37156913016", "comment": "Malware payload (Mirai)", "value": "5e7ccf44a30e6ad5c6a30014c97cc26005494c5aec66e983dffbd996ab772b6d87f6e98361145aa4f53a2cb0067d8472", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984732, "uuid": "c35c4f65-db64-4c5b-b066-f1995089f707", "value": "T146430235DE12AA7ADF312C35A9680AE4F61B1579988D743020DCF78674B60F02BDCF96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984732, "uuid": "484bd225-82f6-46dc-97e0-fbec213bdbfb", "value": "1536:iGj2ig2gytPpXdLD/86FTzhTIzL0oM5vIce/SLZ:jqis0XZDlzFIEoM5A+LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743984732, "uuid": "ac86a906-1af0-485c-91d7-25f6367544f9", "value": 58780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743984732, "uuid": "2d1ed920-030d-44bc-bb59-52a94c8ab3cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984732, "uuid": "c35484ce-68c8-4131-b514-28ef342bf452", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d0df86-13ac-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744029033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029033, "uuid": "a3f65023-ea10-40b4-b2a7-6083f49db17b", "comment": "Malware payload", "value": "9fe285c94c5991b871d5c571db243ac0", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029033, "uuid": "1dfb5dec-b719-42bd-ae0b-93df311e6730", "comment": "Malware payload", "value": "9422f352d00fe27d64c66168da45dacdbdea18e1d4d4177d08d8f1a20ddb4d3f", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029033, "uuid": "e2a1a835-abc8-453a-b111-17813853b028", "comment": "Malware payload", "value": "e71d1a32ede17e30297cb9980ea4114c9065d527", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029033, "uuid": "cca87524-8e0a-4481-beac-241ccb2e69b1", "comment": "Malware payload", "value": "fff9681a3644d637c928bdeb232f107b5ae6d7b2fe109b5a947981b2f65a8a965244b52cb4bf51ee4045a6ad10f85ecb", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029033, "uuid": "24a1c16c-6604-4b60-8e7f-1cc70cd27526", "value": "T19091FB3D8AD56DBD0365B37C2E8DCE1E489CF410F9159A2E70892140A7633863EB96BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029033, "uuid": "c698b885-7634-4ae9-9821-6b0e9cc1a774", "value": "96:THMhkm3Q3mZadATHJnxcLGbgZbrZOeEKL:TH7FfKDJngGbaQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744029033, "uuid": "565c6fb9-1f79-411c-a897-e66f165cf7a8", "value": 4302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744029033, "uuid": "14956e3c-5836-46f2-88ad-ef5b9e6b89af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029033, "uuid": "97a06c55-5618-46a1-928f-83e8fcd2aae5", "value": "tos1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad3b6d8-13f9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744062160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744062160, "uuid": "cba5d495-c96e-46fd-9de2-e30dfbcf69b0", "comment": "Malware payload (Prometei)", "value": "3d23905792787aabdc4f8f08e59e91ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744062160, "uuid": "225dd436-0f06-447b-8da1-3e7b1f2012f5", "comment": "Malware payload (Prometei)", "value": "949dd0d11c99b89c2c2719dd2ccc68595d7094ea5b4b15cc83936167256628f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744062160, "uuid": "46fc68ad-91e9-444b-b018-af8dfcc2549f", "comment": "Malware payload (Prometei)", "value": "1a9afb905d10a9ecaea536cbc800c86493ba0a59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744062160, "uuid": "3a7713a0-7067-4dbd-ac4b-d472088f3fd8", "comment": "Malware payload (Prometei)", "value": "4b0f8b53a67ff754a684d16364d72021ac813919d02d67a87b5f7c8a782883bfd7b6345cfe7fd1e0917ada419013f0ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744062160, "uuid": "a6118f65-e774-465f-a5a4-d47e0999d846", "value": "T1649423F8C83D2E3098169B3CBB5A826CF0E15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744062160, "uuid": "8567f1d7-1a55-478c-9107-770f9e07d853", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744062160, "uuid": "c2736fd1-f8ab-44d5-8c71-65661fb2d748", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744062160, "uuid": "c1341a43-f794-41fe-b2d8-ee1bedca2404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744062160, "uuid": "18a31588-fb80-480d-8162-71a33614cc55", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b35f30-1399-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1744020948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020948, "uuid": "9efdd860-821a-4862-9467-6ed5c81edd75", "comment": "Malware payload (AsyncRAT)", "value": "eca4c8a238679f9b688d6f759f7bd4d6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020948, "uuid": "d43f8cf1-1d58-4041-bf7b-b6e719822077", "comment": "Malware payload (AsyncRAT)", "value": "94c247bbcd11bc3761d273a1593886fbc1577508962aef49b61678d1d3e46e1c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020948, "uuid": "2f91207f-b846-44d2-9389-56aab6703648", "comment": "Malware payload (AsyncRAT)", "value": "febfa65af1ab0cc4e6dd2557063c4e8802f5ac42", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020948, "uuid": "90afb7a5-039f-4761-8bfe-411a4a423c6b", "comment": "Malware payload (AsyncRAT)", "value": "29f1dc37dd69a0b8f99a0540bc6a71051684ef579fd4ad265f8748236b4c3985463d985d83f33b1986cebc82f7abc33c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020948, "uuid": "681244ca-3291-4054-8c1f-3b339dc5d763", "value": "T1EEB4BF46F75E3CA6DE6649348893C3259737B4410761AF0B87608B795F1BBE0AD2B332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020948, "uuid": "33452b55-3112-459a-8e91-ab97bd77b2a6", "value": "ae77e37c4a21b7e9a55fc729ea6eb080", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020948, "uuid": "3435120d-7824-4ccb-947c-e6df7d41999f", "value": "12288:y+yBWdyJSEMlCIzonW2rNfSE1u7MHltpN5Mi5/vr:y+/yJSEMlxOWwf91u7MHltpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744020948, "uuid": "25472894-9fc9-48f9-80aa-5cfe50f62c03", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744020948, "uuid": "00f53495-33f8-4a38-acbb-b8f04466eef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020948, "uuid": "62d076b1-fb3d-425d-8d38-796bb9e4c933", "value": "\u8f6f\u4ef6\u5305_1.0.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cee54b-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744038853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038853, "uuid": "f50c4e88-504a-4f4d-837d-34a99660ff96", "comment": "Malware payload (LummaStealer)", "value": "865e89acd5a7e64a8a5508237f1ca6b1", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038853, "uuid": "09a5ccda-b378-40ab-b055-269132070048", "comment": "Malware payload (LummaStealer)", "value": "94d8169aa2f343c257eefdd8082c739e1381a38cd6b60985fe105e26c5cfb095", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038853, "uuid": "82adaadb-c491-45c3-bdca-1902111b4374", "comment": "Malware payload (LummaStealer)", "value": "3a9d08ca2717f892f40b8443d62dc4afc04264fe", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038853, "uuid": "f2bf4971-bd63-46c1-848c-8d5bec0ebd5a", "comment": "Malware payload (LummaStealer)", "value": "4ccb6fb20e26acb52d20e5c6f4e70cb4590ccbbecfc0f99fce584b46127f92bb098b03c53cc943d5dea83482cd864ec8", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038853, "uuid": "07149385-231a-4301-9f81-15843b9aaa84", "value": "T1B00733A9553127E4CCEB96AA82CE1A73978D83730D7087A39E1F0D47560DD0B7A0C6F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038853, "uuid": "15c9b421-7b28-4ed1-bac6-4f159c707a51", "value": "393216:NTo/z1VH9inZ0vECbAjxuJxmEZQPlvyBfIMluDsJ6m+4uQE2K:NqzJGUECkuJxXal0UwgABPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038853, "uuid": "31608655-dc5c-4b93-8e9b-584de589737d", "value": 18234158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038853, "uuid": "2d3224b1-3409-434d-b6d5-b60bc872a78f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038853, "uuid": "994d3a24-50e2-46ce-8c39-47af40a36c4c", "value": "DLC Unlocker ( Password - 2025 )$.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ef29f4-13a4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744025571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025571, "uuid": "c299b9f8-f87a-47f6-a675-34a0cb17b702", "comment": "Malware payload (Mirai)", "value": "7c8ece36f2dec2accc4bc95ea4b2b755", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025571, "uuid": "a63af605-eeec-40e0-bb37-72e736462d90", "comment": "Malware payload (Mirai)", "value": "94ed35bcde146b4bcfc3de3588c374e84297a81d5c224f916281a5933d876b6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025571, "uuid": "e9c3d06a-71a5-48c6-bae8-34a59815d98a", "comment": "Malware payload (Mirai)", "value": "e9366a9ae048cccd9219deb1fec77a95e0f31327", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025571, "uuid": "7f713995-a8e9-4d18-8f1e-510fc7a9c742", "comment": "Malware payload (Mirai)", "value": "e2c9e8c6043d204ade2bc95ebacc7610a9af82796988b719dcadc7cc96dfc20b334c603d925ad0aa23bdca06bfe34220", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025571, "uuid": "d15b0e43-cebe-4264-bc0b-cf3183eefbcc", "value": "T112B34B22773A0A27C4E6613901E7DB36B7F68BC91960520FBE606EDC3F156E03153BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025571, "uuid": "4efa25ae-b267-4e6f-b705-a04482794a01", "value": "1536:5PCi+GtXhFaoKkSUR6t4xyYFu2TNv6A1E863ct9rdFpFvHA+vP:jHl3RKkS86mxyYhTb+UrdXFPAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025571, "uuid": "1238ae60-d8a7-4820-94cc-c02d77366b31", "value": 116510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025571, "uuid": "501fd426-0a89-49ef-a2d9-0e95913e7e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025571, "uuid": "d8bc7b67-ee36-4f47-87a2-3e77f02b67bf", "value": "hanoi.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5da7c1-13a5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744026167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026167, "uuid": "e36070a1-c7e1-4638-83dd-239c8b201a1a", "comment": "Malware payload (Mirai)", "value": "8f808b7a741493287630506237e402c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026167, "uuid": "a7e2e7e6-c4dd-4fe8-a5de-aebb409ff4db", "comment": "Malware payload (Mirai)", "value": "95f77bff3f3cdf2698ab542779dcaf9947850db3c81c1d4f072ff26c34ed979c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026167, "uuid": "23a88e0a-bdb7-4e1f-8720-c05b6e2c2306", "comment": "Malware payload (Mirai)", "value": "f0f2bef60cad55dd76337c99730b7b20e5cb8570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026167, "uuid": "809a5320-bd9e-458f-96ef-5d47a41dc91e", "comment": "Malware payload (Mirai)", "value": "616e73eb44c23a4e8164b8506351a107d2ca1923cefc9bd248b6d281d26088f248fd05bace9ab089dd5ce2d5fcba22e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026167, "uuid": "95ec1cea-4f13-40c4-b962-9e9218472c0a", "value": "T18243025D90D16B92F8F14731380CD966E420CDA9D8E8077BBEAF2F247385B7251DAE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026167, "uuid": "ea514d4e-5ba5-4d03-92fe-5123d713dd29", "value": "1536:OgKc0HUgdZerG8edWNn3hqryMFt6d2GvCt/A7j9Y:OXJHXdVWn3hqrbF4PvCt/sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026167, "uuid": "7c3f3c0a-ac7d-49f3-b213-778de7670f72", "value": 58864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026167, "uuid": "d01acda3-f86d-4145-ac55-c666ae342211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026167, "uuid": "842251f6-379e-4bf6-9b55-5563e82d5da3", "value": "hanoi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1b11ef-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1744017204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017204, "uuid": "ee2a468b-58de-42cf-8eb2-bde28b17f57c", "comment": "Malware payload (RemcosRAT)", "value": "c8e21020940ba49156c73340ddfa7c86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017204, "uuid": "68feea42-8119-4904-a4f5-1fc9b1dd126b", "comment": "Malware payload (RemcosRAT)", "value": "965845db528ea9bc4dbd24b1c6ea5495d771549bb9307955eaab3f021b0b9018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017204, "uuid": "b9e2f456-8e3e-43f0-969b-2a036b54f06a", "comment": "Malware payload (RemcosRAT)", "value": "7f84a4dcc45d658a805f042681c62b074e86fca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017204, "uuid": "e1d9ed97-f388-403c-8a5c-26e6f28cfb52", "comment": "Malware payload (RemcosRAT)", "value": "89caf2703dfb40e22e5f5b4cb131fc71518f9ba1cdf29ffcdb442d6c8ba8ed89e5a8ef51942db846f63c6d093d4d5d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017204, "uuid": "2db5882f-2fb2-457c-ac17-16699fdc2358", "value": "T1B7F4239A17E1E012CA621B32AAD64BA3DDF353292D5E060327536B29FD076C50D0B3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017204, "uuid": "2280d667-db41-4957-ba12-2370a11ee5cd", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017204, "uuid": "8f87d06d-7bc6-41b6-94e8-561a0648fa75", "value": "12288:b35GUP4TlEjG4BVFTUHO7fKHwqdgeOYUEqF/rApqTpB/37D:b35LPQO7FOcfKwsDUvOpqTpx7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017204, "uuid": "5d5f61be-b73f-4d0b-b76e-01970e68b82d", "value": 747120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017204, "uuid": "ab7a314f-09f4-4e75-a5c0-1069eccd5504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017204, "uuid": "9b22a218-f9ed-44a1-b651-4a5c5e56252c", "value": "SecuriteInfo.com.Win32.MalwareX-gen.10802.4830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017b4b0b-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994633, "uuid": "1bfe6011-88d2-4571-bc2a-07755c086c51", "comment": "Malware payload (Mirai)", "value": "f6421005fbf10a6535f84f920d6c6b82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994633, "uuid": "78297aeb-3f09-472f-b57e-14345fe6a77f", "comment": "Malware payload (Mirai)", "value": "96dae5ae780daee37b61dd185ebd5984a2be9594c556dc0334333ac7aebbe39c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994633, "uuid": "f3c891cf-3f69-4d31-bb4a-3ed88a78fc3a", "comment": "Malware payload (Mirai)", "value": "3158e71e884befcdae5a17ed418c7ec8b8c57286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994633, "uuid": "553e4af2-6214-4b08-870f-117c3b6f7619", "comment": "Malware payload (Mirai)", "value": "88cdbb9c766dac4803305673a91ff44c36896ba733ccdfb17f953a256b27216cd7d774296bd064c4628da262605a7eae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994633, "uuid": "f3394cca-280e-4296-8ab9-c1fe42c26894", "value": "T1FF532CC5B981AA26C7C15677FF0F024D3716879CE1EA3343A9291FB437CB95B0E26216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994633, "uuid": "51b52125-b862-443b-82cf-afb2a9cc6e11", "value": "1536:ojnieZ9njsrI9gySZLiM3/PGGghsI/e8pSodzvu+04:ovZDaZLhPPGjh0sSKo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994633, "uuid": "a0c6cbd6-0b3a-4d8d-881b-77db76d746f5", "value": 62760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994633, "uuid": "ee00ceed-9113-4559-8dd2-21e8eff31e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994633, "uuid": "bd8f62cd-4f69-47ec-940e-27b678543e07", "value": "resgod.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810e6452-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744011168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011168, "uuid": "95bdace1-92de-4a8c-9d31-a3b298f2e8e3", "comment": "Malware payload (AgentTesla)", "value": "29656e3a5bedb6b8035b122cfc7f5f34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011168, "uuid": "1a7e24e7-1aa7-41b0-a62c-0e79a3da3398", "comment": "Malware payload (AgentTesla)", "value": "98a84e3c3cd8c1fca71a54993c9f02cf6ff114d6ba89eee2080c78f4e3bbca18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011168, "uuid": "1ab22b39-9ec4-455b-abb7-e62feb9f7b47", "comment": "Malware payload (AgentTesla)", "value": "be6088d23d1d7affcd2c4241edeb82c20430480d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011168, "uuid": "faaa6930-adf9-4cd9-8566-c407fbc20755", "comment": "Malware payload (AgentTesla)", "value": "0272ca34f5b8ab2922190e51ef74fb5de4c489a32a453d097ea4531c9592e141974aafde8ea2317e30b83d1f63fb9ac7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011168, "uuid": "5b0bd478-186c-40c0-bfe6-e020de73a390", "value": "T14235AE22B3DEC3A0CB779173BF6977012F7B78654630B85B2F881D79AA50161122D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011168, "uuid": "d79fcd76-d5f1-4f72-87b7-db62f8bb287c", "value": "24576:Lu6J33O0c+JY5UZ+XC0kGso6FaWbhj1A4KaqntIBWY:lu0c++OCvkGs9FaWbdeIqnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011168, "uuid": "7d2f8287-33d1-4ef0-a6bf-e52d8792e404", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011168, "uuid": "a563b5aa-aca2-4768-a868-1cfe5aada269", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011168, "uuid": "a4319c06-021c-4132-955e-ed4afb3f1e32", "value": "datasheet VALVES.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe88353-13dc-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049948, "uuid": "822e5ade-ae15-44c7-8a23-843fdfb72bd7", "comment": "Malware payload", "value": "d6b7835aea8c6c36637e8b0d13523e82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049948, "uuid": "51d0f021-7a3e-4d85-9039-134b7f8ed751", "comment": "Malware payload", "value": "990bed4149971491c4f625978702ea1c6c3066ef7f3b924d81af65a1b99ff5f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049948, "uuid": "712fe95f-c579-4580-9bd1-75e6eb5b93b9", "comment": "Malware payload", "value": "9306a32c7f39757424b856a3c9fc3481e520467a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049948, "uuid": "b9b62322-1857-4e00-a4cf-e5fe93b87fdb", "comment": "Malware payload", "value": "2f870e1402b2b2384676f5b8974031978766b5ec85b535f9e2ad60ce7527fa951c9fc7524485fd38c297aab36593b145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049948, "uuid": "04d76929-a287-4285-844b-76f195b2431c", "value": "T146A533057972CE49CABB6679C4A9E3F4537B4EC2D640D98B58C1BC3D7CB18EC8A0D186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049948, "uuid": "65ba1e98-5321-409c-ae59-d8fdade2036b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049948, "uuid": "c9b50b10-4519-4845-9f41-39d3f88115c9", "value": "49152:dG8PAEAUMcY5KB+0c5G993ZaBCcapkADgNNf2FX5/1cO3LBR9:drPBccrofG993ZaMeADgNt2h5/+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049948, "uuid": "bdaa0216-89d8-4c5a-a718-051b3b43b756", "value": 2210816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049948, "uuid": "a05241fa-bbb2-4be7-bf65-73626d849690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049948, "uuid": "917dbdb8-f63d-4d93-aa9d-062868604bf6", "value": "d6b7835aea8c6c36637e8b0d13523e82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4cb08e-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744011161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011161, "uuid": "4d5d10e1-12bd-4f0b-96e7-0c7881c9629a", "comment": "Malware payload (AgentTesla)", "value": "176b0e812e065419bfc4563006a4e635", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011161, "uuid": "02a4f126-0a7a-4d0f-a00f-20d3526c79e9", "comment": "Malware payload (AgentTesla)", "value": "99baf9d5c23c9279310f7d426f1ec530acc0bc11894110bc96ce106c44758c10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011161, "uuid": "b216a6ce-c830-4720-a6a5-9851a81283ac", "comment": "Malware payload (AgentTesla)", "value": "c68fe99078ac7875aa67d05ad3d4e6d44d3ef783", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011161, "uuid": "1f6b787c-69d4-4c15-9f53-b002d212040a", "comment": "Malware payload (AgentTesla)", "value": "4ec4e3c46999d392949ee5c6f571cdfa20465be5d057fbd4987996c2c888d0213ed62b34b87dd8e27993686c141417fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011161, "uuid": "29641d34-30eb-4677-ae8e-31b216c1388b", "value": "T1B735AE22B3DEC3A0CB779173BF6977012FBB78654630B85B2F881D79A950161122D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011161, "uuid": "7c9301f6-d7fd-41f5-9f15-4317ed28f9a5", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011161, "uuid": "b4a47928-daaf-45e1-92fd-47ddc63c72b8", "value": "24576:xu6J33O0c+JY5UZ+XC0kGso6FaWbhj1A4KaqntIBWY:ju0c++OCvkGs9FaWbdeIqnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011161, "uuid": "4e79345d-f01d-44bc-b3a6-dacb63544114", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011161, "uuid": "b31e41e9-ad40-4186-8529-c856cfcf1f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011161, "uuid": "45532e5f-92ef-45e5-aed6-b6a78dd2710d", "value": "datasheet VALVES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c96daa2-13df-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744051076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051076, "uuid": "d8c098dc-584e-4218-91d5-c6bcbcb1505a", "comment": "Malware payload (Prometei)", "value": "cd716cfdb1ed71f0279623ded6f7e13e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051076, "uuid": "62efc732-dc1c-4c52-9f76-5d4d91c86d29", "comment": "Malware payload (Prometei)", "value": "99f53ba765b3608ed74f36fa5127d7ea282751f73f2421ac4c12b7b5996a3f80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051076, "uuid": "8d5355a5-5af8-4337-a64a-cabfa0f74a47", "comment": "Malware payload (Prometei)", "value": "a1954a879bac94e2a00152aa000d416c13d32d79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051076, "uuid": "4e73fc0d-0014-45be-9bfe-d9f556b39d95", "comment": "Malware payload (Prometei)", "value": "87c1f65cc1c3f8f0d6bb8309d2f9e0051ea88271169f875a4625e377eebb3151fcf8325c3c0b68dd01f64dd2bba34ea3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051076, "uuid": "25c996b7-b73c-49d6-b073-9151fdff345e", "value": "T1FA155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051076, "uuid": "99e3206f-0c87-4147-94c0-93428329e792", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplc:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744051076, "uuid": "c3821a6d-cadb-416f-8e95-140d56844bbc", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744051076, "uuid": "d15dab87-eacd-4fce-be14-a40ab6423d94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051076, "uuid": "971ea520-4c64-4570-ac4e-73c4c31a0e8c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535c67bb-13b1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744031277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031277, "uuid": "149868b1-c168-4020-ab92-f1b4056839f4", "comment": "Malware payload", "value": "2852503ef0eb9a389698212d9859aec6", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031277, "uuid": "f3ecf57a-4c01-4db2-bb31-df493902cc28", "comment": "Malware payload", "value": "9a16799f73f551d9400c84bda7014f613d9665be2b979da8e55e216647402e45", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031277, "uuid": "9b1a4388-f52a-4f27-b928-34931b9d23a8", "comment": "Malware payload", "value": "edaed91f19979a0bd7de4fae92222eea0c5c8d08", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031277, "uuid": "4344f449-4043-483a-9a74-13d4ac816e7d", "comment": "Malware payload", "value": "ac448e4a941936773e68fad4186560ffffb9731d6fda86256a7ab25d2a7b83f961e069f78dcef79c8831c680fbf0044a", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031277, "uuid": "97027398-bc97-4583-90f0-06de1623f8b6", "value": "T1FAC02204A3828082D20030096064B484BC4D76860CD284ACA343CE0F2C449D0C24966A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031277, "uuid": "65f25335-7562-489a-bfd6-a7815286f424", "value": "3:HRAbABGQYmqEXXXEm7NMHaRA/N3JL18PKgPbyApBHKs7V25YdimVVG/VClAWHyn:HRYFVmvMHaRAF3JL2ygPbp2s7A54vVGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031277, "uuid": "64a450e4-cd66-48be-b679-99e7d3bc39b2", "value": 176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031277, "uuid": "b54c89d2-6ed1-4385-8c4d-7c1211c0df22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031277, "uuid": "d51d8ea1-5bcb-4ef8-8df9-bc73dd952203", "value": "1TSA6730932.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881f309c-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744017192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017192, "uuid": "d66c7199-b263-4a38-a9f6-d33ac276231d", "comment": "Malware payload (GuLoader)", "value": "f15f6a1d6c56fa51691abb59c60d7256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017192, "uuid": "1ddcc713-dc21-4378-a429-3c64660f6747", "comment": "Malware payload (GuLoader)", "value": "9a5f90ee82403603472ee3e8ac5b83fe537960a1a05f1534d7167ae4cda0f2ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017192, "uuid": "88e5ae72-5cce-4877-accb-4438b2d9eb04", "comment": "Malware payload (GuLoader)", "value": "1d7fdd18a4c4adae22d345a6f7f4c1dc58023eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017192, "uuid": "df44808c-0879-442f-b9d9-86b1eb58d716", "comment": "Malware payload (GuLoader)", "value": "bb2ca8a6693651e2584a221f28df552ea22e44630b1e7871fe6a6ebcfe9cd29c334139f0be91079c40e4da61437ed8cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017192, "uuid": "95032c11-5b0b-4bc4-b8dd-36f71806a58c", "value": "T1F0E402D0B711856FDC23C6B48EF70E1E45BA1CE7E2C40999969CB7097023E92B51FA87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017192, "uuid": "c9e35c52-1291-4639-95c8-b751f785cd8c", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017192, "uuid": "623ec3a1-7460-4542-a9d3-54f6e8eaab9b", "value": "12288:WIpRhPG0YdguD319tNWWKj1R2TX0dN+vDFakDDkj8W5hdyPJV:N8HdguDHtN4WTX0dGJTW5LyPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017192, "uuid": "0b7ac793-81e0-4ada-bfa1-5af78f02e929", "value": 668975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017192, "uuid": "3f24b655-d27f-43ed-88e7-9787073cdc52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017192, "uuid": "76012f65-b2e0-4a51-ac60-4ddd8af4f62e", "value": "SecuriteInfo.com.Win32.Evo-gen.9555.12671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94259a6-13f4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744060251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060251, "uuid": "5b731aaf-b724-45d6-a5c4-49aba72dfa32", "comment": "Malware payload (Prometei)", "value": "a1c89b4396b66486f9298856587bfa88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060251, "uuid": "2915b393-493d-4dcb-b407-eca56331f67c", "comment": "Malware payload (Prometei)", "value": "9ae5d3e9f17674ffaf9f0789ab539a51d169c89c0012d3d3e416550aca1ab53d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060251, "uuid": "defc1d11-70d1-43aa-bb4e-dbc288b93623", "comment": "Malware payload (Prometei)", "value": "a86238d23b29465d55541d31bbaa97396a068732", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060251, "uuid": "41f31936-db8f-410f-9bd6-a2f76f8fcc7c", "comment": "Malware payload (Prometei)", "value": "954921af9273d4a12d910c9cd4bbfadd6f12d0dae5a5c8eefebbb0af2d5e7b017f6c6c83df8d91f7f590d9ec86102af6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060251, "uuid": "3560711e-7ca4-4c57-9f18-95cdc9c7758f", "value": "T19F9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060251, "uuid": "f20e119f-411a-469d-b443-fe51aa91214a", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgv:25WOSACZSV6eKRH5EPiamb4DsDwwcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744060251, "uuid": "819f0175-a35f-4d07-99b4-4f5f0b6236d8", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744060251, "uuid": "28eec98d-dd9d-48bf-afd8-500d4ed378e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060251, "uuid": "7f3c2be6-4dd7-4c17-acc4-e90b55ddd970", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d088248c-1357-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743992833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992833, "uuid": "7add6957-061c-40a5-9f75-5253fb10d1e6", "comment": "Malware payload (Prometei)", "value": "6c2a84e7fd9d3f392646abad90d4503a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992833, "uuid": "b4d27008-ad26-4e4f-b5eb-e2f40eb38ebd", "comment": "Malware payload (Prometei)", "value": "9afd4c15088cedfb10386e547dd73dff9a2b06b124227f1e3c7b5440f6943eb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992833, "uuid": "aa59a280-d03d-49b7-904e-64860591381c", "comment": "Malware payload (Prometei)", "value": "8c65fed519719fa7c3e031e8e79047901c9965a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992833, "uuid": "fc573886-9731-4670-9101-126c627c7311", "comment": "Malware payload (Prometei)", "value": "41a7dbada011e3b5ef4f7b81f92e83b5aa4ba32ae98add8385c3d4ad00ed17ae5f5a5c368931069b7a66d292a9559737", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992833, "uuid": "4386df09-7e0b-408b-90d0-e51700b15561", "value": "T1AE9423F8C87D2E3098169B3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992833, "uuid": "ef1899e0-f36c-4ab7-a731-9a24992553bf", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgX:25WOSACZSV6eKRH5EPiamb4DsDwwcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743992833, "uuid": "7054ea8f-7288-4395-bc27-d97e3cb176ac", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743992833, "uuid": "c6c9cd70-b2b7-47b9-a5c3-15e460a31a21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992833, "uuid": "45a00259-abf6-4685-a214-8b7885fcdea6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a583598e-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744034422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034422, "uuid": "fbb44256-898a-4c86-b201-10fd026cd488", "comment": "Malware payload (GuLoader)", "value": "0e676119c63f320be556d60725395ed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034422, "uuid": "bc0e2cb9-9fe3-4bbb-97ba-c90c6065c16b", "comment": "Malware payload (GuLoader)", "value": "9b03aee479a6f64b7913609ccbc2285920e8459dc1676a120d8a2c86ecb5fcb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034422, "uuid": "9d24de03-fab3-4782-aedd-d0de260702e8", "comment": "Malware payload (GuLoader)", "value": "204e1bd9f66a128256e778a91a5612ff99ef3de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034422, "uuid": "e3d993cb-a207-4f7b-9a4e-e51ad4d19a2f", "comment": "Malware payload (GuLoader)", "value": "e6ac1c23ab3f4dedb6222adf103e4ea4c28e7083eacbf1d4b2c7e111290f884afb3453e2043d2a78858b73f569c00792", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034422, "uuid": "83d52811-9ad1-47d8-8bf3-b396c0d1b953", "value": "T1D95523007790C51BC8A5C6349D1B7B14B73AAD89AE3F730623993B9F3872560D56A3F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034422, "uuid": "3e88999a-1879-4a33-afce-b67cf6952f41", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034422, "uuid": "c7b6b855-d0c5-483b-9067-4a12c5fa6670", "value": "24576:h6dRfReJhDtPVmpDq6ZBKsoDUBMoiaDi4/ehCgs9+fyW:hiEJPVmpDq6ZB9oDwMRaDiVCB+fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034422, "uuid": "5683f837-a2fa-496b-bd98-ee425660edf0", "value": 1401864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034422, "uuid": "8c1c453f-0f65-43fe-9668-f43a612e5e18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034422, "uuid": "eae5be3d-6f5d-490e-b66b-acf0380da005", "value": "9b03aee479a6f64b7913609ccbc2285920e8459dc1676a120d8a2c86ecb5fcb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41430a47-13ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744043702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043702, "uuid": "6519d3bd-96e1-4532-9bb6-eee771265529", "comment": "Malware payload", "value": "538f8d597f24a9e4b87e1cc15158da02", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043702, "uuid": "3cc07f1b-b3ba-4e90-86a6-2affb97b15b4", "comment": "Malware payload", "value": "9b24662d40fb8188987977b9e0fa7c0cb31e353ec1e746ce44e5a40d6522e4d3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043702, "uuid": "a589d58f-bf1b-4cf8-90d1-a13ea1ee6f25", "comment": "Malware payload", "value": "ef5a3ed9d2c766d909ead96bea3425bfdfc26455", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043702, "uuid": "1635cb04-83d6-4fac-ae66-a80aa9d329f3", "comment": "Malware payload", "value": "ad32cb823b86c7c11f77134ba3e7d968bc2a0ffa9044084800e933c23fc06390c96211a9de41598257f1454943868e1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043702, "uuid": "8ccedd85-9551-464e-92ef-2533cf2fc04c", "value": "T189D3180A27E89814E1FFA9730670A111C779B8431A66CE1D1BC2F86D2B3D6D1CE16F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043702, "uuid": "76d3e184-b443-4562-936c-75aa3e80d8bd", "value": "3072:N9HtQ7SEg1abDbN6kFgB6nhGZRb5RtsLPwvx+JgbY:ZQ9pFqI2bACb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744043702, "uuid": "4d9cb74b-4e64-4a7d-91ee-25167a858110", "value": 134157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744043702, "uuid": "97c1793c-0c7f-4259-b230-da7707d786dd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043702, "uuid": "bf5e0195-645e-4d58-b2fa-b0a8d33f8852", "value": "mscorlib.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c850bbbc-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034480, "uuid": "caa034fc-251c-4507-8c03-ffa016486637", "comment": "Malware payload (Formbook)", "value": "4190d855ee62de144bb482e4adec39bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034480, "uuid": "3799cbf3-2a4d-40ea-8159-a0ff568d4840", "comment": "Malware payload (Formbook)", "value": "9b4d21536597cbcae0a05cd6602653d3a03d4fb7fa96b2cf5dc78f79ca8e3959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034480, "uuid": "8e88918b-7eb9-41c0-9d41-f0e3c81b8028", "comment": "Malware payload (Formbook)", "value": "befcbbf0da80403e0bc501ee1bfd720dfb259978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034480, "uuid": "99f575ec-c3f7-4581-b97c-daf2094b9b63", "comment": "Malware payload (Formbook)", "value": "2592a8dac6fa6f55f67712501d85c0471556a2f6d0b483e556470f475abcc70ed18f69c6188b57ee48f76b1906ce6164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034480, "uuid": "6810e694-ca84-4521-aafe-4f59ba610817", "value": "T12345BE2273DDC360CB769173BF2AB7016EBF7C614630B95B2F880D79A950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034480, "uuid": "231e630e-ed51-4fdb-a778-8741e0b5dc63", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034480, "uuid": "a7353bec-e7b6-4f8b-a878-1253e207df1f", "value": "24576:Mu6J33O0c+JY5UZ+XC0kGso6FaB9LJOE4irjSWY:Wu0c++OCvkGs9FaB5r4cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034480, "uuid": "c5d4082e-c7dd-4b5c-913c-1d8bc85d0835", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034480, "uuid": "743cf62e-d6ac-4a05-aabf-064b68369848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034480, "uuid": "27019815-3c53-4c5c-b662-97f91d72bf4f", "value": "9b4d21536597cbcae0a05cd6602653d3a03d4fb7fa96b2cf5dc78f79ca8e3959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05704ed1-13f1-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744058634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058634, "uuid": "1a053c95-2ef9-475b-a8d0-03461c04a8df", "comment": "Malware payload (DarkCloud)", "value": "04db943019b0c0ec05df15b32a9a3e85", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058634, "uuid": "5ee3dc42-cfb9-4cb7-8d18-d413f77e9249", "comment": "Malware payload (DarkCloud)", "value": "9b64d02b1f5a95926d8d362e183171d90864ac23c5d68d1856f9f426f347f893", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058634, "uuid": "60f5d69c-c36a-4dce-b640-9c8c892a3c4c", "comment": "Malware payload (DarkCloud)", "value": "c45d7f46ef1d4033264c3606c8df36cbbd79f5bf", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058634, "uuid": "740e94d9-af04-4bd9-b277-6ebec7da3944", "comment": "Malware payload (DarkCloud)", "value": "10ab7fc411d770610e737a34e8f5165a9cd9a49f181bf2f67526d5d0f6ae97aab41f273a844fb18af0d7698e24005152", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058634, "uuid": "df65a0c2-8104-463a-87df-506443048da5", "value": "T19B45CF2273DEC360CB669173BF29B7016EBF7C614630B85B2F980D7DA960161162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058634, "uuid": "97062b2d-e3e7-4e43-bebe-73018ac87e1c", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058634, "uuid": "62918a4e-6b26-4b50-9a88-eb2d3339975d", "value": "24576:Bu6J33O0c+JY5UZ+XC0kGso6FaXo84J8nPGGvRWotGWY:Tu0c++OCvkGs9FaX7neh0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058634, "uuid": "a8d8e145-9c92-474e-83b2-2e8cd5849347", "value": 1210880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058634, "uuid": "d73cb0c7-c938-4f29-a4e4-a990f14313b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058634, "uuid": "5cc52c78-8e8f-401a-8c74-7222a13ff59d", "value": "EFT_Remittance_Copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082dc87a-13a4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744025568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025568, "uuid": "73c03314-8085-40d3-91ea-f8a22bce6966", "comment": "Malware payload (Mirai)", "value": "7d4a3f6a4a6fff8e3c562144b9e9266a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025568, "uuid": "42004739-f0f1-4a62-befa-dd4184aeb69b", "comment": "Malware payload (Mirai)", "value": "9b8dd1882387ddc6dc7bf7354c8225c0ce9d52582e9f302d47a44f5bbbf56a38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025568, "uuid": "e3b12dc6-fcc3-4115-8b5a-0aa551564c02", "comment": "Malware payload (Mirai)", "value": "e8f7007de8d4d18e42bf3d3328653e2989a1b543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025568, "uuid": "fd37a907-3520-4b32-b46a-4dd0576e6124", "comment": "Malware payload (Mirai)", "value": "eb6bf49359fed614ef9427299dbd0ed538b30c052f36e4352452d8b286238f855e0191749b2cb4ef9218f41ea321e6c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025568, "uuid": "0398e1ec-f4b3-43d5-a1ed-d62e7170ec65", "value": "T106F2F11DA7636950CDA10072E246CF3936121E140B99FAB80B564F878AFC5823F5AFDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025568, "uuid": "ac141f11-b661-4c03-a2c1-abc74f71621d", "value": "768:xbQkhcZ7r0HfLRTj4XLo/RdMKVrLje2K8wpyWOGx0IB/F0J9VAHFyI2:ZQkhcGjP/RdMK1PnQ0q236ly7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025568, "uuid": "7ca9fbcb-6ce8-41df-ac5b-3396ad1dc8b7", "value": 36636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025568, "uuid": "3893c374-a075-4d41-ab4b-666355aa56b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025568, "uuid": "26485338-e294-472c-bb70-3baa764dfb8e", "value": "hanoi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f53dd9-1386-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744012998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012998, "uuid": "ea550cce-8dbb-4a6a-b1e2-bf686590f219", "comment": "Malware payload (Mirai)", "value": "5762977b8f713af23255a4856fed2f72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012998, "uuid": "ff0e1fe4-190c-4abf-809c-8424c6caa273", "comment": "Malware payload (Mirai)", "value": "9b9aae4a28f8e28eaeeb3bc35c600d4e0066a61b3d683cfab60aca90613ac332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012998, "uuid": "6a9fc930-6e4c-485f-b7b5-4c4ac957ac6e", "comment": "Malware payload (Mirai)", "value": "c612153fd7ea0e1b2a708fc498c59629a7a762f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012998, "uuid": "bc85c3a0-cf28-49d0-b156-b569fc86bdf4", "comment": "Malware payload (Mirai)", "value": "63d6fb7c630e2d07d18691fbfe50aeb868645c0aad5f7b81731644f691c4ef55c9a5acaa66ffc8230bdae72886346aba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012998, "uuid": "4e673dd7-508b-4d39-b158-740fc7962d8e", "value": "T19FD30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012998, "uuid": "107a1f82-60aa-4deb-8cd2-d2887f718e9a", "value": "1536:wKdzElm18uZJjb4A4Fa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TGR:wKpn0XU8e947LPHh+zS6thBZ6xKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012998, "uuid": "51b664bd-9197-40bc-ac54-496095fa381e", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012998, "uuid": "ecdd9c20-3777-4215-b341-c49f7de6fb09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012998, "uuid": "e7277338-dc48-4df9-b794-7c57441c1445", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e3ffd6-1350-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743989842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989842, "uuid": "67b0c8c8-a782-47a2-b631-c5e2cdf3967a", "comment": "Malware payload (Mirai)", "value": "0d036457752ae468bed0afb239644703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989842, "uuid": "b830caad-9a97-4f03-8ecd-b9b793a24ae4", "comment": "Malware payload (Mirai)", "value": "9baa710773592146dc5d1423d00d5cf521c51a785b47c0d367b466bc7d7d67d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989842, "uuid": "3b10fd2e-ee1b-4fdc-bf77-5c1fe51ca550", "comment": "Malware payload (Mirai)", "value": "e7102d0bd8edbe36f960aa18abf6b980cc4cb576", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989842, "uuid": "0a819f63-fac1-4d99-8996-b89a951bd480", "comment": "Malware payload (Mirai)", "value": "7e58ca2a756f9796d59e9ceac35513a33543aeaeb303b464b3de681c89e194d78c1b04e200041bcd736c5b1bccc77119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989842, "uuid": "08ac90a7-507b-49ee-9d8c-aae2480f784d", "value": "T121D2E01CF19BBB55DCBC087854D95660D894F2A4318A0F5D0BCD8C887F37E4BE5881B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989842, "uuid": "1cd77126-7109-4c3a-bae5-85a0eddd5c1b", "value": "768:Tw9YZs0t2NPXxYk38qqiEVTkGyr9MNAgz+aYF+6Z8ZNc5WUs8:WPharickGQMiK+lI7cd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743989842, "uuid": "8270e992-88ee-4f66-b2dd-fb9d3ee5566d", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743989842, "uuid": "0e9ceebe-e8be-42fe-a841-cdd1228f2bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989842, "uuid": "0f4da33a-b7d0-4628-b15a-fc7a05ac94ef", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea19b47c-13b1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Koadic)", "timestamp": 1744031530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031530, "uuid": "d36ac750-27cf-48eb-a100-4dfb00a6820b", "comment": "Malware payload (Koadic)", "value": "4b97436ae2e59a3ec6cdd4cd3c4bd264", "object_relation": "md5", "Tag": [ { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031530, "uuid": "589b46e2-a4f6-40f0-92f2-70e6552a5ace", "comment": "Malware payload (Koadic)", "value": "9be46b1d90072911e71fb6a94ababdeef844225247a9727d0da26132c356de08", "object_relation": "sha256", "Tag": [ { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031530, "uuid": "77db6b83-e3c5-4b20-9a97-bc704b1a9156", "comment": "Malware payload (Koadic)", "value": "70b715260a5c677972e82abb30f12f452b641da1", "object_relation": "sha1", "Tag": [ { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031530, "uuid": "314b1635-e869-48ef-94f7-ba8b253bcd24", "comment": "Malware payload (Koadic)", "value": "ea18adee223c08a1063d3f81e1e73cb5a7dd7282f0345936bf0bc6700930d7ce220a5f15a809a9e7fe849135b5d7de79", "object_relation": "sha3-384", "Tag": [ { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031530, "uuid": "b42e802b-fb75-45b3-9a44-4372cfb8cd2f", "value": "T14AE026016D16C8821C72E2A14335C81CFEA8F20300E0D84976DC6A5B5B25AE00B06454", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031530, "uuid": "1c0a5624-0709-4383-8860-0c174e9b8bc1", "value": "6:TMVBd/6nXT+q9NqhdF2bdF/z7fBhOMHaRAF3JL2pyBzMeq:TMHdCXaqahHkL1MM6mJ2UzMeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031530, "uuid": "a8787567-1fc6-4a0c-8c24-5b5e08eccfe0", "value": 325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031530, "uuid": "31bc17c1-1817-4418-9489-9f24907a921f", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031530, "uuid": "7d688890-14ea-431c-88c8-9a502db0efdb", "value": "RE_01890389024s1.pdf.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a1f842-13ca-11f0-ad17-42010a9c0004", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1744041983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041983, "uuid": "1826b213-5bd4-487f-9db2-5c790ba4647f", "comment": "Malware payload (Rhadamanthys)", "value": "099cbd1161cd2f0256cca3c7cb163574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041983, "uuid": "31ebdddb-e51b-4050-becb-fa2731d950aa", "comment": "Malware payload (Rhadamanthys)", "value": "9c2e49857c00116c81c0efa0259517d137d087d91ab8d37eada3a35b7e674c3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041983, "uuid": "4962dc31-bfd5-4f79-b89a-1fbc1386be28", "comment": "Malware payload (Rhadamanthys)", "value": "5cad857e99236d8d0b0e2012fda873e436e786dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041983, "uuid": "3e6d0015-61c0-4cf1-adea-1c97c5c2d7f6", "comment": "Malware payload (Rhadamanthys)", "value": "5511f06ea54b442f2b5f08171b1f6e259a841667029583b6fef213463f983b3f8d690342e428895be2c6f5d42837dbd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041983, "uuid": "20afcbda-ddff-47f1-9259-bd1331be4a82", "value": "T1FF7533D26B24C3F8EBE12E3064E74927379F5E7120E956E7D104352930B3F906B4AA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041983, "uuid": "fcf22263-d315-4557-8e16-a59dc055b310", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041983, "uuid": "61f46f2b-66c4-4a80-a8c7-8578da93ff63", "value": "24576:btCDiWDOJkkEoo2a2oGEWF3WtKkukPddNLgRWsI+sVpevpIGlHti7M:bCV/T2o23KKkBPddc3sVpYpIWHtiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744041983, "uuid": "5a0b74a2-4db1-466d-a6f4-0b6860886a57", "value": 1575537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744041983, "uuid": "9b60cc62-c6e1-48f8-a9e5-b327ddcb208c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041983, "uuid": "fa646004-3d5e-4e2e-af1d-5e8a60d781bd", "value": "099cbd1161cd2f0256cca3c7cb163574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2c7440-135d-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743995244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995244, "uuid": "52070006-054b-4157-9670-8dc3edb362ef", "comment": "Malware payload", "value": "730ce80d19d82ac3f75903492c12b8f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995244, "uuid": "b92c7e0c-3a6c-412b-9cc4-f4282089996e", "comment": "Malware payload", "value": "9cae737fed6231d3808a5706d169a0ed1128ca2c8a972fb78fdbe855b2cf926b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995244, "uuid": "04382249-fb6a-4295-bec5-dc7885fd0e7c", "comment": "Malware payload", "value": "c86f18f95bcb20883780d2f24fe04b1a4b46aa2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995244, "uuid": "a3507d6c-967d-459e-a898-0430c95f0a64", "comment": "Malware payload", "value": "c9e04c2151fd90680fef5bb4d71785d4f11081aa86de3bbb34a95b537421f79c00f6c4485b9fd7d7a70f54891782f89c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995244, "uuid": "9ad508cd-630f-4fca-8e7e-f6ac8e8387a7", "value": "T128C3BE83B74B2551C82506F11BC71BED2E6372269E2FD8FB2C1D623B9A760DF4509782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995244, "uuid": "c99e2d68-b0ed-4bf6-88e8-5c6c67cd0c05", "value": "1536:jKjrl4tdFDwrTm0/QITb+VGpDIjuXlx4JbneYx/+6JDg6d/LWFG:krutdNCTmOwVPADkbVxW6JDg6dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743995244, "uuid": "a783f1f7-2c4f-44b1-b2e2-b384fb8b0005", "value": 125072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743995244, "uuid": "aa6465d7-d9b6-427b-be36-439593d0004d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995244, "uuid": "4227d652-d708-4a4c-b471-11ed69a074c6", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba72e43-1347-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743985684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985684, "uuid": "4f23ee61-3d8d-44b2-808b-3e8658f08bcf", "comment": "Malware payload", "value": "5a5c9ab1e1d89864370152ac20634c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985684, "uuid": "2a33fb0e-12ab-454b-90cb-5588d3c94402", "comment": "Malware payload", "value": "9cb3af001d7ddf66abc40ed230351dc6a995afefae97e5e6ed9aa038c938a605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985684, "uuid": "ed420550-f663-4425-bbd6-cfd8b9e34e1f", "comment": "Malware payload", "value": "6df35dcc258158609197ad20251d6c53f467caf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985684, "uuid": "d88e80f5-d9cc-4beb-a3af-358882adb616", "comment": "Malware payload", "value": "aec64b665d98152480591e1fbdbedf6c17cb5e0c4cfdc19e54860ef4d1c74ab601af00f90e94c1697b021c9483ac5c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985684, "uuid": "e9157fa1-47da-4c52-9b60-f94370d9f993", "value": "T1A3052859FAB840F4E066C139C956962BE2F27C801721CBCF52E477AA1F336D25D3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985684, "uuid": "90a07ec1-616d-400c-8795-9fafb2ec9b7b", "value": "8090a92adc1113fec47c474c51f43403", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985684, "uuid": "3b716151-5b25-4f2e-93ab-383e153cf1fd", "value": "12288:rLv0JiQRDueZrIfWrXeOKznZOetN6Vc9tLDRND3QsVGz8elm5IJUfrxb:rD0NuCrUWrXevnZIVc9RXQsVbe05IJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743985684, "uuid": "424db18c-ad3c-48c3-a4bc-e5e2036fb7cb", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743985684, "uuid": "15b740af-f0a1-4d33-a523-e2339fa2e07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985684, "uuid": "21c39273-0178-458f-8d48-9faa351dac0c", "value": "pestudio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca77c74-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994947, "uuid": "e924bb8b-7869-42af-8744-ffd7f441bcd5", "comment": "Malware payload (Mirai)", "value": "cc57272837b1ef16e62fcffec0c6282e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994947, "uuid": "56b733a2-80b2-448f-941c-4169af79b702", "comment": "Malware payload (Mirai)", "value": "9cc7effac30c411e66ede3f626861fd0a153a4ad097c52b6b19e52077c5599e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994947, "uuid": "b9793d16-176b-4431-ae8f-13364d5d8d8c", "comment": "Malware payload (Mirai)", "value": "2f4b4626e024681df9657060adb5e7400718fd91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994947, "uuid": "eca98e22-fee0-4aca-aa1e-c4807045809c", "comment": "Malware payload (Mirai)", "value": "30dc88c06fb3b7cd89a890360c148fda10f1efdbee6bcfce9b131d8d9c50a8538245abb889d5a6b58ec7a8f9e106bcb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994947, "uuid": "7ef73cee-48ce-4941-be78-abb3f7f1e09c", "value": "T17233F878780AF6ECE4E863B4F5471DF3299244243CEED6D3B0965132FAFA7886914D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994947, "uuid": "9d448892-7184-48b6-920e-7181ed558aa9", "value": "1536:m8nwIThscxSW2+u8/zqKF21HN86IIYt90:LnwIeAl6/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994947, "uuid": "f01e5c03-9fde-412d-b4cb-fa6d002bf89c", "value": 50604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994947, "uuid": "9316829d-94d3-402b-9dc2-e32c7bf2d223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994947, "uuid": "fb1e4d14-a330-4521-9384-275f2990b9ce", "value": "resgod.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77c6564-13f0-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744058503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058503, "uuid": "6d393370-e265-418c-a9af-c43c6b2939d8", "comment": "Malware payload", "value": "c6a119bfd5690fd9740d4b0ceda18c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058503, "uuid": "f6855cad-4bc7-4893-8c7f-26320d21b50d", "comment": "Malware payload", "value": "9d2adad9a2ce99316677b5133953f620720286d5820c0d54adb610ddb71cb8bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058503, "uuid": "78d109c3-50b1-4ccc-a7bf-a6d6dcfea8eb", "comment": "Malware payload", "value": "df5dab76f8b434996d47261010066764b514d016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058503, "uuid": "462d07f6-6a75-4199-8037-2b95355b99bd", "comment": "Malware payload", "value": "bf58dc059d7a787034e69338bf443d04dd859bd791dd81170247ca38ad18d5a94cf9fbb363aa6ce87cd3f3cd1b211dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058503, "uuid": "664f0a26-549d-47a8-9f03-9351e2ffe172", "value": "T11EE4F109F56548EAE8E742709B551201E5337C338B289AEF32F887652F27DD91E3E325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058503, "uuid": "566e5dc8-ec7e-456f-8a8f-a62a9a478bd8", "value": "d7df155ab6f6974888ad50c6d9e3480f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058503, "uuid": "da02dbd0-c56b-4381-b52f-68f37ceddb56", "value": "12288:SLz2g5eVQ9bgzo0y900DK/OiU0av3OSkWdlK8c3MIpr4NT:gz/5eVP2XiUCRWdw86Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058503, "uuid": "8ae6666d-fc83-42d4-89b0-44ec779c96d0", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058503, "uuid": "e73e2600-969c-4cc4-85dc-6a3d6b5abf6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058503, "uuid": "b42fe2fa-4fa0-4786-87ac-aae2787e2c1b", "value": "SecuriteInfo.com.Win64.CrypterX-gen.29502.5285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dc8c29-1385-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744012389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012389, "uuid": "87fe6b4d-eff4-4fa7-9a8a-d63da5d83a6e", "comment": "Malware payload (Prometei)", "value": "3baa111a91c604b5f769ecf810f56b55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012389, "uuid": "35f2c282-b071-4bf8-9304-773176b4b4bc", "comment": "Malware payload (Prometei)", "value": "9d456ba8402894ddf2edc71445f51dc8bc736e8b1bbc5ff20428b706ec3a3c26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012389, "uuid": "96fd7f04-3a12-4d36-a373-cdcc25d88548", "comment": "Malware payload (Prometei)", "value": "395437ddd90ec1db15b926634b05102e13f01920", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012389, "uuid": "d1aa330f-aad1-4e25-ac99-c8c9afdbb994", "comment": "Malware payload (Prometei)", "value": "bf3358fe364c0d53573f47c2ddb846c09bdf0d012d15f08552998bf8cb3f06b6c13ea9dd7db012ca383b4585216e7cb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012389, "uuid": "9707a61c-7d3b-48f2-8be2-08ce846fa771", "value": "T1759423F8C83D2E3098169F3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012389, "uuid": "e3d1cd25-df20-4d9f-899b-5bad465a4112", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgM:25WOSACZSV6eKRH5EPiamb4DsDwwc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012389, "uuid": "2ab1a506-7119-4459-af23-04327b0c392a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012389, "uuid": "57949394-52c8-4e77-9bb3-23caa9d346ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012389, "uuid": "cf46ea38-f7a6-4c29-8a23-45e196282265", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00beb268-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994631, "uuid": "ebfee553-5838-4163-8dbf-d23855e66e82", "comment": "Malware payload (Mirai)", "value": "6e426247c1fdaaa09091b5ab4bb5a76b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994631, "uuid": "bb83c533-3bf4-44eb-974a-936d98226171", "comment": "Malware payload (Mirai)", "value": "9d5c10c7d0d5e2ce8bb7f1d4526439ce59108b2c631dd9e78df4e096e612837b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994631, "uuid": "6488eee1-74eb-41f7-b09c-aac1179c6889", "comment": "Malware payload (Mirai)", "value": "99616f9eb80d8c0e2d91c12fa9db7c6ab94b8671", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994631, "uuid": "f72c8b73-36e9-49ad-9985-d2a77d42a27a", "comment": "Malware payload (Mirai)", "value": "6499031acace6294aee3278d333d276c446e96ede2c9060035cf2cd9aa4add4f9334291277e15adc32685a4cb856d682", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994631, "uuid": "5a9eae0b-2c96-4f1e-8a9c-3de14f70827d", "value": "T182E33B86E7409B13C5D32B76FADF42063323DB54D3A7230699286BF43F876994E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994631, "uuid": "261b6624-1635-4364-a91e-c5c301bb60e1", "value": "3072:tQd3hDQadsfCtnpdo7SEVv3YzWvLUM/9fbhvj:tixEadsfCtpdoNPYzWvIM/9db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994631, "uuid": "562edc3a-4e51-4ed8-8175-73179e3399e5", "value": 146074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994631, "uuid": "f0f4a2a1-57c7-4b05-bd50-223712d22612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994631, "uuid": "48f3d493-8705-43b3-b0b4-6ec47accd403", "value": "resgod.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60047e94-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1744015407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015407, "uuid": "d478ccd2-d29e-46c8-87f1-7b695e5587d9", "comment": "Malware payload (SSHdKit)", "value": "0098b350110f225f1f3810eaae24d970", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015407, "uuid": "b38593c6-f458-4de8-aad2-4d340689d578", "comment": "Malware payload (SSHdKit)", "value": "9d5e9bcf85b75db5a5c40bfed8704fa6305ab5eda68441c7d2f45c9aa60534b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015407, "uuid": "e021dd39-2a48-42c1-a724-8f4e0d292efb", "comment": "Malware payload (SSHdKit)", "value": "f1e70e32e5ccc765a8cf40f3ec9cc2d7f391f0fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015407, "uuid": "c19dbe16-54f2-4fbf-b574-ad77c6a1fcfb", "comment": "Malware payload (SSHdKit)", "value": "d6983a8f7544d87d4f41e09dfd30dbe43e6f091d375a73948e65acaa9b2c5a829e2dd58213ea26335518b1afd793c1e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015407, "uuid": "b9e5d9c6-5bfb-4544-938f-827abd58d96f", "value": "T199356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015407, "uuid": "d04f70e5-847c-480c-a6ce-70c7ae9da531", "value": "12288:E8dASOYRNCAJump208iJftd7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO/8+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015407, "uuid": "7fbb323a-1b88-4afc-be3f-df4ae633f75d", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015407, "uuid": "e13918d5-93bc-4ee7-a012-bcbe53cce856", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015407, "uuid": "16106a4f-d2f1-45eb-8bb6-eb5882fa14ba", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4f5978-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744034567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034567, "uuid": "48b454aa-f197-4edd-9fdf-b72f05a26709", "comment": "Malware payload (SnakeKeylogger)", "value": "5e5351c5c64bc37258d8cb29f339fb04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034567, "uuid": "dd951b89-7f96-46a1-bf27-bf2809d14caa", "comment": "Malware payload (SnakeKeylogger)", "value": "9dea2c8077ef669f375ee39b3696212613965aa7abc9cd511260700b274fb52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034567, "uuid": "cdef43a2-9769-49e0-8184-51e42f1d0414", "comment": "Malware payload (SnakeKeylogger)", "value": "8f564e327ca446c45d82f7ab83cd92718be654a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034567, "uuid": "3dc2a336-a113-4903-b045-da63c57a3fc7", "comment": "Malware payload (SnakeKeylogger)", "value": "eb4d465ffe546374d04994cb426e847c9b435797c17ebdb5f9692d21c4303f91c0778185d3db72b980c6238dc1518580", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034567, "uuid": "9fc6d686-27ad-4200-891f-249653213c38", "value": "T134F41204266AE913C9C71BBAA850C2B867F55DDDE422C7475FDABDAFB4BB3000581387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034567, "uuid": "fe8316bb-8811-43c6-850f-0e9e63be6dc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034567, "uuid": "a0eb2cc5-6d96-44a2-b3ec-2dd8dd0a16d8", "value": "12288:NXWxlloFBUBZQ8PwxSgRkU5/1WO2eynZ7iU5kH/cACPSNGOESC43Bmujsv:N2lvexSgRks/EvnxiUSH+PSN4ujw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034567, "uuid": "17109576-1de5-4459-970c-a8fbca7ec7d9", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034567, "uuid": "c4da38a6-b364-4df7-ac80-6ea7f3977b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034567, "uuid": "b3e182be-49c6-4692-92d0-2360447115d5", "value": "9dea2c8077ef669f375ee39b3696212613965aa7abc9cd511260700b274fb52e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a17841-13d2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744045674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045674, "uuid": "6122a215-4051-4b5b-866f-91ff7ae8455e", "comment": "Malware payload (Prometei)", "value": "17cd1e4b71c2393662ec2c61e4a982e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045674, "uuid": "3fa507c4-a34e-4b86-a73e-3191abf9cd09", "comment": "Malware payload (Prometei)", "value": "9e6f3516e8d7f1c6b28141e8776894a70c994e28c9c142cbc54de2e1e40d2b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045674, "uuid": "6c715d2e-d28e-47f4-90cf-5a43a7926d97", "comment": "Malware payload (Prometei)", "value": "cc1b89aa81341df57ae03a6dc971854e75fd8b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045674, "uuid": "efb3d2e9-17a8-466f-ba42-7213f0e0b924", "comment": "Malware payload (Prometei)", "value": "067cc4193cbb34d01dcb82fe5cd8584c5de62d98d63188d8a4dc8deaa5563543518d1079841c7e385df7714b670da663", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045674, "uuid": "58af323e-eeb9-4537-bf91-afc67028dea3", "value": "T1BA155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045674, "uuid": "a0ef5a10-b407-40ec-a3bc-71cd4c08076c", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplf:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744045674, "uuid": "86bf7e30-58d1-4ec4-b9f4-26af09e11f18", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744045674, "uuid": "deaea3f7-6760-4b02-9b8e-1232e659f662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045674, "uuid": "dcde2bfb-7db0-46f2-87bc-2ca1ea6f53a2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e578df1-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744017203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017203, "uuid": "1e485d39-8f8c-4e68-acd2-18ddfcfba276", "comment": "Malware payload (Formbook)", "value": "bd404885526267f2a21b82fb645234a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017203, "uuid": "4cb5e739-f4fe-48f0-86d0-e270fccd8033", "comment": "Malware payload (Formbook)", "value": "9ecc64a72f31078136a60baa618f717bbd9d0331516c16fbc98d8586b72749b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017203, "uuid": "6a6adfdc-598a-404e-beee-6a588fcbcdb1", "comment": "Malware payload (Formbook)", "value": "dfb5b091644c3918d300e749097a197a851bde94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017203, "uuid": "cd1add12-d5ae-4d1f-9d29-8686eb9edece", "comment": "Malware payload (Formbook)", "value": "88458d51623301bc0574d24c3314e3a93d1d167b17c7831ce352edc1fd416a8b23967acdaae8636a4cade4d1f8c0b89d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017203, "uuid": "d5a9547c-d960-4c47-87b2-0125978b2633", "value": "T1AA5522277E1ECEB1C74827BAF96B0C041398D2A5B963CF1A344E274E585337BE994247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017203, "uuid": "199c7436-d40d-4cac-bded-f892179ec1d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017203, "uuid": "0bf09714-6dd3-4d39-9bc3-31c979e90cc0", "value": "24576:EtCa3AGVrh5KE41pHgij5KtPVqxxAiqnzhsZ9BWQy3jD4NK:EtCQAgQHgij5aN8xAHnz6/64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017203, "uuid": "244c81dd-083f-46f1-8420-0d07445ae28d", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017203, "uuid": "5ff3c5ff-abfd-4d57-b4df-1df73c2c05fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017203, "uuid": "37172c7a-3427-48ff-b551-68757f53e575", "value": "SecuriteInfo.com.Win32.CrypterX-gen.28945.27665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42543ad-13a4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Rook)", "timestamp": 1744025937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025937, "uuid": "db482670-81a0-415a-9509-f94ec93ed924", "comment": "Malware payload (Rook)", "value": "e6f28a4f781cacc98ec2e03e684c62da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rook", "colour": "#7BFBBF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025937, "uuid": "e281d5f0-9355-41aa-970f-537f9837aabc", "comment": "Malware payload (Rook)", "value": "a00021822a02dd5d2fbd348e14902358762378421a6004f26434c4d4aa15fbea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rook", "colour": "#7BFBBF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025937, "uuid": "20a5a4bd-a4c4-4ef4-a1ce-e46d3945f2f7", "comment": "Malware payload (Rook)", "value": "678666316083022c5c8b831f55c6ba52b151b447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rook", "colour": "#7BFBBF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025937, "uuid": "78649d9b-9ea0-4e41-8ef6-30cf570ae973", "comment": "Malware payload (Rook)", "value": "4466047e10fb625e4cbff12c8d9941099453756edc333e697e8190064e7029a747e4aed1b092735f7020604368e88297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rook", "colour": "#7BFBBF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025937, "uuid": "c4a68a8e-03b8-4e11-9930-cac49b95a936", "value": "T182B43964E3B544E9C1B7C2BC68B51927DB31B4C4A31067D762A842B03BB27E17F7D6A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025937, "uuid": "4ffec906-9e62-4ecc-93b6-8206e927445f", "value": "d49dc6b823dbc454df9b43c9705cd75d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025937, "uuid": "5f66326d-1e76-4f26-b415-86b213b92e5f", "value": "6144:1MkLeY49LF6PAd+eDQbS0VeWVa1Kj/5hd2SXvT+r8feNNvy6kLu+1bq7CNZ:1M5XQrVeWVa1Kj/57nmNNeVU7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025937, "uuid": "1d611106-a737-439d-84ac-0ec5fc30dbbb", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025937, "uuid": "f2414b52-a795-4da3-83ad-88c199754f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025937, "uuid": "b1dde22e-32a2-4606-879d-3e959a36d6ff", "value": "a00021822a02dd5d2fbd348e14902358762378421a6004f26434c4d4aa15fbea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478a7125-1385-11f0-ad17-42010a9c0004", "comment": "Malware payload (Apos)", "timestamp": 1744012360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012360, "uuid": "ec3b7df9-6f9f-4382-9139-7c6eefda4f6a", "comment": "Malware payload (Apos)", "value": "84b3d2b5c6ba0d6627e74c2c89f3b9a3", "object_relation": "md5", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012360, "uuid": "4a3289d5-14d9-47b3-a24f-00ae434d08f8", "comment": "Malware payload (Apos)", "value": "a0027df5ccc2a66c8a0bcaa7d7033aa438b58a92732030e73d5a9f77a7659639", "object_relation": "sha256", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012360, "uuid": "88a7b022-1984-427a-96f8-2e3cae696ead", "comment": "Malware payload (Apos)", "value": "fffba62ea70604d321ed6ff199a96c51e4447d1e", "object_relation": "sha1", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012360, "uuid": "a80dea69-7e9a-44d3-9568-56fb7b7d944d", "comment": "Malware payload (Apos)", "value": "8fbd3b8a741e9b34489ab8759d7e7485612294bc69fe0c41df05947867514d9414272b055da743a3b54f76d7217ed8bf", "object_relation": "sha3-384", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012360, "uuid": "bf4d51f0-b782-4d16-b4a3-7a132351a870", "value": "T1BEC47D73F2F99C89C581C13C7986C36222BC79940BA3B717056962313F16DD2AFAE745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012360, "uuid": "f4222d18-0ee2-4a1e-a5de-20007a66524b", "value": "ac8b13711073e9343047374f24094779", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012360, "uuid": "c9928aa7-6be3-4551-bb8f-a4d8efe7d228", "value": "6144:x08cEpULsYWeRa9aa+u4QxlofqFTYDNeE4WNAm29N7gpiHRLGNWizbm2oP:x08cEpULsYWe0aa+RyFXm29NsGRKkiXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012360, "uuid": "df61f55b-2355-46cb-b4bf-b15b29cd668a", "value": 564196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012360, "uuid": "b0a437b3-1932-4f3e-a943-5d0f4e42bf1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012360, "uuid": "9cb71240-0c89-448b-be21-36e334a54cd6", "value": "a0027df5ccc2a66c8a0bcaa7d7033aa438b58a92732030e73d5a9f77a7659639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96148f78-138e-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744016357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016357, "uuid": "cbe6e41a-f697-45ef-8525-921e4f29fdf7", "comment": "Malware payload", "value": "333b09f8865aae5d257b6f11f2fe5d08", "object_relation": "md5", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016357, "uuid": "35310143-ebc5-479d-9120-7d08ae2424ff", "comment": "Malware payload", "value": "a02506468e632875a2c9c9c16e730b8bdc52f7450b28ee7bd8f5ac014b264e53", "object_relation": "sha256", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016357, "uuid": "277205a7-5bfb-4635-bcae-b0ecb2f193af", "comment": "Malware payload", "value": "c91dd6d2642ad1bf9769d62764ca5f2537cb4622", "object_relation": "sha1", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744016357, "uuid": "ea60a05a-dab2-4afe-a764-8cf45058e80e", "comment": "Malware payload", "value": "4079e3125d4301110eb66bc3d913c0c7d547719e8725c3687a6051dd3350ee60e506a4fd1c0f6eb9bea33fbf2fa86641", "object_relation": "sha3-384", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016357, "uuid": "991bbc9a-194c-405b-a0cf-58ee9f1a2ac2", "value": "T197D42308F148D887C56A97B4BB4DD1ABA31B40CC90268AB12F7D33E3775D78712BB15A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016357, "uuid": "e43b65d9-3c73-47cf-b55c-8e52a8ebb44c", "value": "12288:fadRZrWaDXjecbaKePQbNZEFWVf5FDEqvipiM1H+SGGMXljfNCtfkgUe4tY:f4ZRzZBePQ5ZEFWFnD9vsITGMV7NWkkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744016357, "uuid": "a23f7243-adaf-4ff3-9fea-5a24e08e10ad", "value": 649722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744016357, "uuid": "401f739a-3bd8-44cf-b675-484899c548ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744016357, "uuid": "b1ece123-010a-44bd-aee3-b140f7c77eb4", "value": "d#U043e-333b09f8865aae5d257b6f11f2fe5d08.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f566ee30-13ee-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744057748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057748, "uuid": "aab5b149-4665-4242-bd55-3b23340e689a", "comment": "Malware payload", "value": "e23392ce462550200c2d26b96332367b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057748, "uuid": "0b1e4da8-e33d-42ff-8c07-a673dc2f23d2", "comment": "Malware payload", "value": "a04e180ff1b7c3ec7934ce54fd58da76d62ffe438df5bc4a80c7a3c9385182d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057748, "uuid": "17707ed3-90dd-464e-870e-665dcaa1c8a1", "comment": "Malware payload", "value": "b0348717a520dcfafe5b5656cca005cbdeb9f52e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057748, "uuid": "36e078ca-01dd-46a6-be6c-0b8f6a393de2", "comment": "Malware payload", "value": "438686684a515c8820baf9635bf8d044b2400e80aa7dcb1e9e072498709b48242e495499ac115654f7c2ce79d131ef02", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057748, "uuid": "e37f2d40-9323-4a6a-8211-39ba58fd55d5", "value": "T1B442B5A9BDB3312792855EEB72237564FE21BD547CD4A0ECF79E9D44B8804F881B2B04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057748, "uuid": "02a5ca7c-727c-42fc-aac1-bcb87c65f883", "value": "384:D3Pl2/hCJRaUGRfubcMYSiK9DOLD2hpFkgqkWucI9OvQO2qQ2Jw2qdB0M2HavdE:D/lY0eUGRfub1YS1sLD2hpFqkWucHYOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744057748, "uuid": "19ee65d8-635d-4b92-9404-6a960d23ad3d", "value": 13193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744057748, "uuid": "a3526b3e-d9ec-433a-aa00-4eb2833794bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057748, "uuid": "2b1247e4-3177-447b-b494-352cf3190ffe", "value": "a04e180ff1b7c3ec7934ce54fd58da76d62ffe438df5bc4a80c7a3c9385182d9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ddf3e1-134f-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1743989135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989135, "uuid": "15d8242e-e425-41fc-ac96-7735b332886a", "comment": "Malware payload (AgentTesla)", "value": "c01b4dd2b2bd66b6c656ca50b8d17071", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989135, "uuid": "2433bbf0-6d4b-4e79-9dd0-d8090d8f32d8", "comment": "Malware payload (AgentTesla)", "value": "a07e3daabc7adc6ab02411ca94130ca082d8e5d01cab1ffc73eeed924fc87e44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989135, "uuid": "d02c171d-b7dd-48ef-8be2-42d7964c7333", "comment": "Malware payload (AgentTesla)", "value": "558f00963a490a6377311c22e7533f0ba3724d1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989135, "uuid": "b0d9cb80-16fa-4b96-80ad-e7642581f839", "comment": "Malware payload (AgentTesla)", "value": "c641222c163891254ca39581051776104f2e445d1ed959dcb5d0270d7a7247f5f79fda1ca48a745e47d8591197245b04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989135, "uuid": "fcca5b6a-9980-442c-b137-54a9c36e5a3e", "value": "T1A345CF2273DDC360CB669173BF6AB7016EBF7C214630B95B2F880D7DA950161162DBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989135, "uuid": "788fc571-5290-442c-a617-cad76b4491cf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989135, "uuid": "93fae501-e0e4-41b3-b18c-5187c86293be", "value": "24576:cu6J33O0c+JY5UZ+XC0kGso6FatIq2HDwnMLdWY:Gu0c++OCvkGs9FatIAM0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743989135, "uuid": "866a9287-8abe-49dd-ab7e-39377741428a", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743989135, "uuid": "2a7dd178-117f-4dea-93d3-af107ab67d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989135, "uuid": "7acdde64-cae2-4884-b843-3442f7ade766", "value": "DHL Delivery Notification - Scheduled for 10th April.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afb8173-139c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744022271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022271, "uuid": "dcb0dc7c-5b77-423e-b68f-a3676fc01851", "comment": "Malware payload (Prometei)", "value": "8f54dfca0aa987eef4417b4346081995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022271, "uuid": "7c614f7e-6a37-49fb-90c2-e703948b6966", "comment": "Malware payload (Prometei)", "value": "a0b06ef73dfdb446eeab152547353d80c38197cfd5feb806b40d587328a92c9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022271, "uuid": "4a106360-ce7b-44f5-97c8-7cbd81ca1e7e", "comment": "Malware payload (Prometei)", "value": "35920a79c7e2000ce01bfcd7721f8640d46753ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022271, "uuid": "b48511fe-ea39-4cc2-86b0-44a3cc904e08", "comment": "Malware payload (Prometei)", "value": "287389d5fdf6163818ca70c1e892eeed9e56d5c6fa17463b108e7d05c74163e8ee00d4efb245b5b987aef64b71538fd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022271, "uuid": "9230cddd-26f8-44ca-97c7-948979cb1ca7", "value": "T1839423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022271, "uuid": "8e654d27-f4cf-4e5a-8a39-81cd77faf266", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg3:25WOSACZSV6eKRH5EPiamb4DsDwwcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022271, "uuid": "8c763df6-6297-429a-95f3-96e075e9ed4a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022271, "uuid": "56409ccf-be52-4086-85ec-0a89c1cf5fe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022271, "uuid": "631ff1a7-b028-468d-b161-43bf69cde4e5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44368a24-13a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744027386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027386, "uuid": "0575ba0b-1879-47c2-b9b5-76faef42a41e", "comment": "Malware payload (Mirai)", "value": "139472eab02c7e51955347c762618cf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027386, "uuid": "6d779913-0294-4286-859b-c81672fd5db3", "comment": "Malware payload (Mirai)", "value": "a1a2a28d236d501b931a60e73492af1f98692a378767c3d8f34ef5640f55ac28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027386, "uuid": "23fd2b57-51aa-438b-84b3-453c39a75493", "comment": "Malware payload (Mirai)", "value": "95250fd80ca27fa228fd3855c28f5ec919fa4606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027386, "uuid": "cd463ecd-e8ea-4f33-99ff-f3c8bd2d4ea1", "comment": "Malware payload (Mirai)", "value": "60414a24be132466c1a77454ec76552d390b507148884bc5fc4ec17b2b83fe5674b44f39da98e0f594d5014347e8b7ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027386, "uuid": "67b01aab-f140-49f2-89d9-6da525f2643f", "value": "T16CF2F11E64627082C1584ABA7E8D8D27C534ADE1C08EB06FE1A7B9C67E6731AC721C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027386, "uuid": "3d56b153-322a-417f-9331-69d52a2cde3e", "value": "768:qNRNSOFvi7+1WGWcO0y1noC7UUQgS/5bMisrYk6Mz:KmOFL8Bc1mLUnfbCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744027386, "uuid": "5f512b5c-dc58-4b5b-b139-d6a0287cc885", "value": 36316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744027386, "uuid": "68b83f3a-c468-4ff6-9776-b3edb1de746c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027386, "uuid": "1f5db27c-193e-4f36-8c82-9edf1c3137e9", "value": "hanoi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd28fc4-13b1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744031536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031536, "uuid": "4b7850cf-6596-4823-8a10-a42db38a0c27", "comment": "Malware payload", "value": "171a39051580d4f0169f17e5a9680e7f", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031536, "uuid": "95e75b94-8ee7-473b-8741-5b8d34375f6e", "comment": "Malware payload", "value": "a1b072676adabfa37ce9b2c3da3d23e1011b964e1b120dc5b7eb56b06280f6ee", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031536, "uuid": "e63990ec-9a90-4fc3-a516-a839a33401b8", "comment": "Malware payload", "value": "0ddfe7e52f3c216a72f2214324fbbb994684a20d", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031536, "uuid": "3c04fbc6-849c-4e63-b1a1-27570905b43e", "comment": "Malware payload", "value": "de33c5e8b0a8cdb229767296fdfbe1842b1bbe84558e650255f0b1da0d76f2c24785471ae0f9dfac4953db2984c7d81d", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031536, "uuid": "116c8cb5-305f-43c6-8336-75a3bd9289ef", "value": "T16AD05E09899B173DF57BA771C4E18ADE1249501D2F057C6A00B51341D9191A56F9538F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031536, "uuid": "e7340be0-1822-44e2-9f9d-74b91af32d98", "value": "6:5jX/nQhISJeYEAQ+K6xWdkhLLdwETJhEtkknxljX/ft+lm7:5jX/2IGcj6xWQLd6k6/Vaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031536, "uuid": "e822980c-a350-4a7f-9c1e-1535d16bdde3", "value": 280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031536, "uuid": "fb944e54-f2c9-4628-9177-0a4b5fe50c56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031536, "uuid": "bf9ebd6c-1030-4c00-88db-cab7c37e6a57", "value": "trye.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effa173e-13d4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744046572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046572, "uuid": "c18c4828-922e-47ec-9cbb-e2e75fe109a4", "comment": "Malware payload (Mirai)", "value": "ffcf5350344cef2a668221a76af159c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046572, "uuid": "1825f550-3c3a-467c-b2db-22e09d71dfc1", "comment": "Malware payload (Mirai)", "value": "a2928bcff73aa7a6cea2085cd8e1942786f83f43719634960c762873f6130529", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046572, "uuid": "c2947fd9-a1b7-46bb-bcdc-476a00ee42c1", "comment": "Malware payload (Mirai)", "value": "a722b39f90ccb3458cccb5a1652d4f0873492710", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046572, "uuid": "44c74245-7ff9-41d0-9add-e826ec466835", "comment": "Malware payload (Mirai)", "value": "ed4797ac11b3699c0504b92847cb88dabc35e970bb5ca17bba724d005d41b7568e70bac5dff7aff8e91d7c26a56af493", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046572, "uuid": "d2ada8db-9c7a-451d-b65c-306d460f8b9e", "value": "T155F084DCA238CB124DDECA8EF2B0560480C3C0C8F2F0ABD6E2808820EE0498E326034D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046572, "uuid": "1f8e4abf-dfe8-4298-bfa3-589659f381b4", "value": "12:FE8i9pAC7ykxGWi2jIvKTkYBjtx51n5h5n:FE8G/sWi2jIv0kstP15rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744046572, "uuid": "8ddbca97-2fc7-4683-9629-65c343f77c76", "value": 553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744046572, "uuid": "835f2e92-e497-48de-8fa2-0f5cd51db6bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046572, "uuid": "8c41198c-6013-4830-a219-14c937e71433", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2db0d01-13fa-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744062764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744062764, "uuid": "1c99b59c-2cc8-4cee-b04d-e1d4b0562519", "comment": "Malware payload (Prometei)", "value": "1f324e2aa2f2c567c9407e56ddbedb55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744062764, "uuid": "d52f47e1-b9c3-407c-9010-8c4490d88ed5", "comment": "Malware payload (Prometei)", "value": "a2f7f79bde08cdd37c134a8ee3ec2998b9d3c719aa4ffaa6ef258c4fae88e8f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744062764, "uuid": "e30e88c3-0227-4b21-9583-26c5a9b3e43b", "comment": "Malware payload (Prometei)", "value": "a8051d43e48a7568b76f5512e028baae7c08fdbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744062764, "uuid": "fb9d1e59-0d6d-4f40-a179-6767f9c29097", "comment": "Malware payload (Prometei)", "value": "98e8d897ec265d49b6b95e2ad3a250367af4bc57c97b9498781849eb296e05beb1de94c86d53963eccbf447124e6e9b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744062764, "uuid": "3b423c2e-f197-4c0b-870b-c7c3232d89ac", "value": "T1D19423F8C87D2E30D8169B3CBB1A8268F0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744062764, "uuid": "5deef73a-d4d6-4893-97af-f8824591b124", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg/:25WOSACZSV6eKRH5EPiamb4DsDwwcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744062764, "uuid": "33c60c86-3bfe-44dc-a076-94e06c117f38", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744062764, "uuid": "7757affd-46de-4ebf-9861-48e3d6b55401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744062764, "uuid": "437c957f-c444-4bee-8d13-008e93643d21", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c7abde-1393-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744018453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018453, "uuid": "fc501198-2ca2-42e4-92ac-341e613a045e", "comment": "Malware payload (GuLoader)", "value": "dd504595a8dc67b8291c074506a3f8e4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018453, "uuid": "ec1c2344-fb7b-4e93-a455-8ccf1f982a63", "comment": "Malware payload (GuLoader)", "value": "a320f3efec3b4078664b328b8aeb56710362c35aba7163dd338bf3fceccb2321", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018453, "uuid": "f649355d-c151-4a7d-8a35-7f719c2813db", "comment": "Malware payload (GuLoader)", "value": "03a7aa08db134659481ec87a1ef824178be06cf8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018453, "uuid": "9b3b481a-48f3-4ab6-801c-d525ade67872", "comment": "Malware payload (GuLoader)", "value": "32733b902f58eaad67902497da25685fd030350346329edea042d3fa546b5210c5c3ba20d7344e87a71dacfee28aea41", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018453, "uuid": "377cc8b0-4121-4797-b41d-5862b2bcea14", "value": "T1DBF26BD6EC6002668D0B27ABFD451970C57C8256161300A1FEED738E550AABCF7FE61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018453, "uuid": "9ebe4aca-6916-4f23-a60a-f0c2228c5c43", "value": "768:+eifD7w2ZBVPMrg2vSJoQbQrZTm6FlvUWxolAixbI:ofDNDVkXSJTErFvFxUWAAiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744018453, "uuid": "49211485-ab6f-4c64-9443-07388334c565", "value": 34287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744018453, "uuid": "29d657f8-4d36-412d-9a34-b821a5b8e6c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018453, "uuid": "aa9aa388-c3d4-4279-981e-4e4b5b62967f", "value": "Sofortige Lieferung der beigefugten Artikel 07.04.2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037aa251-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994636, "uuid": "a27f69d8-f22a-4f5b-963f-e5decf868744", "comment": "Malware payload (Mirai)", "value": "abfe797a7f64580b3a92c863803eb857", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994636, "uuid": "cb2fa31f-ba23-4f9e-b3f7-1a35b82eaddc", "comment": "Malware payload (Mirai)", "value": "a3bb197d7f9cf8afdd798a7a4336a21020bacc3902a2e279aa6d909d315f202a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994636, "uuid": "f6660581-93fb-4507-88a3-4dadbf82a2b8", "comment": "Malware payload (Mirai)", "value": "71607ea7ed402a5e8e03c5e763ed7c348a0903d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994636, "uuid": "fbef9f31-7871-4c5a-8d17-4f71b17160fc", "comment": "Malware payload (Mirai)", "value": "01eb8333292fadbc6721e2cbd37890eb6a23dde269cba2ce4865f38c393fd8454c4e264d1b63f64e030de5f06e608eec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994636, "uuid": "3a6b2690-07e8-4c81-b14e-26cb8ba29e04", "value": "T1EF432A42F70D054BF5A31DB4363B2BD1D39AFD4032E4E2C4761EA609E2B29315696ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994636, "uuid": "8b3c1513-35f0-4329-8d41-4ea7e03c0dda", "value": "1536:DJt1IfGaVD2JPzZWggNzPqOdmuNVAzM8wZTFlD8aJ/E/hgM+0Roz:DEe8DFqsvv8aJc/xqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994636, "uuid": "ccfc205b-aab9-49b9-988f-cfa06b45ab52", "value": 58760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994636, "uuid": "01614d26-16dc-48a1-917d-6fa47b835ad2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994636, "uuid": "7927ad05-c7a6-43dc-97e8-8cb67f4e509b", "value": "resgod.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddf98b4-1399-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744021067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021067, "uuid": "a1bf7371-c31f-475f-ba8a-c761dd834663", "comment": "Malware payload (Prometei)", "value": "2d6b9918b694830e0d19905059f6e93e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021067, "uuid": "77bfa5a1-23e0-4ff9-9e6c-20c938c81563", "comment": "Malware payload (Prometei)", "value": "a43691277c631590e146f5cec625737897b057641d6770cec9b7f6ec0061ea4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021067, "uuid": "cd3be24c-3402-4e06-a2d8-fc0deb89e478", "comment": "Malware payload (Prometei)", "value": "8191735e833609bf5919d0f5463b63e939819509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021067, "uuid": "9d394ab9-0fb7-4cfe-a9cf-f2b1d48f10d7", "comment": "Malware payload (Prometei)", "value": "19d09bf3da35227bc718235901f0df049f631b21351e65570a96b04e6228acf1bd06e067f80d732acaa3fb8ce459980e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021067, "uuid": "73ff19a0-bd61-4b7d-af98-e380e2e3a5a8", "value": "T17B155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021067, "uuid": "f8487426-5e63-4e8f-96ee-e5daef8085e5", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl9:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021067, "uuid": "6357a1f7-c41a-4b52-be0b-86b608edd627", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021067, "uuid": "ea7189d9-fb8e-40ad-8af6-eab5ab7106c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021067, "uuid": "2e444b70-1abb-4094-861b-a71d50a2ccc6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407ca236-1344-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743984430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984430, "uuid": "7f20d855-4b35-40b9-ad1a-3f3171bdffc7", "comment": "Malware payload (Prometei)", "value": "3d1c7f19542a459c734541a972e2f48b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984430, "uuid": "4c05923d-6135-412c-abd1-7f500dd577d2", "comment": "Malware payload (Prometei)", "value": "a4ff9a32eeab0f77f4c312cac8a49f940725e687297b19279e17c59a99d45257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984430, "uuid": "44f7a21e-7bbd-4a5a-b00b-067f35f14963", "comment": "Malware payload (Prometei)", "value": "6b59526c04054d5ba7dfc884b7a6456277d76636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743984430, "uuid": "f5e5627d-5565-44e9-afae-f116d868ab62", "comment": "Malware payload (Prometei)", "value": "e126efb6cc48c5662ca74ce1c415c493aec6e9d5bf1c93df01fb9d2986a04bfa5ab3bc32a212b20713dbfebef1d0e335", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984430, "uuid": "d9a46088-a0fe-4fb2-9513-51b96eab304d", "value": "T16A155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984430, "uuid": "419aecea-8bf0-408e-be94-0f4f9abc27cd", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplc:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743984430, "uuid": "111f04ec-5845-4589-8ed7-536a0dd5511f", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743984430, "uuid": "a40c3ff4-8c3d-4bff-941d-5b02cd719ee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743984430, "uuid": "067b4e9c-98c3-4534-8224-253775c56687", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3228d6-13a4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744025870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025870, "uuid": "ca47e688-6b9c-493c-bf7a-eafa3fcc0889", "comment": "Malware payload (Mirai)", "value": "5b257a7a6816b5704fffe38822c082b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025870, "uuid": "faa55d8a-c2b2-4e0f-a1ea-ab490c4bca0f", "comment": "Malware payload (Mirai)", "value": "a5025df60ac30d9cb9568ee1143229f9546f235c366bff1c4888a69d1d2dfcfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025870, "uuid": "520ed49f-3920-43c3-9ea7-94147459615f", "comment": "Malware payload (Mirai)", "value": "6a169c686120822bf86072b9704733512ca8d380", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025870, "uuid": "a6dfa18c-8106-452c-a8b3-fcbdde160df4", "comment": "Malware payload (Mirai)", "value": "baba0324fec23e1e3fe2e2db1e541e14bb3a56ea43b314e138145ec3bb10112dc4034e29be32d498c5ad789abe732735", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025870, "uuid": "720c0f2f-2975-4d8d-aaee-9e58febc3d00", "value": "T1C6739F32F4002CA1C96214B5F4ECEE740B136CE552D55C729DEECBA618B3AEEB548F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025870, "uuid": "f8f3ffcc-61ce-40fc-8187-58834c1a985e", "value": "768:G/Meu4y2iFcm52up7lU8Q+lgUWsuGOdHbvH58IrL9jUDXhNc5xDpnoe08h9dF2Ro:cMDSiFa+lgKOdHtkR+Vnor8XsPR/Udr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025870, "uuid": "d7a13f22-5da6-4ede-ad57-8bfb52fa62a7", "value": 74972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025870, "uuid": "d918fe67-6c29-4215-8fd6-fecb576cac02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025870, "uuid": "951636eb-69b1-4e7f-9ea0-5a044ed32839", "value": "hanoi.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bd2465-1370-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744003334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003334, "uuid": "966e22da-a18d-455c-8b30-f77406335f63", "comment": "Malware payload (Prometei)", "value": "9285743a312e46a6eaf54006f7dd2b43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003334, "uuid": "4a2b7335-0d82-489a-87a0-821c4411221a", "comment": "Malware payload (Prometei)", "value": "a55d6308654e042fc7c88e3a963bf557ad78534ff683676ce7398b735407a3de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003334, "uuid": "c003a710-d1a1-4e54-9244-615e78a8102d", "comment": "Malware payload (Prometei)", "value": "3ebf8e410808dcceac3c7f417b7b78de3ab91e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003334, "uuid": "acf9252e-d958-4108-8c1a-f021005eda6a", "comment": "Malware payload (Prometei)", "value": "a3bac95a5fa8cc2de39fb8b811b6010c0ee37000b507ebaff3ca02a75848d37db0f6c40c7ab6c70699dca731f849047c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003334, "uuid": "23570989-86c9-4730-92b1-6dfba3244707", "value": "T117155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003334, "uuid": "7413b757-44bb-43eb-a8af-8daa20abd589", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplh:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744003334, "uuid": "9cae07b0-f88c-40f1-a13e-a0554f1cb28c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744003334, "uuid": "94336ff8-9108-4bea-9304-5bed5f97479b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003334, "uuid": "0168a34a-38a4-4fd0-9af7-a1063515aa5c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a3a42c-13c5-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744040009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040009, "uuid": "810b26dd-8c32-4292-8884-4916420d1c22", "comment": "Malware payload (LummaStealer)", "value": "2c69266aaeb70c9476816e4259cf9830", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040009, "uuid": "c9800ef2-47eb-4285-8ecc-8309cb0b52ab", "comment": "Malware payload (LummaStealer)", "value": "a56367e247f8dbba5b9a4c5762d97752948469fb1f5656c32fd1d9a81458f135", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040009, "uuid": "b5b48167-5a4a-4293-9a5c-3f8c17c131e4", "comment": "Malware payload (LummaStealer)", "value": "31914b67125ff7a39b3e5b3251080157bd7ee107", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040009, "uuid": "78d77e8b-1e9e-43ff-b871-db38737762c7", "comment": "Malware payload (LummaStealer)", "value": "c7cd7f6e44507e1570f5fee14207051c322415981ffb18dca92e14754fcb782f7559155b78c968c8c305a605f16bf0ec", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040009, "uuid": "d6da660c-0b72-4426-9e0c-888902c21f69", "value": "T12715BF80E6B3D1B1D09118B0C56E67F68F3C6F3285299633BFE83F997F636602656244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040009, "uuid": "f95bc384-cdd1-4c6a-ab49-20cfc36d5309", "value": "4453ca20624a571cd75bdaaa05c63b99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040009, "uuid": "e51d5f28-5bc3-41e2-b6c8-5101b5471bbe", "value": "24576:h9H/1mt2hXLRas70Wu/aUZ0FSFUG8Vk8aw:8tu1THuyUZsNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040009, "uuid": "ac46a274-e02f-4e63-86a8-fc59b5d7031f", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040009, "uuid": "0b609b95-7f44-45a5-ab56-e72120767713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040009, "uuid": "113f7547-8c75-4a25-a32f-e3fbfa366b49", "value": "SetuP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcb6955-13bd-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744036559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036559, "uuid": "858efcf3-5a85-4eb3-ab29-e7126536c0aa", "comment": "Malware payload (Formbook)", "value": "942328b442158ee21105775108a465c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036559, "uuid": "d6dfe48f-b3f7-40a8-9164-d7a745866741", "comment": "Malware payload (Formbook)", "value": "a599b9d6384d9ac2dcd29dbc48b8ce56f9a2352fc9c2dfe77171cc6c29da1795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036559, "uuid": "102b46e6-766d-4b84-a09b-c0d998611bf9", "comment": "Malware payload (Formbook)", "value": "0e9c5a0156a612a8f2827fb1f7a7bb843579798b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036559, "uuid": "392a06fe-1e83-4af9-ac62-c543bc372b45", "comment": "Malware payload (Formbook)", "value": "fd0a878bbcf60c7f03f2445615dcb969f3b2395ab7aeb7a42be340eb992741f82c948af6c67afae86b06da2a2033f254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036559, "uuid": "a0b14ec6-c46e-46b4-b9da-dfcd8205cad1", "value": "T1FB45CF22B3DDC370CB669173BF69B7016EBB7C610630B85B2F980D7DA960161162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036559, "uuid": "185ff9fa-747a-48d5-b2d7-504b50f07e75", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036559, "uuid": "d4be53c5-6149-40bb-b7f1-6cdd74bc8155", "value": "24576:ju6J33O0c+JY5UZ+XC0kGso6FaTIkXRpdk9IPYzZfuGNlpWY:tu0c++OCvkGs9FaTIuRpdk9IPY1fnkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036559, "uuid": "fd0a77a1-fc05-4f1e-99c8-1adad571baee", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036559, "uuid": "39446f43-cd5e-4f68-a878-734e3d7e9dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036559, "uuid": "e18850c3-0b91-4550-8df0-9f06df0691bf", "value": "RFQ 6000066536 - PR 10023150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c650c07-13f0-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744058243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058243, "uuid": "d4f50701-a274-48f3-8d84-c23ad42fac98", "comment": "Malware payload", "value": "ce06383cbdd5d74fa7e3cb91eda64494", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058243, "uuid": "e78592f0-ac9b-4b4d-bf5e-908fa0980ba6", "comment": "Malware payload", "value": "a5b764d96b0585ec048584143f575e80bd346b0cff7d12812d249ba8aeb9b513", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058243, "uuid": "138ad9b6-2397-4b62-9974-5636aeb6bcf2", "comment": "Malware payload", "value": "3fedd6e9a599ff78654621139177f4df5bb13946", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058243, "uuid": "a962287d-435d-4f7c-a933-c380857789fe", "comment": "Malware payload", "value": "727a93a5cd72afb19059462eb2a4d80408c877ebfefbd13b7544683e3b0d74930b38fa041e849607f5a47b111f480228", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058243, "uuid": "7bc886d4-2b7b-4fe5-86e1-c73e0d621bee", "value": "T1C065B05C94F09CA12428FF74AB96F7C788E913962B2B0B420FD591963352843FEA7375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058243, "uuid": "27031d48-6d39-4c75-ab23-c3214e1b0f6d", "value": "12288:EVRfR/5vri2+qO8kLZQE44KPO5N7enhRioDdCOOdQXkK7M/3bGwPQLgnoSPu1jG8:wRDOTl6YAiU58jSMk16UO/J1Wm7jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058243, "uuid": "38070538-0882-4cb5-bf41-15eda178e2bd", "value": 1414760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058243, "uuid": "695c3313-a100-4f8b-a320-e4d5c4b27330", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058243, "uuid": "20bb358f-4761-471f-ab11-b0de2534bd7e", "value": "Client.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f715f7-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034342, "uuid": "f7eb6c56-6b14-4227-8373-f96c65ae10a5", "comment": "Malware payload (Formbook)", "value": "730e0513474bb29d1ed0e5809c7556c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034342, "uuid": "558c6f2f-fe19-42ae-96d0-fb1d3ad67527", "comment": "Malware payload (Formbook)", "value": "a60d2d2ef54b96cdb70f181fad669f17785601cc62b0c545ad6204262af9a05d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034342, "uuid": "449038af-a1b2-4728-8b36-699d93ba2bd6", "comment": "Malware payload (Formbook)", "value": "ad33eef9dd3557d02236bde6031d5e8e03e8107f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034342, "uuid": "0193335d-8fb4-43eb-9580-b8cd707b42d0", "comment": "Malware payload (Formbook)", "value": "e657c9e81bf8d1992d1bb8b112c623cae6f4ed95c80c9b1461cbe12f3715df0e97d5878e8a07e4ab12747a00adb25888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034342, "uuid": "7092dbce-7bfc-423a-9c18-8eae7ba0ee93", "value": "T16445AD13B3DDC36CCB668173BA7963206EAB7E670530B8573EC84D7DA960161162C6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034342, "uuid": "93021d5e-9329-4acd-b654-db3fabc61c3f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034342, "uuid": "ac7992ca-5b3e-4a38-b89b-1d912c9bccfd", "value": "24576:Du6J33O0c+JY5UZ+XC0kGso6Fa+3TVscOGkBIHuWY:Nu0c++OCvkGs9FaGBDOGkGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034342, "uuid": "769f09b4-4a33-4e2e-9247-0aa3811e133f", "value": 1241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034342, "uuid": "eb231468-d966-4fa5-9279-225a531d6542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034342, "uuid": "21265887-6d52-4f17-9c6f-171e1738fbb6", "value": "a60d2d2ef54b96cdb70f181fad669f17785601cc62b0c545ad6204262af9a05d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9018323a-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744017206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017206, "uuid": "33d1066e-af72-44f7-a275-cb59421124da", "comment": "Malware payload", "value": "ed027631f34210ee9334362a09270d7d", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017206, "uuid": "6d3f42c8-5287-4b43-afa2-70f8a3ba9e1b", "comment": "Malware payload", "value": "a62da0d5420e9391a8693a9217dd8d1a22cb42ef5d8887cbb2199a69b4d7ada2", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017206, "uuid": "1123acfe-37dc-44e0-8d0d-23b876111999", "comment": "Malware payload", "value": "ffb25c14fa29f14adec73ed8171fbdf2f02876c7", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017206, "uuid": "27c104a2-2ae0-48ab-b21d-f748d427a797", "comment": "Malware payload", "value": "2c8e8a4c7a83344cc394f264ba7c8d08081260b39f0a753d601ad6b37eda355f3afff61f6595b63f3a73907572d92f01", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017206, "uuid": "f734836e-59df-4449-844a-f8cfb0605486", "value": "T1DC3657A49EEE63C8B2AF40E9B6EDBEF0B57564D1204D8F44206ED040D6E1ED6DC815CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017206, "uuid": "88d0ac13-76fb-4d51-aeb1-b76eb63b1da7", "value": "1536:qsIY0QVxYCMBmei6lBrgCl3H/mvCEicMEi4M3UIj3mvTMEijmKtCP+XT1OwEi6up:qnx0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017206, "uuid": "8c9c27c3-f9c4-425d-8a45-283f5b20550f", "value": 5013165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017206, "uuid": "1ed49509-507f-4132-af10-9ddad22a8cf3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017206, "uuid": "1479b9af-7384-4af6-a4c6-c20d3af18832", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.32558.31581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fcf0dd-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034402, "uuid": "869d0ed2-39be-4e5d-b0a7-887fc1b9118e", "comment": "Malware payload (Formbook)", "value": "4bafd72271ca168c9c09559f8ae0de51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034402, "uuid": "ccd4eaab-f523-4d4f-b9ec-4bf1cf880b9c", "comment": "Malware payload (Formbook)", "value": "a6918f34f6ec6b61354a88f4275de492bf08ac570525b76e40c11ef377c85718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034402, "uuid": "015829fd-02b9-4f15-91f2-33c3883d3ad6", "comment": "Malware payload (Formbook)", "value": "12d4d5a6776f2b73cf2323631f3a6f444929603c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034402, "uuid": "a8aebf42-ea32-44bc-8bac-11a5d53eb13e", "comment": "Malware payload (Formbook)", "value": "34e2c8212fdfe93a27ab3deb8c1718acf3c38904235ceff57c9edd058175e6bc48283a5d928817b16408d651eaa1bfec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034402, "uuid": "6a075dbd-ddcc-48fe-ac7b-3f1be1a651db", "value": "T154F412121A9ADC13C0861FB81950D5F933F48EDEA510D7A36FEABEAFB5393412581393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034402, "uuid": "c7d14225-ffa6-4a79-a68a-c12e9e123147", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034402, "uuid": "7e09f12b-3a77-43df-b582-faecbcfde695", "value": "12288:bwxlloF9a5n4n/vRVr9wQD2iM8piKikqVR3cJ4yeRCrpPQTMhijTjLe:bwlmag/vRVRJif/yGK4JRCtPQT93e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034402, "uuid": "19e9bf44-0aa5-4241-b969-c2c2194685e4", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034402, "uuid": "6fec0674-2503-4f5e-9344-d954d8cafe47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034402, "uuid": "784cf6a8-82c4-46b1-a4db-4e8b6998ae30", "value": "a6918f34f6ec6b61354a88f4275de492bf08ac570525b76e40c11ef377c85718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff65ec3-1387-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744013152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744013152, "uuid": "3feb7b4f-da05-4444-a784-dc5861224be1", "comment": "Malware payload (AgentTesla)", "value": "5506571ee04143f0e0e64e2775a3a75c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744013152, "uuid": "3db1e6d8-2289-4724-a0f5-1d274fb5e01c", "comment": "Malware payload (AgentTesla)", "value": "a6abc8e699e17387c5ea157f59980f555d6affd4db7407cde362f9e8a5345eb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744013152, "uuid": "7a84af7f-801e-4479-9e2d-cdbe860919a0", "comment": "Malware payload (AgentTesla)", "value": "51f95a2038938f941bba1aece281205496685cb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744013152, "uuid": "a6e981f4-11a3-4601-a1a6-65456f538774", "comment": "Malware payload (AgentTesla)", "value": "8a6d5bda4eb4f17de55dd0ca9efd79165d0cc7aeaf7a846a1c64e37658da4393bae82a2e7084d6e67faecb73d46c58c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744013152, "uuid": "e6f86a26-97c1-41c1-a3ae-4b9f0b78a2a5", "value": "T102E402A43399E501C5A557B55C61D3B80B786FCD7822C3478FEEBCEBB8367463844292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744013152, "uuid": "79b706c7-32e3-4e50-8975-c66ae38d758c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744013152, "uuid": "8f875ca6-b737-4e1d-b59a-39ff08b87edd", "value": "12288:LYqBCCwfEyQnrKEHQcLXteP9+bH3DRbnhQqJKGj++vMFQpzyX42dfx5r:sfcPrnHQiX4P903DRbnhdJKU++v0Q8BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744013152, "uuid": "500fdbe6-9f6a-4c28-8628-e5241624b92a", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744013152, "uuid": "676bf993-9889-4e17-a0a2-69a8b428ca9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744013152, "uuid": "f3c2bbd5-74be-4ff9-86af-6a53dc303106", "value": "e-dekont-20250407-0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d0439e-1409-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744069070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069070, "uuid": "5d743a1c-b752-4248-86a3-784cb4dd27a2", "comment": "Malware payload (Prometei)", "value": "87d84c55d3bc92e7b3220863d029303b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069070, "uuid": "64c6dc52-94f3-44d3-a0d4-0651350c2a8e", "comment": "Malware payload (Prometei)", "value": "a6eac6c4ae276522ab395f8d326c6679029d460267cdd0aa29153da2bdfa055b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069070, "uuid": "429cf3c7-9251-4a89-a5f2-9abd43d34edb", "comment": "Malware payload (Prometei)", "value": "7509750909888a43855766c96fdfc113b07e32c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744069070, "uuid": "c3a48cda-a4d4-41ec-8d02-844cb4349811", "comment": "Malware payload (Prometei)", "value": "6ef381cc90e900f3eed1f9aa1d5a6efc3967014f32952ca1030c3b919731defa800d347038ae40703e121232a95fbe8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744069070, "uuid": "5911601f-0df4-4f77-9f3f-4bbef5b67e5c", "value": "T1A3155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744069070, "uuid": "730d0a9a-2169-420e-b231-a3730b05f328", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplV:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744069070, "uuid": "fa93bc4f-d2be-4972-9769-8bb3d7b407ec", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744069070, "uuid": "ebee569f-864d-479e-aacf-cc3e18265adf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744069070, "uuid": "1f28d72e-950f-4628-a765-f1f18da48903", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f4ee24-135f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743996140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996140, "uuid": "865559d0-1cd5-43c8-9850-9e47c672b50f", "comment": "Malware payload", "value": "495a33fb61c6b9609d3bfad2abccf7dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996140, "uuid": "39b6db7d-fd22-4ad4-8760-4a0e78da5761", "comment": "Malware payload", "value": "a79b2c939dd958b77833d4b6add702c4c9d149683f7153087b89595a1d5fd90e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996140, "uuid": "e04405df-9561-40bf-8fac-a9a6728412b4", "comment": "Malware payload", "value": "eb6e6bbd0de742400dce5bae3f70d97e9eb933e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996140, "uuid": "296f3a1f-8ebc-4f11-9382-b771dc325a80", "comment": "Malware payload", "value": "71f433b330aafb10505722e4fe73596e282673893e6b5896a62743c0404f259f93cd0999352c0001e46c3aa401fa8180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996140, "uuid": "3c23ca17-63ed-4651-8ef0-9f5b3f7a9437", "value": "T1A7A3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996140, "uuid": "1edd77af-861d-41fe-8f1d-9eb95b8e98c5", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kp6wDId:fma7JLqHxcncWZViTH6xVRFOR6wDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743996140, "uuid": "5a647c13-c5c2-4789-bdd6-832c82bd7794", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743996140, "uuid": "34599b73-3dcd-4d11-9a4c-8788ed347a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996140, "uuid": "7e8be291-849a-4f70-8832-42416891455d", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e35723-13f2-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744059281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059281, "uuid": "04c46588-e1fc-421f-b853-9340f22dcb2e", "comment": "Malware payload", "value": "c662628bbd338e5baaf58f3357ab23cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ionik Software Ltd", "colour": "#A0C8F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059281, "uuid": "3574e3d2-f50d-49a7-b98a-813bf236c233", "comment": "Malware payload", "value": "a7a33414390ae4b45f9d9f00d7b1dcc7519f7e109d7e181dcfdd2a197d040305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ionik Software Ltd", "colour": "#A0C8F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059281, "uuid": "50394c61-36c5-4723-aab9-183f9af7627d", "comment": "Malware payload", "value": "8868f3beeba44b877b91df4420a241abe7dd6fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ionik Software Ltd", "colour": "#A0C8F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059281, "uuid": "c5d6d0ca-1e4a-4a81-9a8f-2c0cf18f1d45", "comment": "Malware payload", "value": "d998d443d8929f48e6d0bc4d07e7b62868deb746235459e13283254ab6c73af882899c9214513041d2c078adbd2de6bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ionik Software Ltd", "colour": "#A0C8F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059281, "uuid": "64d8e765-6427-4003-9a1e-fe2be2ed16be", "value": "T1CD08972135FB904879B3BEA21FD8B5F54F5BF7766E9D6069108043068AE1980CFA17B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059281, "uuid": "8774f23d-e8c1-40bb-b386-fe75aa8eb9bd", "value": "fd5d9d1cbcf99ec36a28bc74087df1e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059281, "uuid": "6c40e723-bd48-45d8-a1dd-46e5cfd93d5e", "value": "49152:+awcz/1JCY3uMxFWsBuoaIlFPdh2kJpjevERR5SleuY1V9of4V00/85MJdyTPdQg:SMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744059281, "uuid": "3f49897f-65d2-412d-aaf7-889ff8527e81", "value": 77954096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744059281, "uuid": "17db06c7-21df-46e2-b35b-253bbfbfa2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059281, "uuid": "745d271f-9141-4a28-a9b1-a14e2580e5fc", "value": "avg-tuneup-crack-key.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4089c069-139a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744021367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021367, "uuid": "d40145dd-6d20-46e7-bca1-4e92ed8bda9f", "comment": "Malware payload (Mirai)", "value": "3a273ad226457ab96281236a2daf2e2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021367, "uuid": "48c4926a-09e9-4555-ad80-f55631b0f2e3", "comment": "Malware payload (Mirai)", "value": "a938e24f188baeb9c033ddb66ddfdc63851bdb89fd3981c3bdfb53ceba4cdeae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021367, "uuid": "31fe61a8-7f2f-4a31-823d-f8a637bccb5e", "comment": "Malware payload (Mirai)", "value": "41425c88d280b9136bc54c7c195b604bc229eac6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021367, "uuid": "d6870ccb-3a8b-4025-8bd1-6f054e35c96e", "comment": "Malware payload (Mirai)", "value": "8e331c11c48d417bdee454944e4fe45b243f3bed981a746b0a08e42b574d788fc1989af904b8b4429d0e0acc6895f663", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021367, "uuid": "59e1c987-933a-4457-acda-aba03ecf750e", "value": "T13013E16041143BA3CB34F3F6E2ED588ED9318651DB081D1B20F2DE9DEE9AB4371868E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021367, "uuid": "dba677b4-f0e4-4a20-a2f9-74585ad0ada9", "value": "768:7qIgwIRAHaIWRp5AmE+KyS2TIImyfF3ubkTv57yIbOoBhnuYW9a+rkOqF9C5nE8:7FIZ3hKyS2NubC57yI3BhzkDqryF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021367, "uuid": "89669ec0-8146-4c50-bb54-1a2e187ec7bc", "value": 42148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021367, "uuid": "35241969-82fc-48fd-96b2-90a5c2f442d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021367, "uuid": "b84ce367-44d0-4ed9-8da5-8e3168dff6ce", "value": "hanoi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475ee1e7-13bf-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744037270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037270, "uuid": "07429e12-f5b5-4e2f-8051-8162f5597ae5", "comment": "Malware payload (Prometei)", "value": "cca6b4b8d41fff203fc74d436bd4fa72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037270, "uuid": "d921160f-dc02-47a0-aa1f-4007d8d98d99", "comment": "Malware payload (Prometei)", "value": "a96c45e3c4ce9579bd2e535b063924d48d2bd7cfa26e839887ea518ccaf0f7b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037270, "uuid": "24b5fabe-89ab-49ab-a397-0192aa55c46d", "comment": "Malware payload (Prometei)", "value": "e9bf955687e68fb6f39522435e6a736aa7ff757b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037270, "uuid": "a296bc32-e226-4208-8354-41075f5ff6b1", "comment": "Malware payload (Prometei)", "value": "036a3a847d91f464d96e260a78edaf29caf28b365d93358744d44d22f55ffa87fb68eb976030e8a7d346867b4d5fc0df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037270, "uuid": "0dba014a-3d93-47d8-8205-2c9e8901b8d2", "value": "T16A9423F8C87D2E30D8169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037270, "uuid": "ca1a89b8-d830-4a57-8059-daeac36e3aac", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744037270, "uuid": "168ca198-eaa8-4bb2-8d51-1ca5f1b1212f", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744037270, "uuid": "b04e02c4-c696-4efa-80e2-ec725efef2c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037270, "uuid": "283ae8e3-c44e-4e79-b6cc-a9915017c17a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8d7b9f-13d2-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744045570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045570, "uuid": "f76e596f-853e-49c4-8f1f-7ea57395238a", "comment": "Malware payload (AgentTesla)", "value": "9fbfc05f6cd6e90001096eadefb8acc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045570, "uuid": "27c76f59-82e7-4e8f-9c7f-5f63b9c36070", "comment": "Malware payload (AgentTesla)", "value": "aa3bd4bbca4db2083492d91590381e4b2b43246eb6066831ab17eba48e05f963", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045570, "uuid": "290e5490-a5ab-4a9a-821d-de4eca9a532a", "comment": "Malware payload (AgentTesla)", "value": "1191ec050ef08d887b9e3c97e88b1a32678c5a47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045570, "uuid": "faf4436a-8c0d-42c3-9202-59bdc2891665", "comment": "Malware payload (AgentTesla)", "value": "3d6072fa36f00abfad61bae015b7103d0a7aeb44b7335e82fc18a918ce0d5bded4756a8015cbd0a953d72ab7cb889628", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045570, "uuid": "610fef82-9cfb-4a25-a192-99826599172b", "value": "T1A8E401A83356E801D4A14BB96970D3F8572C9ECDB821D7179FEDBCDBBC397462804292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045570, "uuid": "1b3e6755-037a-40a4-b7b0-a9329477a964", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045570, "uuid": "8967376d-9212-49a5-a257-4244d13a8a42", "value": "12288:2uYqBCCwfUNL8BXyfvqdb1jlOkSs9h85iuboAffhmKZAcIz1MK/uOi3o:2vf0wc6OkrhY3EMhmKZDIBMKW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744045570, "uuid": "94153e82-f296-4350-8792-bfe9a3b22846", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744045570, "uuid": "d37c0e5b-3547-4507-9c74-ba2c3cac3b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045570, "uuid": "329812e3-2cc9-4ab2-8aa9-c78653e6b626", "value": "SecuriteInfo.com.Trojan.PackedNET.3297.27006.268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502a5f26-13b1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744031272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031272, "uuid": "e2ff5eb4-9f02-42d1-818b-2fc778b6756c", "comment": "Malware payload", "value": "7d645a325450c8fcc35018f268f9ebf6", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031272, "uuid": "3ffcf003-5e89-4148-ac29-84a75097c339", "comment": "Malware payload", "value": "aa7cc2c43e56f1149e5e552106c4b2124fa3fdb3983413f5d2fe7408abd6dc59", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031272, "uuid": "cf80dd15-929c-4aa5-9e7c-a3d6463c6f01", "comment": "Malware payload", "value": "c2a4c58b581562e8a924e33cc52ac911da1f8f38", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031272, "uuid": "f1fbb4c3-f681-4e9f-b5fb-11c07a471be3", "comment": "Malware payload", "value": "cc1f062825bf79825bb3d5b7ee03806cc6c77d8bc0f7117cf5072c7f95e5b35d2a5fbb241f178967199b625e34643516", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031272, "uuid": "bf3a35b5-3be6-4d60-bdba-06df2dabec15", "value": "T175D02B37464A0B4FC1120C35D406DBA37A4D695894104E1F15A30AAC2D634A25CFB710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031272, "uuid": "48991f38-49ba-4e00-aeeb-39e308c4c257", "value": "6:5jg3MhTSu8jBKkdxF+k2F6Hoxn/Uxpdkkjjg3MqTS6mt+lMt/:5jg3MhTb8NKkzE0HZaaE3MqTlmtaM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031272, "uuid": "04cae550-9e75-40b1-b20b-129e13cdb59b", "value": 280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031272, "uuid": "be61324d-12d6-4107-895d-a1cac3d26cf1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031272, "uuid": "825b92c3-4dd8-4fe4-9b9f-85416b682076", "value": "ACHPaymentAdvice_Date_04-07-2025_Time_090456.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eabee88-1396-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744019592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019592, "uuid": "47ad6bf6-bb33-456f-8eba-a3c0ef9b794a", "comment": "Malware payload (Prometei)", "value": "fcd737e10975b8a6ddf3d47d10bb0af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019592, "uuid": "6addf2aa-1d6f-4d3b-86c8-de5c33f0fc3b", "comment": "Malware payload (Prometei)", "value": "aac77cf9a19e28469327e3e7d405b7125f0873b9bd20436a8a117e91f2f6f64f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019592, "uuid": "c6a1186f-091a-4384-a7ef-c5656c5e8f7f", "comment": "Malware payload (Prometei)", "value": "655529defb94d0259d608cfc38ccf326be7f0186", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019592, "uuid": "dae7c53a-ecba-4a69-8f37-0070832a26b4", "comment": "Malware payload (Prometei)", "value": "cd2b08a6bd4e8f01c203cdd3e40d4ab34d217c3b99389d1c4dd878c388fa5e6749f57765971ecdfcf578a3fd8f9ab5aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019592, "uuid": "678de201-2595-4947-ba52-61899c002149", "value": "T1EB9423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019592, "uuid": "f526c08f-820d-4258-a0c1-db445eacb30e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgJ:25WOSACZSV6eKRH5EPiamb4DsDwwcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744019592, "uuid": "1145f4c4-be66-4b6e-a9b5-c22238e379ae", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744019592, "uuid": "db9a223d-dfe8-4398-a93a-2878cebeb680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019592, "uuid": "3657e1c7-3908-472f-bba0-39ef42c18ede", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46533c6b-13e9-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744055307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744055307, "uuid": "e2a67970-6051-48c0-ad0a-74caa1eca2f0", "comment": "Malware payload (DarkCloud)", "value": "5785146f0db574a3617e45e4ebcc5e24", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744055307, "uuid": "03bf37f1-d2dd-4046-828c-5c83ed0d9cb1", "comment": "Malware payload (DarkCloud)", "value": "ab5578d7369cf805e6034e9536ffb84af9cc1865147d7371dcc47d818a606a58", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744055307, "uuid": "dda70d46-527c-4272-bb83-8ecf59976c6c", "comment": "Malware payload (DarkCloud)", "value": "ab66c5748b48d55028a6abd155509445a0ce250b", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744055307, "uuid": "117720ce-0dd4-4816-a7f0-2c32aebe364d", "comment": "Malware payload (DarkCloud)", "value": "38d26e4142e56c2d99076076a9d812587999f7e4fd503d8d8f66d0431122e306b62398e32a70b6d91d13b922b96d9c7e", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744055307, "uuid": "74ffe1e7-b257-40bb-b0e1-56b1376ea7bc", "value": "T13AE43333DF814AB3A75E9D33D96E90B1D0E8CD1253E4951A8CF95EEF2230849E4AC964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744055307, "uuid": "b787eb83-5bd9-4304-98db-a6a4191ce0b7", "value": "12288:oYX+RuuMjyR2ZQvFx1UBnuZKvdFQ5GiVz1R/D6O3PsX9KP1RykviH7JkupTXpPlK:nSuluR2y7eBuZKVQz1UwPA9UBa7lfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744055307, "uuid": "72697342-7ab0-4f9a-a7f5-426361278f59", "value": 713108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744055307, "uuid": "320fff3c-5a2e-42f5-87e0-7af78bb3a51d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744055307, "uuid": "6fe6f3dc-02d8-4418-9dfa-7ebf719b642f", "value": "EFT_Remittance_Copy_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4687645-1346-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1743985484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985484, "uuid": "54c42bf7-9596-42c7-b08d-01c39e8b487a", "comment": "Malware payload (Formbook)", "value": "806b668d3762f221294af7e827e6e52f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985484, "uuid": "34c58855-06ca-463b-b0a4-f30475a6bb8d", "comment": "Malware payload (Formbook)", "value": "ab7a449b8092a6f0469bf8713fac1aa4aee0957813341f6e84170a1fb46df339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985484, "uuid": "882310d0-aa21-46fb-be04-19b0b44f9b04", "comment": "Malware payload (Formbook)", "value": "ba5f2db7952f28c18304b267428cac15642acff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985484, "uuid": "8abc4b3f-aba5-4ac5-a83b-ce1f30ecb448", "comment": "Malware payload (Formbook)", "value": "fb050c77aaa6209c6ccea2c35fe2d8ba585cdcf437f2d85ef42a8486f44bb0cca08ea9b0efdfb2f5c4fb7490cde99d96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985484, "uuid": "57c59a17-5f71-495f-b894-fcafacda920c", "value": "T1B3542310A3217C0FC92DAC7002C70EC5BBC29EFB5E4A6651AB65F087ECB91B96507887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985484, "uuid": "f94e85e4-a7c6-4b99-a307-21ebfa7d024f", "value": "6144:lX2vr7riDFG1kaMAdJGuRzJDOo000I5NURMYHJt29nPr3QcaESZ:EvHGDoztdDT0zI5NSFqPT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743985484, "uuid": "b10cfca0-1e72-4075-b291-0ab85029b1cd", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743985484, "uuid": "341afd92-f221-45d3-a758-c157657ce04b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985484, "uuid": "edb8020d-1005-455a-8248-0487b2743823", "value": "Biomedica Order040725.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc3fb66-1399-11f0-ad17-42010a9c0004", "comment": "Malware payload (SliverFox)", "timestamp": 1744020963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020963, "uuid": "0b6ed5e2-3dea-46a2-8832-5c4abaff1409", "comment": "Malware payload (SliverFox)", "value": "e5efea3d0185e571cd74186e9269ea19", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020963, "uuid": "014173ba-4518-44af-8005-3187264f6010", "comment": "Malware payload (SliverFox)", "value": "ab7b1618c9d5cc048657df26d2efc43b821fc1bd1fd970382e795545628af99b", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020963, "uuid": "43770a61-ebb4-4b18-bc2e-edcc9ecccfba", "comment": "Malware payload (SliverFox)", "value": "c425b77e2bf1b429e49cbbb8189cec2a97ec6c0f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020963, "uuid": "9eca16dd-b95d-4bdf-b44e-172251505d42", "comment": "Malware payload (SliverFox)", "value": "1b4292a91e4f1e49c3b4167d1959070b34c8a0b221d3aa74346e7b4855580b1ddaa9b929e229b7fae9592f7f29bb40bf", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020963, "uuid": "c157e600-6b49-4c7f-970a-c710eca9d7c7", "value": "T116555D3E9036C423C841BBB528D31D7574673CAAA2CE0656F7ABBB4A4736270ED5C09D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020963, "uuid": "18ca4e56-a684-455e-8805-9bffdc624284", "value": "34d9b88f1718040709ed8f970a2443f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020963, "uuid": "72372f2f-134f-479f-8f3f-54e3ce8e7980", "value": "6144:Chdpg/92r36nl3r2I0k1hX0bOSMMIQnKBqBo6BBLa+vBktBpBQqwpfwgPgMK:ChU9Ael3r2I0gSHzBBLa+xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744020963, "uuid": "4df8cc44-9bcf-4cba-af42-3f22310281a8", "value": 1404928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744020963, "uuid": "8ce8254c-c2f5-4158-af59-1bfb4be9e057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020963, "uuid": "9c6a0758-8bb0-44b7-9dc8-ee35d702bab6", "value": "\u8f6f\u4ef6\u5305_1.0.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc7e07a-1347-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743985630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985630, "uuid": "546c2a9c-709c-47e3-9eee-4dce185d009e", "comment": "Malware payload (Mirai)", "value": "24517a77ec0985336045a21886c8e82a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985630, "uuid": "5c93a8d0-4b4a-4636-b7c8-cb3ffe7f9919", "comment": "Malware payload (Mirai)", "value": "abe28f2d8a0258e8fa7fc00d631f9d7b0090a1272ce431eedc89713cdf0a1977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985630, "uuid": "ba65460a-0793-44fb-a313-5f4b81f6b3a5", "comment": "Malware payload (Mirai)", "value": "81fa471b6b7772d5c9314a593788e14793be1d35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743985630, "uuid": "b5c25557-bf49-48eb-a920-5d56ca60592d", "comment": "Malware payload (Mirai)", "value": "0b1e06ce3533d4ee12681759a13e115abe4c678000e186b79792dc2a6a87dfdf408909ae18ca1dda3ba6c69ec2f6ddb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985630, "uuid": "2756c409-a015-48b9-966e-4f205f8af0c6", "value": "T1D53302B9CF204D16C9FF3A706021F6E112645D91A3D7CD42B442A611AF279983B2F8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985630, "uuid": "03294039-8a86-4ee4-8832-13f10e85d5a9", "value": "768:nmL7Dt+VAkKLgvoL19KBjwwVTM+ZvqMGLBr314YMO6GDXEHIkD4aA4uVcqgw09H:nADhZJ9K2wF1C1l04Xl7aA4u+qgw09H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743985630, "uuid": "f3ff14eb-5e04-4c45-821e-b10345406c11", "value": 53628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743985630, "uuid": "f37eddbe-8ad8-490c-8284-524c71df8c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743985630, "uuid": "da4939e2-1028-42ed-9eec-061c799bd237", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9136703b-13f1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744058869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058869, "uuid": "5ca8d8ca-5b97-4025-8e9f-68fcd9375242", "comment": "Malware payload (Prometei)", "value": "12a908cde405232a24941f97aece6b59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058869, "uuid": "87046706-92d4-42bd-b08c-43143fbc7caf", "comment": "Malware payload (Prometei)", "value": "ac82f492186fe1d84c400ee1e820253e13631e92a5166b78124af3482fdccb97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058869, "uuid": "263d0859-a8c5-4399-b8a7-dc0d39448965", "comment": "Malware payload (Prometei)", "value": "7ce74bbe854e44cabee02e78f7961b8e3970b4c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058869, "uuid": "f70750ae-450f-490e-9f81-94441dac1df6", "comment": "Malware payload (Prometei)", "value": "e6ad4f5267dd18e350ca1a1d9bd522c6074026a9e380214fa76de5d127990b27e670b49fc92df68ebaafbeb880a0ab2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058869, "uuid": "619b9547-bc79-47e2-b2fc-56749c29e91c", "value": "T1979423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058869, "uuid": "7798d38e-daba-47eb-8e53-9d4e050b8c6f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgd:25WOSACZSV6eKRH5EPiamb4DsDwwcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058869, "uuid": "fe017563-ed3e-4daa-956a-2aa2e119fda2", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058869, "uuid": "2c23a2fa-37db-4171-91cc-73d7b48c6380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058869, "uuid": "319ddf0c-85c2-4fd3-aa16-0a4a35f865b5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b75adf3-13d5-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1744046860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046860, "uuid": "40ea3b6e-8fb7-4521-b1f2-98bff4783eb8", "comment": "Malware payload (RemcosRAT)", "value": "8849e2039f215fdc3d18270bff047810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046860, "uuid": "bcc1c964-5a74-4526-b30f-87079a9e03fb", "comment": "Malware payload (RemcosRAT)", "value": "ad39a998b7f7b0889d74b2377b4ef09cb4827b314052e6280f2925bdc06ae248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046860, "uuid": "4d3a1599-5700-44a6-b867-70e51fd828d5", "comment": "Malware payload (RemcosRAT)", "value": "b5276ad1f216f5de3d2edccfa598a0eaf676821f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046860, "uuid": "a853f182-3666-42fa-8630-ae38f2c85968", "comment": "Malware payload (RemcosRAT)", "value": "8fe8408dfc047de4af68c7ad20921b81672b88eee2bf2860b6ccbda358e54996a598d1e38a6d17070a84977d861e82a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046860, "uuid": "5b07871a-e174-42c2-a187-6a2bfe073009", "value": "T1C905239ED945D927EA684335C5395DD58334B42AEA063BAE8215EA4E7C30343FC1BF2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046860, "uuid": "2a7e3f15-543e-4936-a982-e566e625332f", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046860, "uuid": "1c9e927d-0a0a-4dc5-a3bf-340e2b4030a1", "value": "24576:url6kD68JmlotQf4uvwKMXeDyEpyrX5WIYz8g3Q:Ml328U2yfxvwdgSrpkz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744046860, "uuid": "99876303-9961-4a6c-a2ef-7ceefd2523ed", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744046860, "uuid": "76995e22-2b13-4728-bf06-3678b7440c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046860, "uuid": "7632dba8-fd7d-41ad-b411-129c6dcc1d9b", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b55d33-13cd-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744043394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043394, "uuid": "4224a0d8-3717-4290-863b-3d292fbb8eed", "comment": "Malware payload", "value": "d52bfdc4fc73a7a8f0d759e9bf8d43fb", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043394, "uuid": "426f824e-5afe-45fd-8917-34ac69d360fb", "comment": "Malware payload", "value": "ae1ec40d3d397593a11495635b6632f0e28b623cbf6ba628c235aa1e37f33db7", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043394, "uuid": "63ffe91e-177d-4f85-bf0a-e6a9f06a76c8", "comment": "Malware payload", "value": "9479be38236cd3a2deb32aca349b1c5d856bb8bc", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043394, "uuid": "f2191277-b919-4f9c-9b35-3be7fd980713", "comment": "Malware payload", "value": "b4693372fff403f4149597e69eb8590d9a234dc80dddd6e46229f3857695739ee203040783c18ae2717081c10a5989f0", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043394, "uuid": "958adf9f-ffe0-48a5-85b3-9f6ef9ff2d60", "value": "T13ED095EBB6771159C281FB36304B3604864C58F1CC4D52CC7745F72C9A1929D1B14D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043394, "uuid": "2d889f94-fc4c-42f7-8e22-f5f27ae61500", "value": "6:5j04eWS/6DkVJYDmz7rPYMRsjcljb0Ruv04eWOD3t+lV:5j0vWMSg287rYrjA0RucvWe3taV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744043394, "uuid": "1e95ee79-a5ed-4e9c-8e37-76ccc64bdea4", "value": 289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744043394, "uuid": "5e0e3612-f3bb-4156-aa45-4206376e9d32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043394, "uuid": "0ef78387-8ad1-45d6-9d72-22837015cfe0", "value": "Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c361aeba-1373-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744004836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744004836, "uuid": "1c3171d1-00b8-428c-a490-20a702cdb458", "comment": "Malware payload (Prometei)", "value": "32427a9fbf867c9cb0849674e5783185", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744004836, "uuid": "51fcb6a6-752b-433c-93a9-84618ab064ed", "comment": "Malware payload (Prometei)", "value": "ae3d6da17d3ef72ec3bda58f416f1afcef00e09264843556b6a372cb742d01f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744004836, "uuid": "a623f138-1190-47e4-93a5-9b0a902578d8", "comment": "Malware payload (Prometei)", "value": "06b876b0bbb8a6742611aeed3bc01882db4c6f15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744004836, "uuid": "060be942-b65a-4005-bbbc-25e3dc7d8e2a", "comment": "Malware payload (Prometei)", "value": "5c9c9c5d94670e9b09bea341faac4a7170dc46f25e5160e2786600cb8d4846ed82801253bafbfab43fb99da0e8aac7a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744004836, "uuid": "3199b7c6-feeb-48e4-b0ad-1ac5627c5fb4", "value": "T15B155B653700FF5EF29DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744004836, "uuid": "bc73765a-d3d1-4a66-8e59-c952fa09912e", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpla:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744004836, "uuid": "681645e6-4e9e-476d-bcb2-d4d9afe4b4b7", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744004836, "uuid": "3c807485-1a86-4e4f-9151-c085fbf835ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744004836, "uuid": "cb40ef60-c1ea-48c2-b35b-374fa0f1ae80", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd8ec57-1360-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743996744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996744, "uuid": "c843a362-7f67-4332-b128-ef89b85e8ee3", "comment": "Malware payload (Mirai)", "value": "8e634b92b319b534cb6cb2085cd88f0e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996744, "uuid": "e1127073-6e70-48ff-829d-9b8387b5206d", "comment": "Malware payload (Mirai)", "value": "ae6428692adeaab08b358b337d563795a5f4ad5c130623398459aa4ad208f3dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996744, "uuid": "8de2dc4c-effa-4960-9a90-d25cbac90c74", "comment": "Malware payload (Mirai)", "value": "a1e3922222d018d5bdfb820b776a70129598747a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996744, "uuid": "69bd3fb0-9463-43d9-9827-6aef23f1e3cf", "comment": "Malware payload (Mirai)", "value": "8115610d018b86c554306195af0f0e628a7207cf00c9834c2f0f386626685cba6e940527f15a75fd12ae7d6c22932384", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996744, "uuid": "1882ec48-6c93-462d-a5db-b9859b0fee75", "value": "T1A90128CE1058CEB554414DEE3193591968CEC4CA1ACD8EC4609A08A9E4CCE0C7562E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996744, "uuid": "1e698b4b-9c2f-4b24-b09a-e6baecd2a832", "value": "12:3rWKIw+u5ZMoOF7+MB05whPO+hPNDNkpjNYhIyT+hIygDNkpjN8Tvn:yRk5zOt+MB0OhDhDkpxYhYh0kpx8jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743996744, "uuid": "6ce5f5c6-d985-4627-a212-2b834da7623b", "value": 700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743996744, "uuid": "beb80e5c-25c9-47f7-8308-7af69e8abb25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996744, "uuid": "a4193361-1267-4767-aa92-f918411b96aa", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937a744c-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049424, "uuid": "635ea829-505f-493c-b0fc-9f6365aa38a6", "comment": "Malware payload", "value": "737ef09d7ff462cb81037b593f8742d0", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049424, "uuid": "1b0432af-a4ad-48a5-8c06-f2a8d2bbe86d", "comment": "Malware payload", "value": "af0abe2c2a0a6089abbecf9cf57a89037b2ca1f074d8a36b1d454a457ce48b6d", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049424, "uuid": "6364def9-e229-45e3-901d-c87d41d18532", "comment": "Malware payload", "value": "fa8d21e8dea9543e502a2d7447d6d60282f7e4f1", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049424, "uuid": "d4eed7bd-9b41-4d2d-9810-3f2f175cc3ee", "comment": "Malware payload", "value": "d001284787ebe56f04acbac12a8af8c3c1c5378ce25c629b8447c5821c9a8a52adfe54ff0de387ac7bf980b89edcc33a", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049424, "uuid": "58c50dd0-2484-43d1-b3d6-6a927b4669ec", "value": "T1BB24D066F285C80AC649D3798CA3DE167662FE054DAF7707338D732D2DB66D48A02DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049424, "uuid": "4f6300cb-4d63-4a65-9a59-184c17a24e69", "value": "6144:56Z+RwPONXoRjDhIcp0fDlavx+W26nNV219LYxmcCZ6SYbKPrCLjvHCj6wMwKgTx:NCmWblqj6wMws1c3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049424, "uuid": "3dbf284d-8f29-4cad-8328-d2bc7748d97d", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049424, "uuid": "275adc46-4e5d-4416-963f-847b64da9a4e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049424, "uuid": "1b09cbff-716c-4a2a-bccc-47739380f0c1", "value": "af0abe2c2a0a6089abbecf9cf57a89037b2ca1f074d8a36b1d454a457ce48b6d.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d14572-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994635, "uuid": "b12b3592-5555-49ff-bd7f-a49725724aaa", "comment": "Malware payload (Mirai)", "value": "1343b3a37e9e898e69e82297c58d1ed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994635, "uuid": "439668fa-0852-4f82-a024-06a0933373e9", "comment": "Malware payload (Mirai)", "value": "af1d742886bbf0ae7ee161095df9dfc669edc56367be0a2aac3491e52e1e7bbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994635, "uuid": "fbe2ee5e-e6d4-4990-8a03-3dcabd778603", "comment": "Malware payload (Mirai)", "value": "b6308c0363281e8e6058299544231ed460771433", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994635, "uuid": "a9338bcd-f44e-4dc8-9662-90ae23a205c2", "comment": "Malware payload (Mirai)", "value": "9b64270027f19246cd7ae17afb258784699bffbb31145e895066682020e0422089e47a55beb5b668dec228bf5c79906a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994635, "uuid": "d04b642e-77b8-4274-83f6-bff75a223127", "value": "T16773A4492E224FFEF36CC6344BB74A20979923C623F1D681E29CD9181E643CD585F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994635, "uuid": "bc7d591e-bdb4-44ed-abd6-aa7668e19776", "value": "768:JmwY6UfpBTyt+g7pqzQeO0lB0PF+j3bU69Ksyfql2efR7nPvrJ1EiKdMBsByEz5V:HkOkg0c0sTdluPfWMs/ev4Yq0yOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994635, "uuid": "78409e83-65cf-4a2a-a535-99974de5cfd9", "value": 76428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994635, "uuid": "9b39f15c-446a-4d5f-9e26-f59f1028e1e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994635, "uuid": "ec2971da-1fb5-497a-9175-7c77324d1cd3", "value": "resgod.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf45636-13ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744043749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043749, "uuid": "4fbdfe1e-6145-4b91-afea-dd418af4206a", "comment": "Malware payload", "value": "db87d1c55021fd6f7a74c96f61cda44f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043749, "uuid": "c6638a1f-6c6b-4672-975f-f6cdc7f42a07", "comment": "Malware payload", "value": "af74047f7891c7e0dc918dd69f51c61fc085bb9c6ace4cb8a62f4da81929150e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043749, "uuid": "1f699a24-3abc-4ac0-bb7f-a9097a1ee2fe", "comment": "Malware payload", "value": "e3c133db68539319b8297963c8772adf48ad8936", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043749, "uuid": "a2dffb4d-5bda-432f-91b7-aeffcc37e94e", "comment": "Malware payload", "value": "f0e7b26bc21af957114379b55c77f5d2fff5117007ace224e7f8f3c89f5fb36275322d6dc7d36a06613301490c3864e7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043749, "uuid": "8b0e5fdd-de31-4618-ac21-3f37c15a2696", "value": "T168515C8DED6F874A07A67244E0C17309CFBC2E29061F0ABD814CE748987E44E4445977", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043749, "uuid": "160dbaa5-120b-4ec9-90f8-cade27b5ca85", "value": "48:Elhee0Qypod/zfls1P3sVOfuLQsK3vb12bYhd96RTxzOFQvG2EKZqXaWsQ:Elc3qd/aPIWsKz/ySavGJzjsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744043749, "uuid": "b57a42a6-e4af-4c6d-a958-0d2d9c03082e", "value": 2768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744043749, "uuid": "dc98289b-df93-405f-a00f-f2f42338a584", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043749, "uuid": "6929b468-c966-4d68-8713-e9e959840e6d", "value": "vcruntime210.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18227e98-13e7-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744054371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744054371, "uuid": "63aa8878-a6bc-441a-9c6c-f99156e56b80", "comment": "Malware payload (Prometei)", "value": "7a1cd1586302506ad46cffaa88b0d570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744054371, "uuid": "f8646590-96e5-4517-9329-26c1c76c39bb", "comment": "Malware payload (Prometei)", "value": "aff7242857e7caeabebafba56d119c3d204a4c36ba03c330841776de9dca2c87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744054371, "uuid": "3bb605f0-130f-4fde-8fa3-d2c2bc4f8a86", "comment": "Malware payload (Prometei)", "value": "800706742a7402b8605a3e30596c9cdc8fb0388d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744054371, "uuid": "3e75e742-f059-49ef-9307-514021eda32b", "comment": "Malware payload (Prometei)", "value": "79a4c74ea1267ccbb5677161ecd2790f955fc757ec7d3d2db207e01408764c5104eaab1e14189d68cad521fc10befe53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744054371, "uuid": "a0d0d857-8d2c-40fd-82c9-07955b0334c0", "value": "T1BE155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744054371, "uuid": "d58ddbb0-cb31-40d1-a760-6f32629a779b", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplY:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744054371, "uuid": "54a4b7ad-8722-4986-8d0f-d229afaa6048", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744054371, "uuid": "832aa76f-e0c0-4771-8af2-c156d370e4bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744054371, "uuid": "1657c82e-1ec8-444e-bd36-f90004884684", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893e6972-13a0-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1744024066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024066, "uuid": "89a29700-4834-41ae-b616-690e48093fbe", "comment": "Malware payload (AsyncRAT)", "value": "3ea16070eb41ae18964f0eff999378c9", "object_relation": "md5", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024066, "uuid": "a4dcd22c-1993-4a42-b273-a21dce39b16c", "comment": "Malware payload (AsyncRAT)", "value": "b0134672307237bfca72bba0990811cac2a4eee4b603d9b0253523aa14105a22", "object_relation": "sha256", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024066, "uuid": "19c94337-2ed2-4b02-982b-3ad84a75e42d", "comment": "Malware payload (AsyncRAT)", "value": "3cafb91881186eae712fb91410395d2369915d85", "object_relation": "sha1", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744024066, "uuid": "f9e079d1-e030-4b8e-9faa-8a20b85e0587", "comment": "Malware payload (AsyncRAT)", "value": "5ae11e51b0474d882a42353bc8d34f60aa7ee1041c9f9417dbb37d1dd6d78246b145e2e34295bad192f89487fa4ec7b8", "object_relation": "sha3-384", "Tag": [ { "name": "83-147-240-230", "colour": "#D1ACDB", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024066, "uuid": "516f5320-38a7-43aa-947f-9b446d325b8c", "value": "T11943C232B5027DF4663EED80A21418A4FC94355F43615E3DBA8788796FB55E0AEFC8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024066, "uuid": "21ec65cc-4a62-454f-92bf-525afc4c943f", "value": "1536:Flh2em4ZdOdZsMAN+iE5VhMxxOUYUHjHesIwW:rZzN+JhMxxOlxwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744024066, "uuid": "112a6d05-6309-467c-9bbc-2ce11b591a9b", "value": 59851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744024066, "uuid": "3586722b-2318-4681-9e01-bd395e734686", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744024066, "uuid": "4d19465e-4b71-44d9-9ffe-1e8fab03e0da", "value": "83.147.240.230 (12).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bc73d5-135f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743996141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996141, "uuid": "f7e89a55-977c-4e56-ade4-1ca1f560114c", "comment": "Malware payload (Prometei)", "value": "6422aafd6fcf66b799a62971c239596e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996141, "uuid": "a85c4c26-f489-4acd-816f-d40e6f77f949", "comment": "Malware payload (Prometei)", "value": "b0c2cdee70e447077abac94674f74abbea26151757751eb6f3e3709ee2297acd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996141, "uuid": "dcfed428-7791-42a6-b5f5-a807d4d1116e", "comment": "Malware payload (Prometei)", "value": "e7f3fcc9a9eca13735e35ebbc6cc993b3238b05b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996141, "uuid": "be6e15d2-68e0-4875-9f72-f48b7b8208a7", "comment": "Malware payload (Prometei)", "value": "edfff1cfd57f4cc0c1639f6727e85a8cccd5dbdcab2fce1ecb8c38e0cbb8dbf742c3945fdcef55e33c0297214b6e5fdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996141, "uuid": "a1e1f677-7895-41d5-9146-bf5eb0832e15", "value": "T159155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996141, "uuid": "d5304616-a656-4b39-aab8-318b9f4dbfa3", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplE:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743996141, "uuid": "378cf2e9-3d1f-42a8-bc1c-b7de1b72932d", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743996141, "uuid": "364daf22-81c4-48c9-8f3b-42b6133738bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996141, "uuid": "0e5b85e6-7a5b-4f44-a2c4-1ab14c951177", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c06010-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744017195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017195, "uuid": "1085acde-31a9-4ba6-895c-d50053ab94a5", "comment": "Malware payload (GuLoader)", "value": "06bc3b45280e8d35c07965368fcb2dce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017195, "uuid": "1325b61c-ed06-40ff-89d9-a640c9a3392e", "comment": "Malware payload (GuLoader)", "value": "b15f342aa8b5239d0d03ea74ca949f61749c3ee4e50e5bd1761169bfc0165dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017195, "uuid": "cec39f30-a2e7-4fbb-b180-fd43a941844e", "comment": "Malware payload (GuLoader)", "value": "50b639f139f5859540f10060a17b0a64c8243b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017195, "uuid": "ba66fcc4-00d4-4a3c-ac3e-06d51b6bb1cb", "comment": "Malware payload (GuLoader)", "value": "9e755b8da87675b1be0549645fe14abc6efa234a2fe1e1e71d34c627de7ac0562d46650f5ca47fe18ba650e877f5f8f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017195, "uuid": "54424293-1230-4ffd-accf-924e740dfc96", "value": "T15894BF91F24D98C7E51724F18C3FD9310157AAAC94B9920D25AE7B2A59E335320AFF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017195, "uuid": "67ae4e55-cd69-4e55-82fb-e75f982a00ac", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017195, "uuid": "943b808b-e49f-464b-8735-199699924d03", "value": "12288:JCf5fw7Qg+0cW1Od/a5GrJJZeFwQGmG1McHpkgo:JM5f0/cR9qFw+NcJkgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017195, "uuid": "accf0d30-2c52-4ba3-a27d-237badcb7e5b", "value": 434304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017195, "uuid": "63bb6281-a3a8-4780-8733-aab72e1139ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017195, "uuid": "9819ec2d-e596-4c26-86a8-b29a2b294c35", "value": "SecuriteInfo.com.Trojan.DownLoader48.18088.5056.10463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc104a-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744028342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028342, "uuid": "ec8d80eb-e156-4efd-9514-4a2610c6dfdd", "comment": "Malware payload", "value": "40aed1fea55dd9c98792e2da62ca7d49", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028342, "uuid": "c32f8fc7-4b1d-421b-a881-b79a49704251", "comment": "Malware payload", "value": "b1bba4494dfdfcc4a931665b3574e1f3e47bdc36ee0b7c629ea5dcbfd4d006e0", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028342, "uuid": "55de225c-a8d9-46ba-b36d-0ef5a5f86cf6", "comment": "Malware payload", "value": "0b6c906dd64636b3ff7c33f17cbf1f5fdd2ccc68", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028342, "uuid": "7b1f6211-b91d-443f-bad0-a5c687696459", "comment": "Malware payload", "value": "a936e8be5ea09b77a37e37d1cc2716d995e9682adac9c5f160132e118e7597479c7b6522b59e968c046e98255d260569", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028342, "uuid": "0e87cd81-f4b1-4b1c-ab19-f665b04560dd", "value": "T1E8C08C6B04A8820A6FA3962460E133A86F872204CD6606872B92BA2EA4065B6C75D496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028342, "uuid": "a7fee4c0-2df1-42a1-9f35-6ef961b77448", "value": "3:pF2u5LJJFIXMz1oM3KskARgUJrFFIA/tEGKRbqRfc5VYRWLY/n:pFLz8XI1R3Ksk01rFF9/235Kyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028342, "uuid": "e31dc27c-7117-4d3f-8def-bb1591a6c909", "value": 159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028342, "uuid": "f87c3370-a2bb-46d6-9872-3a9f550b28b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028342, "uuid": "3d4c1857-5823-4fdd-9fed-ac969228fcd1", "value": "b1bba4494dfdfcc4a931665b3574e1f3e47bdc36ee0b7c629ea5dcbfd4d006e0.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eda29ea-135b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743994333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994333, "uuid": "10261a4d-0c47-447c-8dca-e2225ebde492", "comment": "Malware payload (Prometei)", "value": "35a9e344362c9b93c097818e4166d411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994333, "uuid": "07dce811-544d-44c9-95f6-801a5c7b018f", "comment": "Malware payload (Prometei)", "value": "b1e667cb223fa4cb59d32d6c6dd4688985838af448f175cb6fbd596940ad49bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994333, "uuid": "6b27ba48-6086-4a31-b0d1-c0250a27cebc", "comment": "Malware payload (Prometei)", "value": "4b147536e8f95311e40f29dd3ed8da7690a963e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994333, "uuid": "ebb138e1-c99f-4712-ae7f-a46d46af23ac", "comment": "Malware payload (Prometei)", "value": "0913c410797c863f7571f607047c145480346896a51c418ca3aacc8d3d9f3d2a252f39254a6fb6b0309569e55c830518", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994333, "uuid": "708aab29-75af-453d-baf7-94d63f58ec21", "value": "T1BC155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994333, "uuid": "5427bfb3-0235-4854-8980-bb54870cca13", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplD:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994333, "uuid": "3a47f31c-3eaa-4ab8-8467-084fb822c485", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994333, "uuid": "91d563e4-d7f5-4037-9361-b57388b4ad61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994333, "uuid": "b52b0bb2-1eb2-4aa0-be97-b89787e26d78", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ac3c0e-13ac-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744029191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029191, "uuid": "6ce4004a-a0f6-43a6-84ac-953d1d7ba2ed", "comment": "Malware payload (Prometei)", "value": "b26178664f070059d258b320cef3ab42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029191, "uuid": "5c760833-5b1c-4404-a5da-43588ad11895", "comment": "Malware payload (Prometei)", "value": "b334f5cd2780482bfe3d3251f4b7ec812d4a9b49f415499344ae9e03f570be54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029191, "uuid": "4096c3db-33b7-416b-8146-0a83372af12f", "comment": "Malware payload (Prometei)", "value": "cddf0b63eb2b5cff7b01450b9eeb4f3e93365e6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029191, "uuid": "7f886802-f6c4-4013-acee-1ccb07024f5d", "comment": "Malware payload (Prometei)", "value": "722aaf5f80169d1088aeca7bbb8101f4a44e27f1fc0fd77b2810331e568595cf3cc5a141954522301634a0675e197b4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029191, "uuid": "f19b96ad-21d5-40ea-8ba7-320b5f97c327", "value": "T1689423F8C87D2E30D8169B3CBB1A8268F0A15772D9562F7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029191, "uuid": "620aa76b-0082-42e4-a9b1-9b960e4fb606", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgB:25WOSACZSV6eKRH5EPiamb4DsDwwcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744029191, "uuid": "b0e1ec0d-055c-4d80-b307-992e84acd4ae", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744029191, "uuid": "c45b431f-ec9c-43be-8113-4d69009a020c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029191, "uuid": "38693a99-de5d-4bd2-b4db-d5665d3343d9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e19996-13f5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744060675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060675, "uuid": "3e7f3de3-18fa-414f-bd0d-b6465824d6d0", "comment": "Malware payload (Prometei)", "value": "d7194fa3640ca0ac7ff80725a6b052a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060675, "uuid": "ce4750f8-32d0-4517-a33c-c196a12e54c5", "comment": "Malware payload (Prometei)", "value": "b349e11554b1b1f47d0b0c3878f91a9665c7a3d5a254d5f905de2eeeebd37ad5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060675, "uuid": "aa3f8901-d01a-4970-91ad-321b1200f61e", "comment": "Malware payload (Prometei)", "value": "a1ce11892e94b93eacb2637c46bd3f66f3dbdf47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060675, "uuid": "bc5700a5-f254-4965-9606-a492bcb32233", "comment": "Malware payload (Prometei)", "value": "60b8759ff032b2a4b769c0a56291992c8a0514fa2eb6afb35aa8b452a5c66605b7a3e6bbb1d90229b7764f1baea9fa04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060675, "uuid": "12c82f58-3873-44df-8f33-e1c7c37b789b", "value": "T199155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060675, "uuid": "27764d37-e48c-4ce9-9dd7-d21ee814e8c1", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplQ:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744060675, "uuid": "a1d462d1-6b36-4d7b-88d8-8b8d2924c0cc", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744060675, "uuid": "837840c8-86e1-4116-96e0-d3e063182f1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060675, "uuid": "543582e0-1646-4066-b3ec-5dbdebe93eeb", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209f7e22-1357-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743992537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992537, "uuid": "9fe2dba4-454c-4788-8134-33e1ee91c004", "comment": "Malware payload (Mirai)", "value": "68bc88c47601d12a3f7f61a6d415c893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992537, "uuid": "8fdd3a81-ec14-47cc-b6b9-d27015a96a88", "comment": "Malware payload (Mirai)", "value": "b376065ba7e7b0f8342fbdf4f097203e88e4aee7117fa4b2b5165f002342b90f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992537, "uuid": "8ed6ba85-c4b5-40d5-af98-1bf312752cd4", "comment": "Malware payload (Mirai)", "value": "dc6c818e4aed11aa72ed71e01c448b264f52f9cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743992537, "uuid": "2872b46a-c23f-4a6b-b1b8-562d6a984a6d", "comment": "Malware payload (Mirai)", "value": "23e35c167f084f6645afb018451d5d500a086062291b4710d4448f0cc31aac08aafd82518582d0afbf85116d6a87b020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992537, "uuid": "de48125f-749a-41b9-a4e6-44eb2becce2f", "value": "T1CAF329D7F900DEFAF80EE33688530909B230B7A255925A373257797BEC7E1940467E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992537, "uuid": "6f83d116-b54c-4d2a-90a8-bc040751d73b", "value": "3072:nMp15shp3WZaO6+uSzzRMW+X6qbFfwjV/jbiILy+nF7MoyO06O:GHsh1FSzzX26MfwdLh9yOLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743992537, "uuid": "9af5e199-9ebd-4c8b-8b90-cdea444b167e", "value": 159616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743992537, "uuid": "312d81dc-b917-4938-82f9-91fbdd25da20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743992537, "uuid": "ea17b578-953b-4bc4-a7e6-b04d031a926a", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d433ae8-135d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743995243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995243, "uuid": "ef5220b3-662d-47cf-ba91-32af1248bc1e", "comment": "Malware payload (Mirai)", "value": "63e939c5e2935dd96a1e85f45469b1ac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995243, "uuid": "b7a2d70b-83ef-45e4-b316-2eac233249a1", "comment": "Malware payload (Mirai)", "value": "b3af40324cdf4ba7fb7c50a6a4267915fca8179d4b3cf44fefcf2cc437768cf0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995243, "uuid": "b9e8a749-1621-4817-8e72-ff04614df7c7", "comment": "Malware payload (Mirai)", "value": "ddc24d4fff7c4ad81e04664cc0ab366c276f1002", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995243, "uuid": "cfc71c6c-8d8a-46ae-94c3-cdbdfbb81f52", "comment": "Malware payload (Mirai)", "value": "63f7c50a87ad680ac16b9aaebb7da5736cbc975dd2c92f00680ab3a6bb2e48bea7b9fc5ea65fc0b18cba0c3baf027e35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995243, "uuid": "f4ce0a20-4845-49b0-b244-105be3c6a4b6", "value": "T1622105CF0018CAB555418DED35838819648EC8DA2ACD8FCE54AE4DF9E4CDB0C3956F1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995243, "uuid": "278222e0-0803-4d44-bafe-2bb777658c22", "value": "24:yRk5zOt+MB0OhDhDkyYhnmhnmkyYhdhJkyYhYh0kyIhjZihokgYhBhNkgi6jn:4k5CEA0yFDkyAamkyATJkyAA0kyQjZu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743995243, "uuid": "80b77d7f-b00a-4f53-b567-fa5bda533575", "value": 1322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743995243, "uuid": "c1b18604-a0ba-43e1-8fa5-25034508daca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995243, "uuid": "9bad4745-f7d6-4bb2-9262-d0b213b08e11", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f5996d-13b2-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744031572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031572, "uuid": "7ea5dd96-22bb-470b-bfb5-5479dd14b14f", "comment": "Malware payload", "value": "1c951a5578afd1e6f8bbd474c81038b8", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031572, "uuid": "41ecb065-df78-4fab-8a40-3e0ce95b3cd2", "comment": "Malware payload", "value": "b4aaa820a412bb28238fe6098626f2db3d645baad89e2310c80398fbc25d443a", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031572, "uuid": "2150fafc-40dd-4cd4-b4a8-8da748cd461d", "comment": "Malware payload", "value": "18f6553b89c994c1fb8173f6d6286a06cc98b447", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031572, "uuid": "45651bd8-9ccd-4345-a9e3-f7d50d70bc14", "comment": "Malware payload", "value": "27c57706ea63c72e15b05beb58773155231f21a9250419e5e7b040d77b6ea0c5065e22ac58ab111194e0027824fe756b", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031572, "uuid": "3f0f8198-c87f-4adc-aee9-8c810d24a821", "value": "T15EB02BC1AB0084803801336A40284016F8C030068410FC9D53070D9E6101242030F03C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031572, "uuid": "fb5dc0e2-4c59-43db-b74c-666a876e5d12", "value": "3:lP/ErUpXXc0Em7NMHaRA/N3JL18P53yYk8YWQULXmEy:lP/ErUJHMHaRAF3JL2pyJ8YWByEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031572, "uuid": "9cc025f1-cc24-4b02-92a8-f0cd519a49ad", "value": 119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031572, "uuid": "8386dbfc-80ef-4dd9-bef3-5339d5bf4bbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031572, "uuid": "fbe63948-de7d-40d1-8476-2fde764bcc7e", "value": "una.wsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dc2e60-13aa-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744028374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028374, "uuid": "48230d8d-87f2-4eac-a486-d8e15da8d4dd", "comment": "Malware payload", "value": "b24d02ac52cc12ca488f48efbe30367e", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028374, "uuid": "0ada2de8-9a44-47c1-bef3-b8a394e8996d", "comment": "Malware payload", "value": "b5295abea9607f177ce143b6ae1df3798fcc0185c142d87d8fedbc1c0bdddac3", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028374, "uuid": "1f0035ce-3862-465c-804e-00da850b936f", "comment": "Malware payload", "value": "a08b730356af5e2cb354feb8037cbab44ffd4a08", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744028374, "uuid": "dfd7ca39-e076-4918-8de1-ec24ba754831", "comment": "Malware payload", "value": "a377fc530e576b0f65f74e5b93d85bb9770f15b9e5b5b6935ece6571795ebc53e330b950028573264efcf5f3b21d4928", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028374, "uuid": "ab5df27d-6d75-4c96-975b-e9f9a31dba2d", "value": "T18896021175DDC532EA6F06B29629EA2BA53D7DE20B7004EB53E4F9896B304C25335F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028374, "uuid": "be55f283-8a5f-405e-abe9-d20f9d2da1ab", "value": "196608:mdCYHeVtodlir7CrSCs/pd2XlM2x2CX98XJPCix:mdl+VtUa7CrSLae2gm8XJ6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744028374, "uuid": "0472986b-fbc4-4a7d-bb46-3186b6ffb650", "value": 9297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744028374, "uuid": "099c4dcf-0e05-4cec-8cd3-cee3a81740e3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744028374, "uuid": "1e15a9c6-bc2e-45d9-9c40-5fed8e737c2d", "value": "msi.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e11ac13-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744015296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015296, "uuid": "6cf3a8b2-f9fd-4fcc-bb2c-48be5e510bb2", "comment": "Malware payload (DarkCloud)", "value": "19fc2236ab4dcfafcf07745d613e308e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015296, "uuid": "5dd4c286-bee2-4b97-a25d-a416c78892c4", "comment": "Malware payload (DarkCloud)", "value": "b57eabc9a653f78c74b5c022a53e4bb9020b19c34879b7592940a50cdcd7c6b3", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015296, "uuid": "2c466364-9bcb-464a-accc-804c0dd62b43", "comment": "Malware payload (DarkCloud)", "value": "6ac9964dc8f0eb16b6d565a4af4be46884a164b5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015296, "uuid": "57b4712b-ae21-4aa6-8ade-631739737fe5", "comment": "Malware payload (DarkCloud)", "value": "16269b0e7abdce85625cde0c9a36e1c7b244fa490e08ce14a24988f51d2e1e11092e883334b387ea4613584912698ee6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015296, "uuid": "395af622-1389-4627-8375-c8298eb31dd5", "value": "T1FDB7BD0372E60195E8B7D2388AA75103D773B8635731DACF325D06152FBBAD4AA7B720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015296, "uuid": "5dd4509e-5cb0-47cb-b601-c22985f7cce0", "value": "66b10d8b5718b0fd6fb4865843d44280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015296, "uuid": "aed4a7ed-06a6-476d-81b3-dd2636fa4907", "value": "393216:y76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfYnVQx4urYsANulL7NX:y0LoCOn+2Ys4urYDNulLBiu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015296, "uuid": "239fbde7-b962-4d21-8477-6c0dd0c43602", "value": 49443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015296, "uuid": "51e56044-3ca6-4396-8362-af7340097793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015296, "uuid": "9065fc02-7b4d-42ba-98de-cc726a2ddced", "value": "Payment Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33909d0f-1407-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744068161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068161, "uuid": "3aac1224-4ee5-4f7b-a1e1-efb5e540e274", "comment": "Malware payload (Prometei)", "value": "57586145ce407f5bd9b9271a7bc65157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068161, "uuid": "15ca74c4-e548-4ce3-adf1-fd972266795b", "comment": "Malware payload (Prometei)", "value": "b5c0f2fe8b954b8c44ecd30c2720ac6d313d0b2c41a0ccafb27626ee82c236dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068161, "uuid": "5e27352a-75cc-47bd-aa13-d33319834ce6", "comment": "Malware payload (Prometei)", "value": "04afacfbf1cb47fa4fc30bb4490ebe6a09a55ef8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744068161, "uuid": "12a38c4a-b709-4cbb-88d2-d2f363a28efd", "comment": "Malware payload (Prometei)", "value": "a1f8342a1a53661e08effbb2e32700a668553971a0f647b033e93855a6845f0a940fd2ff227b146242810ffba9f97047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068161, "uuid": "aefd0b1e-c41a-4597-8db1-d6632409f6ac", "value": "T1E99423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068161, "uuid": "665aa05c-68ca-451d-8590-127bcdf48cff", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg+:25WOSACZSV6eKRH5EPiamb4DsDwwcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744068161, "uuid": "6f941a41-8326-4a3b-ba71-1f597106d355", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744068161, "uuid": "8030915a-deec-47d9-bbff-3e18feb9eb03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744068161, "uuid": "95bc6eb3-99fd-4ac9-ac42-63900757df54", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1ec461-1379-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744007322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007322, "uuid": "046dba60-cd16-44c9-9981-b66d7de2bfe6", "comment": "Malware payload", "value": "11f2ada11d8aa978f54131bff9c62ac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007322, "uuid": "7cb22cd2-1414-4e3b-8599-31090085e0b4", "comment": "Malware payload", "value": "b6ac9e1095b2f7bd5ede59d25bf074759af9bf529c4d7e83152c0fb3942166bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007322, "uuid": "29c97fcf-2f57-481f-9f54-e05a7e8b8f8e", "comment": "Malware payload", "value": "14cb531d61a49c3f1d947d394f30b2ec0143957c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007322, "uuid": "243996fa-5e18-46fa-98ea-2e2883c46a1f", "comment": "Malware payload", "value": "5c839adcd9036fada6bc11e9f507488c0837c2c43cb0e9419df297ec47c4d25c3c4b6c5b5e02a598b02e920df2c376af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007322, "uuid": "d53d7663-c837-4154-9a21-9c896ff1d84f", "value": "T1ACB733029B662F61D43CE6FE24390C866F75A5FCE453DB12E6707AA1D3C1035BE88B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007322, "uuid": "6cfeab64-627b-45a5-9211-d2b48bfff863", "value": "553ef6236c6cb4268814330cd1e93c7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007322, "uuid": "b82056cb-352c-410b-9f63-d3deb9855c7b", "value": "786432:Wabiuq+8DoW5+FcwbJcC1gkQLIgOvRPWwfidpaivCREbideAkAt3:9ii8EFc46L7OvRWXPf+Eb8eAvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744007322, "uuid": "a22f35fa-6edf-4842-a505-809d3f30299f", "value": 49217773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744007322, "uuid": "4beba944-6144-4c38-b06d-ad7e8bb83651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007322, "uuid": "d73eff1c-2ee1-413b-9563-abcbdef243a3", "value": "Win32.trojan.\u20af\u1eff\u04f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2866ea70-13df-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744050962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050962, "uuid": "899e511c-c564-4bea-8b1b-2747339448c2", "comment": "Malware payload", "value": "79615746124e8e66ce5d578fc7da30d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050962, "uuid": "9fdbcd98-a07a-4256-863f-34d560e301af", "comment": "Malware payload", "value": "b6d8191caf0fb0a1e1e93094a67444b426bf2591a9aac51192de8de5fdddc73a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050962, "uuid": "c8624807-62b0-4da6-a016-a993f25fe25a", "comment": "Malware payload", "value": "dd2b73e558fc20179fe4abc998ffcdab3551c705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050962, "uuid": "8f715e8c-1834-4195-a300-c6277d9d8e49", "comment": "Malware payload", "value": "d929cbb1fe6fbad97e55dffe440ba6ae41253936f3e3fd9d594cd8cacaf94966950714761c2d93fd97e9f0efa893c438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050962, "uuid": "29bdc3d6-75e3-4fd2-a28a-fdbae25f4f68", "value": "T1A49633874EF3A564C9EBF630A9BF3197583F7E126A72E6371310300B9A61B95053077A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050962, "uuid": "05aecd4a-ce49-4f8f-9d1b-1dd7adc11f42", "value": "4f1342a4b5f473a33cad1e0fbbb5c40c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050962, "uuid": "9cac9bba-2968-487e-91c7-41b74350483e", "value": "196608:riM+UXYhP1juZFOXyXm/jN55DsKwqGa4eg/3P8UWpVY1OdyBQ4F:dSzXyXoj/58qGajgNx1W4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050962, "uuid": "5993f5c5-37b5-46f2-a73f-698e656d0888", "value": 9255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050962, "uuid": "7f0988ab-d9d2-4947-b4b0-7e56b01ffe66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050962, "uuid": "d1fe2f05-c50f-467d-ac23-e7df751c2bc9", "value": "larBxd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee06f09c-13f5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744060742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060742, "uuid": "639d0f7d-507a-4b48-96ce-67232898b89b", "comment": "Malware payload", "value": "2980e9d93d12cdf494d44a07d9dbfc63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060742, "uuid": "6f9efe6e-5d2d-49ed-8ea5-61b67dfc5711", "comment": "Malware payload", "value": "b6f7ed639a60e1621c8ecb14ecd443ff96d297ff2c60598880b56d0f2caad783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060742, "uuid": "3898d66f-a5b1-4e8e-96c6-a97e6a6e9698", "comment": "Malware payload", "value": "8aa7d3109b293927c354dcc826a1f4152c6100ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060742, "uuid": "f935ad5e-f22d-439e-b457-5a6f3b683d44", "comment": "Malware payload", "value": "c6b968c56d928785529c2bb87a60f85b41cee33a286dc069d6c88872e429c62af89af4b2a5dca2f4f7e56d5ce1c65152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060742, "uuid": "b0f51615-df89-43a3-a0f1-e1bea1aa9669", "value": "T1D9C4914CFE91E805DE1E3D77CFEA15044B7161C12E2296463149AFFE8BA637268E217C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060742, "uuid": "d815becd-ac55-47ca-8430-c85db36285ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060742, "uuid": "b01c104b-b788-4051-9571-fe6b987e9d8f", "value": "6144:XSMCQ9IFRla6XHmAHMvEdFpe6VlWT8b9o++FdrE6UM7IkVfd1juJHbSsJTxPvF:CMwrFpPVle8YUZegH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744060742, "uuid": "d84630fd-51c0-4453-b8a7-fccc32ab985b", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744060742, "uuid": "d92a4218-94b1-4e11-9a1d-9dff48cf7366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060742, "uuid": "b84e521b-9a77-4a1a-8319-4f5b0bc9216b", "value": "Nixware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75998b7e-13ac-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744029187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029187, "uuid": "ab193365-4e5f-44f4-b00f-0ffd76fbc0b5", "comment": "Malware payload (Prometei)", "value": "733c98fd4fca91c5c7934eb52936a2a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029187, "uuid": "a6c83f0d-67e1-469c-b6fb-dcfeb9d7d815", "comment": "Malware payload (Prometei)", "value": "b83160d1605a09b30f8b591941fac274cbde574d66f4b4e1205388faa808a358", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029187, "uuid": "e9c6e299-79b9-418f-8536-1e754731416a", "comment": "Malware payload (Prometei)", "value": "1c89a91f2271553c2b0aadd01842db326448549d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029187, "uuid": "79e0f225-9837-4bca-91c9-77d49947df82", "comment": "Malware payload (Prometei)", "value": "b8683fc045d23d8d0f82bdce2223600577d54784613212829c205e4f1b7e25ba07fc43d8e2d9d9e7dbab538b0159639c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029187, "uuid": "69512de5-e1b5-47b6-aff7-24e57103d5de", "value": "T13F155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029187, "uuid": "37b5f758-ce1e-473f-a9ac-838723818a03", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplq:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744029187, "uuid": "023ada40-dd54-45b5-801c-b79f98be5cc2", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744029187, "uuid": "c218ddfb-005c-43c3-b6c9-47940ca3aaef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029187, "uuid": "8c5a3c15-2860-41d3-b550-66493045a218", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb42142c-13a4-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744025868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025868, "uuid": "848f217d-6220-49e5-9c04-ec1fc5caf70c", "comment": "Malware payload", "value": "f7baa62406b3c3265450fbc69b8f6c24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025868, "uuid": "a8a6ea83-85f7-45c7-8369-35f77f0a9086", "comment": "Malware payload", "value": "b8a7a2a5512a345d2c4ab7c020399a73a2630e9deaa617efe1dde2d0d21edeaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025868, "uuid": "e2f693a6-6c18-4883-a674-7189c3587bd6", "comment": "Malware payload", "value": "72a8b17fd76381b55250b482c70cee2bebe7c69d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025868, "uuid": "b2b0c05e-f47a-4ce4-a851-6c82efbd903d", "comment": "Malware payload", "value": "89d2d2ba3cb8a2c32254f4bc27cabe3f8326519fb73646369fcc0d6485005557bd827087ced09c333a06a80e6537b858", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025868, "uuid": "afe45b7a-dbbb-4a7f-ad7e-2acbb14bc61b", "value": "T11503F2E837A26D64CCCACE77113E86D7C8737F31D369D4D4A29B6A4232D838F4945660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025868, "uuid": "caac1b8d-6c1b-4300-a885-e631d02af367", "value": "768:cMo/6PmuPyVKkp8OhP7qbJkKbDUmb3DFLZmVXT7PImN:cM26P5KAJkKtFkj7Pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025868, "uuid": "84413e70-c105-4bf0-837f-78b932a5a0df", "value": 41348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025868, "uuid": "a1bcab75-3cb0-4d8c-bacc-49e5ed9a5f06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025868, "uuid": "c50b9a6a-616b-450c-88c0-9fa58482ad45", "value": "hanoi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f71893c-13b9-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744034599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034599, "uuid": "fba7de5a-ce07-408c-9fcb-4f171e0c4e95", "comment": "Malware payload (DarkCloud)", "value": "4f6aa901cbaa4668f661d9a9321e546a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034599, "uuid": "a1e8567c-0c4d-4e89-bee1-c9b7886f4c74", "comment": "Malware payload (DarkCloud)", "value": "b93f79fa5e06287399f002f51dd90ee65e422f5d0271a19ef5a6da0e6c25c33d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034599, "uuid": "a24837b1-eba1-4100-94fb-7e933b504a60", "comment": "Malware payload (DarkCloud)", "value": "0fca50aef20a5bdcc8952623f7fda7abe37893d3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034599, "uuid": "813aebc8-3e44-4847-b2ed-33cd370158ec", "comment": "Malware payload (DarkCloud)", "value": "ca423dc7432b3924afce80b556a179781c347065ad25f0896520901ecf281f303540d02d8b5f05696cf85938ec201645", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034599, "uuid": "0697da31-9b14-4547-a14a-3d72714df6b6", "value": "T1C2642A01ABF88226E6EE17F4E8B106144BB1F58BB67BDB0F5994A1FA0C037545D2137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034599, "uuid": "dd9b67a8-48ca-4be5-83c6-7269556e309e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034599, "uuid": "4c673e0a-95da-4287-975d-23ddd83c7579", "value": "6144:esZU/0mDvqA0FlouxidoGOLOSvLChOl6UAHJya:esZbmDR0Floo0OLTX6UAHJya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034599, "uuid": "d66a77d9-56e5-4448-a9b5-c684c4223f14", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034599, "uuid": "d60e64c8-8f66-4e24-b374-2516533d90c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034599, "uuid": "84357964-5861-48eb-b871-e262b309e128", "value": "b93f79fa5e06287399f002f51dd90ee65e422f5d0271a19ef5a6da0e6c25c33d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0228b650-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994634, "uuid": "646289a1-8394-446d-9dee-ca47db072569", "comment": "Malware payload (Mirai)", "value": "c84819c9047909407679d2ec6ed419b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994634, "uuid": "d627d451-7f2e-4545-87b9-7ceccd0602e1", "comment": "Malware payload (Mirai)", "value": "ba74b87c7456bead05c443d9ae620eb9f6c8bff7587341b286924d7351dcb00c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994634, "uuid": "0905734e-b504-49d1-a8ba-7a6e5c9a0a29", "comment": "Malware payload (Mirai)", "value": "abda42dae04c060bd015f8339b841bb4750a28e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994634, "uuid": "2f0d58fc-64fc-41e8-a3de-3b7c37e55d7a", "comment": "Malware payload (Mirai)", "value": "c953e7d4019a130c054dee9a13826bbddae4bc2167409a45fe0d66305e9bebb7d263a8db34b9aa6330ee2f00ed1afbe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994634, "uuid": "b87ba922-a211-4db7-92b1-2a832b5f8fd6", "value": "T1DC73D747AF614EFFDC2FEE3305A90705399C690713A83B752674D828B64E94B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994634, "uuid": "591d443c-8370-4127-ac33-1665851f7878", "value": "1536:Xply04o9dM3dMLlGbdMreYVtOmZ76/iggw8Fq04y:fl9e3OVreYamdhDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994634, "uuid": "1afba410-937a-4051-81bd-f407a1c332a5", "value": 76604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994634, "uuid": "76a82f94-1cc2-46a7-9c6d-b28b555850e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994634, "uuid": "d8f84342-9c28-49c0-a7f5-3d259b5762dc", "value": "resgod.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fa448f-1396-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744019893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019893, "uuid": "1db9dbcf-9d3b-4abf-ad1a-789330757983", "comment": "Malware payload (Prometei)", "value": "8f566d04d5de3aa657f9cc51813a9b2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019893, "uuid": "4c615254-9400-4f7d-b9cd-de3c69fe3daa", "comment": "Malware payload (Prometei)", "value": "ba7668b215f1af31d2535572e15a68912500a6003af1ec234ad18f4e30ec04a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019893, "uuid": "c792ca73-2a2b-4de5-8cdb-4da6206cc93a", "comment": "Malware payload (Prometei)", "value": "eaa477d9de59e819d7a97008b10348f868fac979", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744019893, "uuid": "69bcfe6c-2627-4d69-a472-2377d5be0ccb", "comment": "Malware payload (Prometei)", "value": "7ebfb8eed5af85c713f53937f689fdadf795ecf4ae6cb8c70865c0f65f0d1ff3cba0b5108a176f2676cbb8a7ce570efa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019893, "uuid": "5b8113f3-7dde-47a4-8f6f-044e310092cb", "value": "T127155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019893, "uuid": "6c3a8c90-9b2d-4116-bd51-d9e65201d108", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl7:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744019893, "uuid": "1323c3ce-dda2-46c3-aa3c-0bc6965eac01", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744019893, "uuid": "d5e29c7c-c33e-4c45-8d85-5e7ab96c8db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744019893, "uuid": "6c69fe94-c260-4427-a7e8-b7b1cb51cc4a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f52ede-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049394, "uuid": "13894fbc-6600-426c-be17-be9c6cece5b5", "comment": "Malware payload", "value": "f18d178ce6af498dbd70f22a316d87ed", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049394, "uuid": "26b97f92-3667-47f0-b783-9b84f4a2b26e", "comment": "Malware payload", "value": "bb45abcd7607426332bbefc5a17c551070b17bcf86a72dc9ceb57c20bcb05f6a", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049394, "uuid": "95be48c3-3e33-4a5a-b00e-22a71add1da7", "comment": "Malware payload", "value": "6eee586a7eb5b0b10bdbb0dd448fb3a543dab98a", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049394, "uuid": "e06acea8-7333-4bac-b0fc-ff949fd970b5", "comment": "Malware payload", "value": "26e72dd2c9501dec9d7ac4eb6a0840b96e7c50b1e275d138b204387fa0a84bf89bf3649c5e7991230b3652f7beef0214", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049394, "uuid": "e0d09956-5347-4e48-bb5f-db3f4b0c3ac0", "value": "T10EB41261F144A227C557C6B2C8D1CB5F4BB2BC141B5AE45B639873FC0435FACAB2B868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049394, "uuid": "60e7afe0-5500-4504-aa1c-dcd0be81e21e", "value": "12288:vshijFLuYNWwrJqWqoulSB/wKD+2upveGK7eLPHLGFLpB:vVjFLuaVqzouU8FeJeLPqFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049394, "uuid": "a5afa4de-5a93-4139-ac6d-025aa22d22c5", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049394, "uuid": "518e8613-7b93-45d0-9ce6-74d7f9a8e6e5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049394, "uuid": "c2af225b-b7e7-4640-b962-058dfddcb707", "value": "bb45abcd7607426332bbefc5a17c551070b17bcf86a72dc9ceb57c20bcb05f6a.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf772eb-13f6-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744060794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060794, "uuid": "c792b1da-b1ed-40bf-98f2-08155abb96f4", "comment": "Malware payload", "value": "c7baa688c8d7b3ee589730627613472b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060794, "uuid": "3b19f3ae-cef4-4656-84c9-5454c8bda834", "comment": "Malware payload", "value": "bd9ced5c8c7baa2e9b38c30ebcd405cd41306a35ce25111c35ba35b0178fecaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060794, "uuid": "8fccd485-b802-4ae6-b7e0-4c3335a1f5b8", "comment": "Malware payload", "value": "215d278af61f2d42ac0233bd0a850eb5d7b4f738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060794, "uuid": "b46fbe62-1b4a-4778-8459-06acf63c8c79", "comment": "Malware payload", "value": "52e100e189e16b91ef606f6eabe7222e18d24f607c9dbaafa237c288d2f0c5c8a35ddaefdbf1ea4096826924027c108e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060794, "uuid": "8f78855f-7f3e-4868-8140-c8768d1ea8ea", "value": "T16DD7BF22B3C8CA26F99E067281BBE655C37DA9150735EBCB1698FBD814723D149313E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060794, "uuid": "59b7c6cf-b80c-4310-899f-078a9fbca41a", "value": "f4680c52b4d4f6f1e0f92b81397ce8c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060794, "uuid": "99a42966-bf35-4984-80bf-096398d2b9cd", "value": "786432:O9T/j0BmAyv3+gc5ibDB28+oFwjvYKM289vy3TOZ34wWIN34w:O9T/jemAyvf28+u289l4u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744060794, "uuid": "3131f8f4-fb15-4259-9153-3d93de9abee6", "value": 62593528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744060794, "uuid": "32ce3c57-56e1-4562-82ca-cd0d92a3c609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060794, "uuid": "26cb0775-7d3d-4415-b685-ffc493c91935", "value": "predator.system by abamovvv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d3c9a1-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994638, "uuid": "0cbf13c7-2be9-4008-815d-f0976a15bf3d", "comment": "Malware payload (Mirai)", "value": "394c5626ea5f3ffc4f9dde31e9bcf3d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994638, "uuid": "2392d6d5-b3ed-4585-b1b9-129e585f3c9c", "comment": "Malware payload (Mirai)", "value": "be1718d915cb0a11f558dda64af2330e0a520af58dc61af31c60d8c58ac8f1a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994638, "uuid": "eb3ff002-219d-428a-8081-899d58cfbc7f", "comment": "Malware payload (Mirai)", "value": "e4454d4a97292fc59c14178c7b62e6b1f25c7be2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994638, "uuid": "9875b4d0-b435-42f2-b730-9dae763659a4", "comment": "Malware payload (Mirai)", "value": "93a3e8a28a153458e10e5a71d54b91bd0f24cb86a222a6ff76f6f80b4e62be49c9dde9a82202d54dd38076491b371a90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994638, "uuid": "572b2c1d-e7c1-44d9-9e7e-e3feedb0b07c", "value": "T1AA534CC5B4119E7DF9CBE6BE85220D0EB921721150931B27BB6FFC83BD731A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994638, "uuid": "88e38120-2f77-4073-840c-042625cf3ad2", "value": "1536:UPKRgsFRTbSX5R5LepSGIPsFXMhO52QUpeqEXy48s:pRwvWM8QxECa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994638, "uuid": "4c9cddc0-ec3d-44ae-ba10-00ccc38d4e25", "value": 66500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994638, "uuid": "cf2ac6f0-7b25-49b1-805d-12cb4948b1b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994638, "uuid": "e03aba30-de79-43f6-9fd3-e26f6134e7cf", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e95909-13a6-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744026767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026767, "uuid": "fcd855a5-0d9f-41f2-bb51-da894c97b713", "comment": "Malware payload (Mirai)", "value": "623ae3b4c816da17823f96822966ada0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026767, "uuid": "4dec1cdc-8b19-4456-a4b1-7a63abc8fc08", "comment": "Malware payload (Mirai)", "value": "be5390d50e62d6e79172a21626a01ac91f414be9d10f0814db3d360d72724933", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026767, "uuid": "10995fd8-1dce-4adb-9ed1-f801b5797030", "comment": "Malware payload (Mirai)", "value": "98952731a10bc316071303cd5d5711088763357e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026767, "uuid": "bba1ebbc-0fcd-45a5-a02f-96c48d623810", "comment": "Malware payload (Mirai)", "value": "25e0257aaa53b9c4e9e6b3608ae961f0b3378daab3182e4ed860cc235886f90f319df7789cc974977d593e71bd9a9e7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026767, "uuid": "947f6944-cff9-45d9-9a7c-428a529c75ad", "value": "T181F2E1183FE75DD0DA6115B8057C4E8E1FB5E01A3E78D1128514EB23B8EB2E16B8EA47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026767, "uuid": "81159f11-c3c7-4e96-89b5-44bd7435aa57", "value": "768:FWScZNDdzXE3pyqUIJnl14cMMVOBrjZXVAHFyIx:FWSc363we5LlqHZX6lyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026767, "uuid": "648ab167-746f-46e7-92bb-b5f301db52f1", "value": 36268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026767, "uuid": "b4037428-d4a8-4238-822a-eccf6a228458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026767, "uuid": "156432bd-e9e5-4e3b-9e3b-112e2ad36a76", "value": "hanoi.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086b7955-13d4-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744046184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046184, "uuid": "9d3355ca-ac4c-4dca-8ab5-fb4189715125", "comment": "Malware payload", "value": "c3195c28d4b4d5af009e930403db63c2", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046184, "uuid": "ee51535c-f961-440a-b3d6-db4335ca15c9", "comment": "Malware payload", "value": "be5a40b5622d21b46cbc87fd6c3f8ebcb536ec8480491a651c1625ee03ae2c6f", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046184, "uuid": "dee3e810-6642-4d98-9fb6-c230c6b3f11b", "comment": "Malware payload", "value": "18740d98b4c688f39013c3adc44fe1cdb606cc20", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046184, "uuid": "26a9f771-3e4e-4ef1-8671-73bf34dc6938", "comment": "Malware payload", "value": "e235bc0d10fccc5042bfe4fd17e650db61bab1d53b8fe890a09129a18a3a5b664be7ed5c111904c2f2f14b60d7738e0b", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "rustyquill-top", "colour": "#1F513D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046184, "uuid": "8c76c9ef-d8a8-45d6-bef2-7c59ef93906e", "value": "T160041276F51283E2F4103DF423F972A8E10662AD03FAAC889702B4756D6B20B95FD5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046184, "uuid": "165fb3c6-7e0d-4884-9651-f428895657d3", "value": "3072:ZmdJ44jXpKIOsKsiHjXYxU4UK3tAb9zA9vtzE1sc9mZB7jwWaDM41E3ZQ7v04mEJ:sThDUTYxU4hWbO9lzE1r0ZB7VMM4upQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744046184, "uuid": "dc65576d-a3d4-4aa1-a15b-7b4f7321ae2a", "value": 180738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744046184, "uuid": "cc07358c-c3fd-4e73-8a67-4a0b2e131d8e", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046184, "uuid": "5dcf599a-bb24-4745-b1f9-2517dbf22efa", "value": "aas.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0fa14c-135b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743994332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994332, "uuid": "e5069dee-e780-4412-a47e-b35c4add3c7d", "comment": "Malware payload (Prometei)", "value": "f5e19c9adccf44100ca1b9de0c08c105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994332, "uuid": "c4fa353b-3c8e-4b14-8f9a-a7e2ec2164c8", "comment": "Malware payload (Prometei)", "value": "be84cacfdc958755361d47a31c413b4c33bf39c0f0eec01e5d83b390c29a2ee1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994332, "uuid": "dce4d1d5-d464-4bee-8470-2966a651af67", "comment": "Malware payload (Prometei)", "value": "e78cdbe0b253cad5fdff29fbcd74d725b7f8b4e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994332, "uuid": "dc32a6c9-3f21-4d71-98b9-03fa06e1e413", "comment": "Malware payload (Prometei)", "value": "fc2818dcce3b137c41560e7b9de4a5ae5a16ad82d0532f6922241f2de885850eb22bae776810d4b97235428f1e2b9aa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994332, "uuid": "2ccc8d8d-1d5e-4b3c-ae98-0fc840147a98", "value": "T13F9423F8C83D2E30D8169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994332, "uuid": "f76449b4-ab01-442f-bd51-bef60065165c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgj:25WOSACZSV6eKRH5EPiamb4DsDwwcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994332, "uuid": "21fa25cc-f91a-4a19-b063-871f87b36dbf", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994332, "uuid": "e2416ef4-c0db-4c2a-8468-b993949feb70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994332, "uuid": "4e8a8156-4dde-4a1c-8438-043672d871a0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5573b923-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744038582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038582, "uuid": "9ed3f0df-16c5-41a2-b142-fbab5bd9939a", "comment": "Malware payload", "value": "33d5132d6c41b72b5faa7697a5e74e8e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038582, "uuid": "d669e22f-e291-4a08-9b29-34a75b02f643", "comment": "Malware payload", "value": "bedab2d20401c14dfd9e9f6f5a905c08a3c366c12f1f0ed246835a65080a3345", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038582, "uuid": "1360de10-23d1-48bf-8740-f04fec1f1445", "comment": "Malware payload", "value": "86322235a0386bfa7d7ba91ce7171e9fe1bee6d7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038582, "uuid": "3b6b397f-b74e-4405-ab41-431bd6ee2fbd", "comment": "Malware payload", "value": "02b62933c8387c6b94d2bbfacbd109995e629cc1c4efb9d4c50b34790e38a7b01c13e81e082776aa682b8e394d4ff854", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038582, "uuid": "6bea2c2b-4930-4276-a0d3-a913b3b41637", "value": "T1F9A620DB639C07FDA6988DDE820A354B62E2C1773D7F128DA4E1450BB42FE127625E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038582, "uuid": "ff634326-f2b2-49c0-9661-b1174f9db047", "value": "24576:ao6to6Ho6To6co61o6Lo6To6so64o6Po6zo6so6wo6ho6Bo6lo64o6so6oo6Vo6C:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038582, "uuid": "95e544bd-b8e3-4a1a-9211-d6a3570942f6", "value": 10261813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038582, "uuid": "e6837152-6374-41ac-a9c7-20f6928bf599", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038582, "uuid": "6effa6d7-4066-43eb-bb42-770a687cfb22", "value": "700815a50547b01b29cf3a1ca55d7a7e3058e7d911072018.html.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c598784-1405-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744067263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744067263, "uuid": "3ebcb61f-8425-45be-90a5-ef77cf7bb2b2", "comment": "Malware payload (Prometei)", "value": "31d7a345c973b4aaa1b3bfec7c7994fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744067263, "uuid": "c699a365-9b32-479b-9a14-b2125d44879c", "comment": "Malware payload (Prometei)", "value": "c05915d316efe2d39fa9712acfeb4fd16a1618ffe793ea1c2593836ca7cc3d11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744067263, "uuid": "eda40d7a-3097-4ef7-95d8-d72dda8237c2", "comment": "Malware payload (Prometei)", "value": "6001e3b2f4f63da2adece74892b5dc8f907f86eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744067263, "uuid": "523296f6-587f-4326-8bc8-5574526f2238", "comment": "Malware payload (Prometei)", "value": "fda24bec1bfe8f90cdedd5e633fa312ea3a3487a273b68fedd4b4681661d6c0dab0a8d828c9a2f7f2be8293cb0b892e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744067263, "uuid": "8ab47c9a-b419-43f8-a068-946afc19f5b6", "value": "T1029423F8C83D2E30D8169B3CBB5A826CF0E15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744067263, "uuid": "47eb980b-edb0-44fc-baec-16ffbe99dee6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgW:25WOSACZSV6eKRH5EPiamb4DsDwwcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744067263, "uuid": "6c3b8290-8eb0-4df1-8996-a575c9635319", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744067263, "uuid": "c2ba81fd-d98c-4aa2-9296-7eeef0d20de7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744067263, "uuid": "a86539f4-f28f-4fe3-9f41-61abaa5cd28b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc3b22c-134e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743988932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988932, "uuid": "1181931b-8c81-497b-a4b4-0eb7c36197f7", "comment": "Malware payload (Prometei)", "value": "6f206fbcf70c42cdc5919eca0d7fea37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988932, "uuid": "4668cafa-452a-499b-aba9-a847fe18e109", "comment": "Malware payload (Prometei)", "value": "c1ddb2e52c9a28e8dc8dd999a47017002f291750c37c3fc4b9fc3b4c52302d99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988932, "uuid": "7cac269f-31cf-4930-ba69-54b4ce1bda40", "comment": "Malware payload (Prometei)", "value": "6816654f290b4f33b34de5dc54887d49e070627f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988932, "uuid": "f34ef86e-de16-4642-add5-1c7f0bd76357", "comment": "Malware payload (Prometei)", "value": "32b69c6fe35235613cdcbc7726f0e93e8c82e9d74c3dfc1387a74089169ac037f54b1bd23f0e83cbf561a945ee883f89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988932, "uuid": "91f6cdf1-b825-4380-8e7d-2a9368aeacb0", "value": "T12F9423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988932, "uuid": "e756491f-b95c-4763-916c-d6c03c569120", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgv:25WOSACZSV6eKRH5EPiamb4DsDwwc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743988932, "uuid": "bdf6d7a6-3f41-4c44-a0c1-09ca6ede653d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743988932, "uuid": "b0416058-d2b9-4d08-aa25-88766374a1b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988932, "uuid": "56923c2d-2aaf-48ba-9542-b23581ee7992", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97c0524-138b-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744015208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015208, "uuid": "fd63c7a1-d63d-4cf4-b21b-1cda9d5801d0", "comment": "Malware payload", "value": "9f6c82c240ba5ef6bb85d28c0cdf7f7f", "object_relation": "md5", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015208, "uuid": "3cd00a87-a0b2-4dae-813d-d64e69b1915e", "comment": "Malware payload", "value": "c27cf714293c496c8fc05b330a57bcfcb6189267e2818062660de88b0f3a25cd", "object_relation": "sha256", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015208, "uuid": "cd38e467-e1c6-4dec-a414-051d9915e67b", "comment": "Malware payload", "value": "ccf59b2d59d975bc4fa68926b17debe88272a341", "object_relation": "sha1", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015208, "uuid": "300db337-5f79-4fac-a583-07ea913fe5c4", "comment": "Malware payload", "value": "f2613934a25c6db72b52aec6633b2218c663254a74a9d1c3290be851b3801f07800f080f2d69d8f978915116af2914ed", "object_relation": "sha3-384", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015208, "uuid": "bfd58034-be03-49a9-af80-ed58bb644ec3", "value": "T11AD4233644DDDB48CE8089F00C7A4E65CB55B7C9B878929251DAF69683E3F81F31F1A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015208, "uuid": "d0b141b1-0f43-4307-906a-ed84d0ef4f02", "value": "12288:MiCFkYRe/D5KrYi8HTVPit2yWNcYSC1lDkVF0IqpPuFmHYPoM9g:MimkxL5KMnyWNcjCvkVaIqpPumYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015208, "uuid": "dac0074e-8131-4aa3-b6de-76410d7d1427", "value": 609421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015208, "uuid": "7e4ea8fe-b751-46b2-a312-691aaff05ca3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015208, "uuid": "e60d69fe-8639-4fb5-96e6-f533588d67ab", "value": "9f6c82c240ba5ef6bb85d28c0cdf7f7f.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61367c1-13bd-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744036677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036677, "uuid": "8489aeff-fe81-419c-91a0-c1a4a0bd74ba", "comment": "Malware payload (Prometei)", "value": "422641a3935ec6df5e492fd31c2ef428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036677, "uuid": "92d08964-5f1b-41b2-a782-eaf7a8f3abc1", "comment": "Malware payload (Prometei)", "value": "c32b7f2b20477cbc2293395402f2553ab3b65c1855a73d2c2581e8eb5f51b6d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036677, "uuid": "72fd7f03-2647-4d1e-adf1-254e6df67c68", "comment": "Malware payload (Prometei)", "value": "adcaee11e0aeb0864686a55afd247fb5d1b9a895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036677, "uuid": "b8027fa0-9a39-4b5c-89a3-bfbc9ea1e1d5", "comment": "Malware payload (Prometei)", "value": "1ecb1d1882154eeb4f6a5d0302a166edc2ae79a6f418ffba4e21808ac136ad187a1eec49049425d8993eae24a2f23453", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036677, "uuid": "2cf72efa-ea41-4d72-9d97-4dd2b3e09b8d", "value": "T17C9423F8C83D2E3098169B3CBB5A826CF0A15772D9562B7EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036677, "uuid": "95dcc7c9-5ade-4162-aba5-8136ba0f4f6d", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgw:25WOSACZSV6eKRH5EPiamb4DsDwwcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036677, "uuid": "47934cbc-b352-4c2c-b971-18a8480914f0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036677, "uuid": "42a2b402-e829-4dee-a45f-e58554666fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036677, "uuid": "14c4daf7-f85d-4e39-b576-df85b20c335e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb078f33-134e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743988931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988931, "uuid": "2daaf939-44a8-4a1b-9a7c-2f83b65cded2", "comment": "Malware payload (Prometei)", "value": "e6f9a61cfeb7300c16b2fdabd92c1ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988931, "uuid": "10108ee7-d29c-47d0-98e4-c40f3a86cb92", "comment": "Malware payload (Prometei)", "value": "c33f23c09216590470272eaccc838388aaf265459f307c57d63476bf0e3f2259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988931, "uuid": "ec27ec2d-83b1-4e08-8290-4bd037a0b5a5", "comment": "Malware payload (Prometei)", "value": "1cf7570922e516abe5c70d55f1e93635ea18a3d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743988931, "uuid": "f9297ee8-281e-48d6-8861-5c840191b983", "comment": "Malware payload (Prometei)", "value": "f1038b29d3639b85fcadb62b590509a7e40119dcda3b7add9f1419993e17bb1a6c7b42b827a5a137213bf1a9b377cf03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988931, "uuid": "581e2dff-8e1b-49f2-b5ce-f1db14bda1fe", "value": "T143155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988931, "uuid": "eede5c53-a862-44fe-ae42-eee3cbea20e1", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl1:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743988931, "uuid": "3b7fee0c-1c43-41c8-a0fa-6286bf949531", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743988931, "uuid": "5cc3d901-3b9e-4070-915d-9d1165970373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743988931, "uuid": "a667ca23-9056-45ee-aa6e-2634fdf22d18", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc98502-13b2-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744031775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031775, "uuid": "26921609-77ea-44f6-a20c-ced2094933d3", "comment": "Malware payload (SnakeKeylogger)", "value": "76e55727d8fdefb81d97b238cea8470b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031775, "uuid": "94cb694a-bb26-4373-a038-b9d57ab27f67", "comment": "Malware payload (SnakeKeylogger)", "value": "c399085c97a8ba0e2a383491d93849ef743e4ef5dcf0baeeaeefb6c9ce9894e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031775, "uuid": "bff5b17a-f803-49d0-b2a5-ddc1a8851f7a", "comment": "Malware payload (SnakeKeylogger)", "value": "b3d6cb37d7fe9112df848ae437517db386ca916d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031775, "uuid": "7b3bb639-e420-4389-80dd-c71b27c5a6f3", "comment": "Malware payload (SnakeKeylogger)", "value": "65c8332dc6ef0b9b04ebce34b91fd42e5fe02fa6dca63ad4dc8a0f2ada7efccd8eae1df12462065f9d3820443b79d174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031775, "uuid": "a02db675-41b2-4182-a2ca-f5dbb943fac7", "value": "T1D305F094336CDD13C5B643F45420D2740376AD9E6521E3CAAEEABCDB78E2F441A10BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031775, "uuid": "82e14706-add5-44f4-9cea-f1b374da1935", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031775, "uuid": "7429b3f5-158a-495c-b634-3ca2eb493d48", "value": "24576:2ftMD7DxfNm2nDpVLHRwBE4zhE7rVlS+np:QMDjnLHRwBTzI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031775, "uuid": "aeefaac9-539b-4a86-97f0-fe1ff8444490", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031775, "uuid": "37bcb2bb-dc3a-49f5-8631-d31ee1c831fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031775, "uuid": "e66d1ebd-cb72-4a68-b305-9acb1da86d76", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a03673c-1385-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744012391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012391, "uuid": "b76225d5-59a4-46bf-ad56-7ade808759e9", "comment": "Malware payload (Mirai)", "value": "18b068c948eabaa2cf0c54cc75024ea2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012391, "uuid": "1e7447b5-91e9-4d96-80a7-7de437895f64", "comment": "Malware payload (Mirai)", "value": "c3ca47292862dd8760281ca0149f47cbb65c71336c5b1ff5e07b3a776f7ee519", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012391, "uuid": "d948b85a-becc-4cba-bdb4-90c5cde0e9d0", "comment": "Malware payload (Mirai)", "value": "8340cf43e3d28fb01f44f19636ffb32094e0954a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012391, "uuid": "59e8c021-fedd-4bec-b44c-938d866520f4", "comment": "Malware payload (Mirai)", "value": "8c2b3bb93bf0daea3a6f0199d5031471f52e50a781946cf072e03f19c1fd40873a6a1adcddd3137667f3b25f4125b859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012391, "uuid": "3cab93e6-6cc5-4619-b494-ff088138bc81", "value": "T16DD35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012391, "uuid": "2b015174-db7c-4b2e-9337-1618f09964fc", "value": "3072:79eSuygEPjt6qkWGVdKmDnYMb0gBd/gQyVGsdqml6gaj:79eSuygEPjt6qkWGGeH2laga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012391, "uuid": "9aa9e2ca-b617-4d35-8757-b3b3a7aca839", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012391, "uuid": "87b1a573-59c6-4588-95d2-a03c2def147c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012391, "uuid": "41d3aa97-b794-4787-8bfe-e2133b2f6735", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877a586c-137e-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744009460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009460, "uuid": "349fafb3-a3fe-4af6-b5cf-d5a42065c286", "comment": "Malware payload (SnakeKeylogger)", "value": "89206d924107e2c80e72e6ce0b03b395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009460, "uuid": "94fb1652-e435-46b3-9cd7-6c51a612d599", "comment": "Malware payload (SnakeKeylogger)", "value": "c4743a2d5dca0dc94b30dc2fea44e042428173a6d41b3e904680d037ca8bc58b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009460, "uuid": "65f8207a-04cf-4a74-9170-70f7dc4d669a", "comment": "Malware payload (SnakeKeylogger)", "value": "ab3e1fedaf17b2a678385e03d7d4f948ce82d1f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009460, "uuid": "6fc295a9-2a98-4434-be48-cb91c80d6f36", "comment": "Malware payload (SnakeKeylogger)", "value": "2357dec7cace9fc2da1cffb3258ee8eebcebd42bc3f0fa9b6e905eefa4a3670029f13c10cc5deca953fcfe3e8d90894d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009460, "uuid": "f0ffc2da-8b5f-463f-9d05-bac2bb18e74f", "value": "T14FF402A523A9E911C5A24BF55C71D3F80B6C9E8CB520D3478FFEECEB7836B512441292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009460, "uuid": "e537ae02-8a9c-4fbf-9c6c-55dd5385d505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009460, "uuid": "a1655421-0310-49ab-8286-4fbced50d3d9", "value": "12288:XLYqBCCwfeq0Vi009eYTKDii1/hl0jJnhgdMxL/ISX5ufnOorahWA9KWi+Um73h3:cfWzVi1eYTKJeydSLwSX5sOmcbQm73z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744009460, "uuid": "46437f8f-6099-4ef4-820c-094146afadb9", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744009460, "uuid": "db6af16c-2aef-4485-b94e-b6d00ffdacac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009460, "uuid": "9010da81-a0e3-4d4f-9c9e-1fc35d23e466", "value": "NO SNKO05B250300091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdd0ffc-139d-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744022567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022567, "uuid": "23c64c11-bebf-4388-8a9a-0f0bb789f38c", "comment": "Malware payload", "value": "d6f1612c0850afbb92989c07958859bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022567, "uuid": "82bc41b9-acfa-40b1-94da-6f2483369d57", "comment": "Malware payload", "value": "c560234af800d7d70cc617269607f71195ae458cec59041e4711add4eaf28001", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022567, "uuid": "ccefb3e1-c687-4271-b1a2-6765b7af7b36", "comment": "Malware payload", "value": "89c87b8c12328d60de023808f31b57e6be6a8395", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022567, "uuid": "bd0e30d8-2e7e-4a6b-807a-e9cd25469d1e", "comment": "Malware payload", "value": "1a5a212c15a0e881fc30fae2e6d4a479d2911a357b6e7f3dc7b0633bd186fc0cad32ae3742c1e1b277734625b69b3b62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022567, "uuid": "839f44a4-ce89-4091-98f7-d53f5b5dd813", "value": "T1FB0302A32703DE30CB5D7FF8686DAD760A9041B7A19196F20C2A3D7D34D41532665DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022567, "uuid": "6c562d0d-4f5d-4674-ad67-4d2d8bab7189", "value": "768:r+Tn6jnKHh3PlCU1NpOyLb7b3k2oEZkQB3OyViPyj5bbzQGj9Rowbr0iDz2PpAO:KT6+ZPlCU1NBLb7b3k2oiVBejqjFDoiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022567, "uuid": "0e8f19cd-8493-4104-9a01-8a12de5c1028", "value": 41236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022567, "uuid": "e9b7e599-6062-40dc-b117-55db6bd74ca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022567, "uuid": "2a5fb09f-1e2b-41b3-860f-0a6fd11e39c2", "value": "hanoi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab9c74e-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744017197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017197, "uuid": "a8bee5a2-a177-4f3a-9bd1-557fcb53caea", "comment": "Malware payload (GuLoader)", "value": "576830f5344b4796be50de962c0e53bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017197, "uuid": "edc7450b-999b-473d-a073-9612b23c2589", "comment": "Malware payload (GuLoader)", "value": "c56211be456f15a955c58990ec47172e107b8571d83d4ff7e9fefe9afb81b761", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017197, "uuid": "5ddd3240-7fb1-4834-825c-10136b2da2a5", "comment": "Malware payload (GuLoader)", "value": "67c33e4bf37c581af4f1a5a5cda22e465b233851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017197, "uuid": "6ac94c6a-c0cb-485a-96e7-2b5bc41b88c7", "comment": "Malware payload (GuLoader)", "value": "f37d080357be5b832d234cde887e6f2d6ed0929a71401ce2352398b347a618e93535f734b24224d9215148d401c3dd3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017197, "uuid": "489be046-7b6e-41ee-87d8-06081b920485", "value": "T18BC40241AEC6C85FE31C457684FDEAA276BD6C181A169543EF773ABD3B303624D0A306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017197, "uuid": "048cf499-763b-44a4-9e68-d2b26620393e", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017197, "uuid": "46b4bbaf-4a1a-4606-9989-4ec2917db511", "value": "12288:nDGfx3geJtSy0UbATJ8rMYNS3iMONPHEJhudD0S:83gKrbAFSMYaiMKsTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017197, "uuid": "44c2111d-3ac1-4c53-a438-6a896a51bfcd", "value": 545586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017197, "uuid": "aaf7c66a-49da-42ff-8cec-0ba18f5c379a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017197, "uuid": "fe13bf3f-6ada-4a84-80f7-450f4a7375c5", "value": "SecuriteInfo.com.Trojan.Inject5.19889.28515.17358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c46074-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049375, "uuid": "1ecdcc33-43de-444f-bce3-a8bd7e850027", "comment": "Malware payload", "value": "fd830909822e8665cd1912b48e94fd01", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049375, "uuid": "df3098b3-0d2c-4a3e-afe4-958b11865720", "comment": "Malware payload", "value": "c5f01c0eecccf994bdde890fbfa550cd6b2044c44ecd420ee65559672e3439fe", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049375, "uuid": "e95e162d-e6e4-4815-86ce-e592f4cada96", "comment": "Malware payload", "value": "c861c2254fadcda908ca3f380a680aeaf59d3de6", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049375, "uuid": "ad346fe0-79ac-4186-9037-319d217033c1", "comment": "Malware payload", "value": "6bc26465d921db0197acc28ee534552459d05c72f290b285869af20128d270e71a137471b1c812b9f5519c3e45f3b593", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049375, "uuid": "5a21f75a-ae15-4131-b6e6-17f7bfa4039c", "value": "T1F3B44F23D26DC512C40E9B3CE6738EE96B31FC0C47D2258FA64E722F9CE2941D7956A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049375, "uuid": "ecc4a59c-d25a-49a8-b316-04459d1b68b2", "value": "6144:3cKoSsxzNDZLDZjlbR868O8Kz5LLxEtjPOtioVjDGUU1qfDlavx+W2Qn14yLxCPT:NonD9JH3jO7AefiDmUL4eIPGQW0hv5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049375, "uuid": "0ce9dee8-6c9f-4d95-b58e-bc26851e1567", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049375, "uuid": "65a04ff1-cd4f-49d7-ac05-e079820a7886", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049375, "uuid": "a9c5b75c-83c1-4301-b401-b829aec32c93", "value": "c5f01c0eecccf994bdde890fbfa550cd6b2044c44ecd420ee65559672e3439fe.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceddc941-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049523, "uuid": "ef6e9015-5b9a-41b5-8efe-39ee09de88b6", "comment": "Malware payload", "value": "37034b48c4dc43d60be0bbb6c129207e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049523, "uuid": "c54bbbbb-eaf1-47ad-9628-694926a9c764", "comment": "Malware payload", "value": "c6873948824fac08142b87a9f1c70110ffcfb422a3383a9de26d1caa04a1ae7c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049523, "uuid": "d5c0c7a2-568e-4776-b60f-4313d989443c", "comment": "Malware payload", "value": "0fd37b24300514510e00cfd01164e133cf57c6b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049523, "uuid": "30590bbb-0e51-41bb-a3bb-295eb38640ab", "comment": "Malware payload", "value": "a37aadbe860071a8bb35c6dafa983598efda153514d6cc8786555f7873d9d23ec201a9f32e5d0bf41b0bcb44343bfcb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049523, "uuid": "c993bd6a-a9d3-4607-9a7b-7f585f2ca7de", "value": "T1B4933FDD766072DFC86BC472CAA81C64EB60747B931B8207946716EDAE0D99BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049523, "uuid": "157d2ed2-4fef-40f3-b9bb-2d6b33fc1a01", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049523, "uuid": "1e15b687-9969-4ef3-bc53-59de489c3026", "value": "1536:5MJ09WaGtov+4QG5bYPIbBIxFLvtUsbC4eCB9Wka3Njb:5MJ09Mtq+4lWpbC4eCB9WkaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049523, "uuid": "54b7f87d-d272-42dc-9803-e4e3030259e6", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049523, "uuid": "3024fe11-d1d6-4b55-aa6f-337e0b2b5df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049523, "uuid": "d02d8632-450d-4b2e-9b0e-31148385caf5", "value": "c6873948824fac08142b87a9f1c70110ffcfb422a3383a9de26d1caa04a1ae7c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0604ff3-13d0-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744044775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744044775, "uuid": "bd0a030f-2d35-480f-a03f-f0851c86938e", "comment": "Malware payload (Prometei)", "value": "a72019cce680ba4c3c2f739fb3bf5f70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744044775, "uuid": "a28ae0a8-908f-4850-adf7-c4d8d8a1e3ce", "comment": "Malware payload (Prometei)", "value": "c6b3e5d07015dace4cc6f69515b60b80f5cfe64f1197412f7a12aa6e19cad711", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744044775, "uuid": "ace55b6c-bbb5-48fb-b6f2-2720a7dee389", "comment": "Malware payload (Prometei)", "value": "cb8ff331f28ed23d96d1d825073ead8c482680f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744044775, "uuid": "2b6f5d7f-b788-4c88-a58b-a8c57b621cdb", "comment": "Malware payload (Prometei)", "value": "89e611b36ba359c3cece03206e4160a2e3c4b7789f8de78da773a77d3c44b2eefd0f99592d17c911928c2f2ee3834dad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744044775, "uuid": "4bc3055f-5c8b-4836-a9ef-14140d25b2a7", "value": "T14D9423F8C83D2E3098169B3CBB5A826CF0A15772D9562F7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744044775, "uuid": "99fee810-66fb-4090-8b03-48abcb50c345", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgC:25WOSACZSV6eKRH5EPiamb4DsDwwcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744044775, "uuid": "b6f355d6-f6d1-47b7-bde8-11a2908b81b6", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744044775, "uuid": "970a4aef-15b3-43bf-a3f4-c13e5c74ac5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744044775, "uuid": "19e3d44e-6053-454b-bc02-490fbb559482", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56040c07-1354-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743991338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743991338, "uuid": "1876fe7c-9e07-4431-a243-844dd53f55fe", "comment": "Malware payload (Mirai)", "value": "c665be249de8aacbf7f020710556850f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743991338, "uuid": "9f061dcb-54d8-4e62-b303-340a216c90cd", "comment": "Malware payload (Mirai)", "value": "c70c7d6288ddd3de1e999fef3e15a4cb7d23656de44209d834ea08c97f26f2c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743991338, "uuid": "1573edf5-cacf-4325-bb65-bfe3d7702cb7", "comment": "Malware payload (Mirai)", "value": "7bf15fe8983c1a7304ecb626385fd8d656657750", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743991338, "uuid": "a937aeba-fe96-41d3-b902-0997b785c480", "comment": "Malware payload (Mirai)", "value": "218c43c777c97b5aeb94e6770d1848ba6e608a00a0030579bcb63419f04868c0e2d1f4b174d79cadf44daadae734e5a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743991338, "uuid": "2c3144f2-2f7f-4f63-be88-9d65adcee607", "value": "T158D2D06EA7001AE9C51AC47D87EC03A07A116BB5D143FD1A508C7F935F9DAB93A8B4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743991338, "uuid": "421a47f7-06ec-46bf-8f51-bd87d741863a", "value": "768:9Yva6tyRjdLVM1ZnRMy6gidymlShZtYAH1n/HJgGlzDpbuR1JI:9YvZtyRphMPRDid0pHHRtVJuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743991338, "uuid": "fd2aaee0-2de1-4de8-9e20-1c454e620edc", "value": 29420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743991338, "uuid": "f4c18440-ec48-4fd7-9d71-8982f51d9041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743991338, "uuid": "8f668fba-092a-4c1d-8ed1-8a63e5da08c1", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82ba276-1367-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743999744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999744, "uuid": "586950b1-4629-46e8-94e8-3e329ab238f9", "comment": "Malware payload (Prometei)", "value": "3880e58ad62cfee93308e067dfb073b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999744, "uuid": "1e65b486-51bb-48b7-b2d3-5e7e83275cd3", "comment": "Malware payload (Prometei)", "value": "c7140dfb968c0703626a7fe402f44e3befefa5af21aa449c068a8cb460bef0e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999744, "uuid": "79c7b54c-b269-41cc-974e-3b348d444a57", "comment": "Malware payload (Prometei)", "value": "24b1db1b63048e48d2511adf06695017a2f8a5b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999744, "uuid": "8490d436-147b-4544-87b9-d69207fc3f53", "comment": "Malware payload (Prometei)", "value": "8d73929b842426f46d2d40cc3f9a7f85b439a3f3480ac371d4c99177d4f4c467f9825ed084e7859355641f8cc6458ff3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999744, "uuid": "441a7d3a-c8c7-4909-bc29-132a3c326ea2", "value": "T1649423F8C83D2E3098169B3CBB5A826CF0A15772D9562F7AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999744, "uuid": "1b95682d-1b14-4089-912a-e33e6e58aa62", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgA:25WOSACZSV6eKRH5EPiamb4DsDwwcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743999744, "uuid": "8203279a-9503-4a42-8236-dd7714e26f56", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743999744, "uuid": "80ce1e59-cc6f-4f14-a6f1-d0864751c30c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999744, "uuid": "722c50d8-5e42-49ab-b5a1-a614aa5cacd9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45881e2-138b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744015146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015146, "uuid": "4a4ceeae-e147-45ee-a44a-81fd8593027a", "comment": "Malware payload (Formbook)", "value": "da62a1cec03063f3eafa2c0f99f636a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015146, "uuid": "8b393393-2d2d-42c0-839b-dae7d9165278", "comment": "Malware payload (Formbook)", "value": "c73f2334dca4bbd14f7ddae4abac6a2afbf86d36d972dd3638ea6b76f654534f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015146, "uuid": "5eeb341f-e0b3-40f9-bdf3-d792feade7f2", "comment": "Malware payload (Formbook)", "value": "51f696f57a355b84844e5537c11830f525c6b3ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015146, "uuid": "7f173a44-746a-4acc-b467-ebb4f53b91f3", "comment": "Malware payload (Formbook)", "value": "1b6b743a8f491b0151ae5c236e52bd22cd9ca1671f76daa792069289ef6ad3330cbc880523a2693098810c7dc451f032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015146, "uuid": "cebdf0a3-c53d-46a7-9986-dc25a2128d33", "value": "T182542310E6227C0FC93DAC7002C70EC5BAC2AEFB5D5616A1EA55F0D7ECB91B9650784B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015146, "uuid": "3e98aeed-f9e4-413b-8699-580abb313064", "value": "6144:Iu2vr7riDFG1kaMAdJGuRzJDOo000I5NURMYHJt29nPr3QcaE:ivHGDoztdDT0zI5NSFqPT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015146, "uuid": "b43a3d6e-b632-4fd3-8bbb-595fe58dadcb", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015146, "uuid": "cf2ea595-687b-4b96-8ed9-a89f6874462c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015146, "uuid": "9b2b1fdb-7942-4f70-9b00-8f6b2b17d6e7", "value": "Biomedica Order040725.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de1c127-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1744034409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034409, "uuid": "882dc4c1-83d4-44da-a3b8-172817f95cfb", "comment": "Malware payload (RemcosRAT)", "value": "f160ddfe3d7e39dc40d9a018fe2fef16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034409, "uuid": "102cf401-ada5-4ce7-8f07-24086db372e9", "comment": "Malware payload (RemcosRAT)", "value": "c7daaf3bafa2af2b0dc4b9c933f629ddfb05cdd1c5728eb128e74636cd0e3a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034409, "uuid": "8f2dafee-a808-4f11-9f67-af727ac49ea8", "comment": "Malware payload (RemcosRAT)", "value": "b2c1b86d8a35bf2a779ad14b940b9d7072954fbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034409, "uuid": "6fd59228-090c-4880-9a9e-2cdbaf331bfc", "comment": "Malware payload (RemcosRAT)", "value": "0cbe3296fd2f4b49cbea923e64438206d0adace53b38fa4d10ebd9e558e93fcc03e7ed6ae6c69509aa5db2043a5da503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034409, "uuid": "f947b937-4b5c-476e-8ea5-d96ad21b9dc1", "value": "T1D555CF2263DDC361CB669173BF29B7016EBF3C714630B95B2F880D7DA960162262D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034409, "uuid": "e95c5141-bf39-4a23-b5ae-f84edf7ff7c1", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034409, "uuid": "e9b33084-fc87-4605-92d9-09bd6014ead5", "value": "24576:ou6J33O0c+JY5UZ+XC0kGso6FayvQSSGXFFkIzSGo1c3Q6qGcZsDWY:Cu0c++OCvkGs9FayvtSGV6IGT1x6wY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034409, "uuid": "6ce98b96-18d4-48c0-b9d1-f4d41fba7da6", "value": 1293312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034409, "uuid": "f83e467a-4b17-44d1-a60d-cf64f3ba8ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034409, "uuid": "ce88bfbc-64d3-4b18-a0cb-163e6ab8d9f7", "value": "c7daaf3bafa2af2b0dc4b9c933f629ddfb05cdd1c5728eb128e74636cd0e3a31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15087df-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034549, "uuid": "6a600a05-d053-4750-9ade-2388e28e7718", "comment": "Malware payload (Formbook)", "value": "fbcf00ed27bac15c981d237c31af77c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034549, "uuid": "6fe67f74-e3dd-4086-8ecf-e8f41a5c1c4b", "comment": "Malware payload (Formbook)", "value": "c82c8f715142e8bb457caeef673c059332a6bbcc4dbb9c5648b5af9228fffda7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034549, "uuid": "912b9c21-e8f7-4ad3-b4ff-9a5f6049d89d", "comment": "Malware payload (Formbook)", "value": "d22710a8d38fa7e326e050ef413f287eeb8dc990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034549, "uuid": "4e6c46d8-82c5-4b25-aa7b-ba3280a6fbc1", "comment": "Malware payload (Formbook)", "value": "71b84e8e9f20d945fa5ec5f506d58261355e5b86d6ca6f04dc86f479ae5fb5db383e2ee6010c53efcb6619a2f406f556", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034549, "uuid": "64a71074-fbf2-4add-99bb-c194d544a3e8", "value": "T1D1F41228166ACD17C0C61FB81C11C2B863B69EECB902D7539FE8BDABB5B73601551393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034549, "uuid": "2337401a-33b1-4bab-95e0-5bc03e7e5f53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034549, "uuid": "fa4e6457-c1d5-4892-b6d9-1237d4f8fc23", "value": "12288:FCxlloF+e4yELhDwd+svQihT7p05NIlRvbz8wIc4CvnlOrmJDSdyxCyASoVbc4z:FClQELhkag7p0D2vbbIc4CNy6SdyxySK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034549, "uuid": "8086d964-9f67-40e8-8812-e7c22c604828", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034549, "uuid": "cb149837-bfdd-45b9-b5c2-6ef717b1ac0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034549, "uuid": "ba830212-a5ee-497e-953c-04ef34c95b3f", "value": "c82c8f715142e8bb457caeef673c059332a6bbcc4dbb9c5648b5af9228fffda7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba66c4d8-13a4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744025867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025867, "uuid": "86a72667-a620-4b78-bd75-3edf567d7312", "comment": "Malware payload (Mirai)", "value": "f404f1edcb68d0a3a2230532b6361439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025867, "uuid": "b08f2cec-9748-4997-ad55-fbc57cd10fc8", "comment": "Malware payload (Mirai)", "value": "c866169c4d10bb4b35d23bfdbfc6b6a493513a3fa2e6f2fac477d0f6cd37c779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025867, "uuid": "e935b8fd-f23b-41b8-a0dc-e78cf1465044", "comment": "Malware payload (Mirai)", "value": "a7a8f5b056e97335b9d559f16aadd1e0df44aa99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025867, "uuid": "5e222f5a-5b49-4081-9344-595364d8d009", "comment": "Malware payload (Mirai)", "value": "89624e5526d2b6aabc4c628cf2e2e1f7ccc71f64d74c028440f0e9ac921ff1f361d1c5f66c5d60bb0836c53b7dd4bd22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025867, "uuid": "2f1adadd-60f6-46bf-a166-6f4d88756a8d", "value": "T13713E10DF890EA93F57895B5B9D2D4CCAA006D42FEE14A1F6332CB18F948709786F1A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025867, "uuid": "012243b2-06c6-49ee-a8da-99a983cffa60", "value": "768:TRoYf5fImBIMg2Lt2tUw1UR4N26sd9bAp5UUUmJrMwCNWYd7QWk9F5tOthx+rkOC:Tye5fIDMhLt252qNHgtAprUmJGpQWk9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025867, "uuid": "15e9404c-7988-4437-968a-956b4b023047", "value": 42188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025867, "uuid": "d99f8666-5c14-4485-bbfb-ca46e019b7da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025867, "uuid": "32d19702-f0d8-4bd1-b95a-e36914318fda", "value": "hanoi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b39022-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744015279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015279, "uuid": "312759ca-1599-4b40-8117-490553b7f29b", "comment": "Malware payload", "value": "cffdd24742610fe5710dbc9ebd258c64", "object_relation": "md5", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015279, "uuid": "1cae8ec3-8c85-44f1-8ba4-222461701d53", "comment": "Malware payload", "value": "c8bb0dbc952c9dc2bbc550a300ed033ad5d2416390891ed1e800b08ad3ab5d3a", "object_relation": "sha256", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015279, "uuid": "819f96de-7ca5-4ea7-9adf-21c19ebad7dd", "comment": "Malware payload", "value": "5a86308407334b30642134920fb83c4dcbe6f613", "object_relation": "sha1", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015279, "uuid": "3b221c62-f4c2-4578-b243-4a2e5e7ad8e1", "comment": "Malware payload", "value": "b22720e62224ca544dccb73cac3547513432bafd05e8bf7b5395eeaaa54886d117ec37c1de16e43443625eb0e622d508", "object_relation": "sha3-384", "Tag": [ { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015279, "uuid": "4a3c519a-ae80-4bfe-ba05-0a64a06fe9b5", "value": "T10BE433A8283F39B9DC1E9EBDE8E41977E960345F6D3363E9C14D388E3111A41CB8951B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015279, "uuid": "5f356164-b832-4b37-8d24-d06cd75ecfa7", "value": "12288:kkWTnqkCT1VX+OUg3cSbJzJKHIgH00zoeIEvW6ZUDwmcAd:7eqBTnX+HOcosU0nIEu6aRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015279, "uuid": "f7b221a6-daef-4aae-bcd7-a579ae705215", "value": 699522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015279, "uuid": "27e3a470-109f-4922-ad5b-edca3394152d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015279, "uuid": "d9612a19-8283-49d3-900b-79a1a479be21", "value": "\u0410\u0434\u043c\u0456\u043d\u0456\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u0456 \u0448\u0442\u0440\u0430\u0444\u0438 \u043e\u0440\u0433\u0430\u043d\u0456\u0437\u0430\u0446\u0456\u0457 51324.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48f4281-13c5-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744040030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040030, "uuid": "71b0e266-939f-4a65-a0ec-132dce9749f5", "comment": "Malware payload (LummaStealer)", "value": "39f8d0ce7296a25a45cf4475c823e8ba", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040030, "uuid": "87c73265-6db6-43b7-9bd2-adcdb9fb1cb9", "comment": "Malware payload (LummaStealer)", "value": "c8ecb2104aa31ae974982ae6dbe83140149a62619c8453fe015e8e6033c469e2", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040030, "uuid": "6bc85e10-45da-45ea-a563-8efd5a5c202b", "comment": "Malware payload (LummaStealer)", "value": "4ff0c2c9fdf2c2a7db1021dbf827c48420ab3367", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040030, "uuid": "9028ca98-085a-42da-a9ae-e388a785e2d3", "comment": "Malware payload (LummaStealer)", "value": "1377ffd40564080a44a9606e4f1841c7774d54674c856566d6f6eed1efbbb8b41bcfb779983b968f384057a5ba61b9ea", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040030, "uuid": "420dbdb1-ca89-4031-a5e5-a7e9553bb1a4", "value": "T10C55D0516AA1DDA6C108D1704CBF3F3B3EB18573437489BBBB982D821957AD253F321A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040030, "uuid": "e17408b9-19fd-4e7f-9d31-78ea58c64fdd", "value": "7a198086ab6454f928ef37eea73f36f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040030, "uuid": "6aa9e3e1-b976-4b0b-ac2a-023aac964fa3", "value": "12288:az0cOT8ypSZt7R2AC5PrvNZWoeUvNZWokJOeqFJOeqEJOequJOeqVmbSentHdwqz:azHa8yUC3PrTWNUTW8ntH9516LrOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040030, "uuid": "09a2d938-2f08-476f-85c6-ce48ddda6a1b", "value": 1394688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040030, "uuid": "1f92124c-249e-4762-bc04-6c9f09fe64fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040030, "uuid": "d1f22d47-bb41-4459-b8a2-bcde143e9110", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d37383a-136d-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1744002007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744002007, "uuid": "6fd11a86-5d03-4682-afb0-5c3e0fc7c24a", "comment": "Malware payload (GuLoader)", "value": "779c055ab6c16cfac256f3a322a66efc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744002007, "uuid": "cc125bf8-d65e-4272-8d9c-37946ff973f3", "comment": "Malware payload (GuLoader)", "value": "c9f9303bf69be85902b542f14f7c9a21673d616d3c6cda70d28175229bf6b9c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744002007, "uuid": "def0f182-7b7b-4647-b762-68f269459c5d", "comment": "Malware payload (GuLoader)", "value": "84a796047b064811c7a4a1fcbc18231d51b762b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744002007, "uuid": "cac9d598-4619-4d42-808c-8e44b78bbf04", "comment": "Malware payload (GuLoader)", "value": "17c460856ada529dfaff0e05537ed2fdd1b58b961eccfa64967e3aed976a408a5cae1090f2c1ea8fa4b41aa99e8ff30a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744002007, "uuid": "4f51c3ed-3006-45dc-93ca-34f519b7061d", "value": "T136F423E52A62C113DD5A41B32FBA8323CCF4798935CF270BE7802919BE23751671E59D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744002007, "uuid": "61582138-a85d-4c27-bfcf-097422499a53", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744002007, "uuid": "2a08bc32-f1a1-413a-b229-8226ff5e7e77", "value": "12288:N3nXU7JPoyxIccVbQCu40jq3YmYU3LZf0dsSRcEfYicJInXESzeAUGkA4Pa3b70:N3nXXyiVbQYK/CeyEfYicSBzjpk4b70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744002007, "uuid": "81dc6b1d-cf2b-4fd3-9062-688c7924020d", "value": 756296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744002007, "uuid": "793de6c5-fc80-4227-a45a-c0f4d2b0e69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744002007, "uuid": "0220a325-6261-4618-bcf2-553fab3461bd", "value": "z8Document_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7835f91-1398-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744020762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020762, "uuid": "6e265a86-ef77-4fae-bef8-9c73c7f3553e", "comment": "Malware payload", "value": "76d2048babd3c965f96b7eb2e227e7f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020762, "uuid": "11d77c1e-0d41-4adf-8745-898a296bbd19", "comment": "Malware payload", "value": "ca3e00654122067718238437507d58a8e8f7b2d58438a4a0cb1545141be1ab05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020762, "uuid": "57170d95-6aab-4cfe-ab11-0719b550fe27", "comment": "Malware payload", "value": "bc401384b911e1aeb36e02485714adf9c5a2054e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744020762, "uuid": "e591849e-471b-4a4e-9db4-d0127d73a9f8", "comment": "Malware payload", "value": "f6ad301b1ff99bddb4859c690e27bf78b325379d3420d4d8278ad7752ec7a82e6500f38ef50f17e133145e4bbc6f1cc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020762, "uuid": "4c3c394f-53f3-4eb8-b509-d79555eece9e", "value": "T1048633F7A67A5073365B933DB07A5069A099D47934CF192A9ACCB34381BF7BCE140827", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020762, "uuid": "4ab2323b-4e6a-45c1-9be7-2049688e1fd2", "value": "196608:9UINL9tYv8JqqtjyemnaAa87M6dDndrRIYYc2iyYc2kWRVb/E1tRCSz7Ksm:+INLQYTtjAaAV71DcOtvc2rbbs1tRpG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744020762, "uuid": "da498ae1-cbb1-4b44-9aa3-269e59803345", "value": 8585724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744020762, "uuid": "e23dbd34-166c-41c1-bcb4-168157b558ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744020762, "uuid": "f8f3aec1-e78f-4703-9499-5e2fb8450d72", "value": "fscan", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d90613-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744050746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050746, "uuid": "129732c7-0503-4e74-9474-8729087fe313", "comment": "Malware payload", "value": "b8dea100c3343e7ba3bbc108cce7639f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050746, "uuid": "12f234fd-12be-4e8a-aee1-e3d0cfe5a741", "comment": "Malware payload", "value": "cb1e237933357d1beaedc4a598cdbfd23294e32ea019cb5463b0efd8eb5d7ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050746, "uuid": "0f8b6ee7-cfb3-4dab-b174-d36fd4fed55c", "comment": "Malware payload", "value": "9a9b052524f1e3b8deaff4248e43934a07fd37c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050746, "uuid": "234e7c0a-9dde-49f8-b298-240cb9afd07c", "comment": "Malware payload", "value": "2119f4524a596fffbadfc21073640cd3a65a5346492eda194dff3301087f64c9a9545fff6bb2f18e266f06609388077c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050746, "uuid": "728d31d3-2c7a-4a11-82ab-b1a236373cfc", "value": "T14DB5334C532044DFD7774D7518BE9D700EA2A72C0AAC815534CAF927EA3878EF51F8AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050746, "uuid": "e0761cb9-a5e4-46c1-9f32-f90fa754673c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050746, "uuid": "6db58efa-a4aa-4e32-a122-1569ec522511", "value": "49152:JG8JyWarE8pML5QV+xjz7vnNQQj7BUHNAg1s9v/3DVyrrXLgsg:M8xYEAMLRjHv10NTSVfDVmrFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050746, "uuid": "0da64e81-90ea-4c3f-83e5-c71872cabb10", "value": 2375072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050746, "uuid": "1faa6c52-c227-461d-9dcb-2e93ea7ea4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050746, "uuid": "0be593f4-17f3-4e2c-9a1f-eac172f07d5d", "value": "b8dea100c3343e7ba3bbc108cce7639f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d78a03-13af-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744030590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030590, "uuid": "1964cfa8-e26f-47b4-815b-47e797392dbd", "comment": "Malware payload", "value": "0876f445a300fabf195ae4a2077bc3e1", "object_relation": "md5", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030590, "uuid": "a0a779a4-9aad-48de-a0fd-773f287c2c22", "comment": "Malware payload", "value": "cc5efd4f7d02c2e1eb00fdb4987f2e608f562baf7dc6cc90ae29b8bd91fb7dfb", "object_relation": "sha256", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030590, "uuid": "472dc24d-d623-4fb6-aba7-b63ca2e23267", "comment": "Malware payload", "value": "fd2741e20f7e898714f7ca29e705d16c9d2b5100", "object_relation": "sha1", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030590, "uuid": "6cf0837e-da76-4f8a-b6fb-5f8763b3061a", "comment": "Malware payload", "value": "58ca068c30e9f44ab480148731ee62dd61effdaa822d1df7c53c409ba662c2e047af364c2ac75c19d543ec602c630a15", "object_relation": "sha3-384", "Tag": [ { "name": "194-180-191-51", "colour": "#3C6999", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030590, "uuid": "a75720e2-cec5-47c1-ab24-7ed9a43e950f", "value": "T1DB35F74C34C2E8CD6A623D75247B9085A23292A6F4479ED9F0DDECF21AF44641937F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030590, "uuid": "4f2add21-0371-46ed-a13a-d516ddb547cb", "value": "6144:Wb6NJhIrDjyeLyXyberDq91ItXMIX+CdppUyM4JMRUdt0FjyD0EjpQahloWbGhIM:5DUiZDWie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744030590, "uuid": "bcf3182e-0b1b-4f87-bd5b-503738d7c443", "value": 1094192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744030590, "uuid": "ecf26719-9989-42c7-9896-56c53e472cf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030590, "uuid": "35b95446-49e9-44f9-847a-b2df4685f44a", "value": "Chrome 134.0.6999.43910 (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab852b9-138d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744015693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015693, "uuid": "284b554c-e862-45e8-b7ad-b5234e617c51", "comment": "Malware payload (Prometei)", "value": "8bfa767f18b10114cd6c4eb33c16c161", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015693, "uuid": "585e684c-f4f0-4a26-b31c-4007213cb438", "comment": "Malware payload (Prometei)", "value": "cc5f6daae8c537aa953cd841f7cd6a8743a82b9b7396494ec5fae378c2b93b41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015693, "uuid": "c40e33ef-6059-4eff-b7b0-48ef6a0d0b91", "comment": "Malware payload (Prometei)", "value": "5fa187b68cf0002790560904f97d069d7e6e8111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015693, "uuid": "5596f909-286e-4e52-88ed-2a31090caa9d", "comment": "Malware payload (Prometei)", "value": "addc210fe0ebaa319a3a0d1194cf24587515f6d3422080345f5380681064c3e3f659fc06b5c4852f953b808c8004326d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015693, "uuid": "9c727cb3-b136-4de3-930e-326394eedc2e", "value": "T17F9423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015693, "uuid": "4dd66cca-94d9-436d-889d-6fca443f59b8", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg8:25WOSACZSV6eKRH5EPiamb4DsDwwcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015693, "uuid": "128e0492-e925-4b11-a9a1-42d73e3d1ea0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015693, "uuid": "2f1b9017-ec53-43f4-8918-c8d1ed87cbb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015693, "uuid": "457d5953-8ce3-491a-a726-59327173d4d5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6db340b-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744015526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015526, "uuid": "e021e268-40ad-4882-b296-c9d0ea99dee9", "comment": "Malware payload", "value": "52c2d785984358485ba5d5f946c1ba63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015526, "uuid": "e58226b3-fa33-4600-ae31-68e56b1556de", "comment": "Malware payload", "value": "cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015526, "uuid": "b8bba8fc-2a89-4d0c-9744-b51557baf66f", "comment": "Malware payload", "value": "f44365fa8ca9aeebb5d01ca86865bf26b7251a70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015526, "uuid": "81f86bde-1aee-4687-9d5c-12129493bcc2", "comment": "Malware payload", "value": "9471a8c6618b534f7f9e40675cbc5d771233510c7d42fc48daf74807f8b95f94680fccc1fecb29b38c1f1bd925135880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015526, "uuid": "8f58e605-1b53-46ec-b547-92ce595497ca", "value": "T1279633D86D4315A2CC8FDB713359EC7C31BD6BB98A6CCD67A40D605BFCA7629103980A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015526, "uuid": "7842ceef-5f17-4fb9-80f1-af30c8bd5a81", "value": "e49108ddcc94d3a4a3aa4740d05d7ddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015526, "uuid": "b1ff70a0-a3bb-4263-8700-2abd8858a8b6", "value": "196608:BlFyJA06kqDGwTYW0vycMbr5ECDBdf8/ledTcYAVgoftCQ7D:jFyJAJkeGUuaLb1ldKlQtAB7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015526, "uuid": "97456dc8-b26e-4676-a1dc-42ba206c5f60", "value": 9037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015526, "uuid": "775a8245-e064-4c85-9eec-89edd6bff874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015526, "uuid": "95c2ea14-d06b-45ba-a8ae-c222c0938ead", "value": "rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afbea48-13da-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744048980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048980, "uuid": "6d9b1d74-e99f-4338-a32b-6b9c02f7557e", "comment": "Malware payload (Prometei)", "value": "3bda5ee0763cb89002dfff0db5ee05f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048980, "uuid": "557cc2f8-e453-425f-9075-a500872b4275", "comment": "Malware payload (Prometei)", "value": "cd2603028a847d0e615b02767a390a4ae84fb2b5892f343c78d3f6f808b915bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048980, "uuid": "a5b7012c-f773-4a90-8f79-c088ef75fb65", "comment": "Malware payload (Prometei)", "value": "aad701f0a1fa5feb13af99c741f194536b69afd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048980, "uuid": "c4cc2f1c-299c-498a-860b-010fc4044c33", "comment": "Malware payload (Prometei)", "value": "4edb47a961c6bd1033bdff69464185547911aeb07b635cc5b53a8f0c49731bcd73f2fac7d5a9f5691e88d9929389dd6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048980, "uuid": "c7d3e252-0857-4443-89c3-c61f9cf25e32", "value": "T1FB155B653700FF5EF29DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048980, "uuid": "87d1453c-2af6-41f1-adc6-9319620cb698", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplL:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744048980, "uuid": "b3ea85be-8053-437c-9953-fe07b95b062e", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744048980, "uuid": "b07af6bf-35ed-438e-8892-6253d08fe0e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048980, "uuid": "b48c408d-7925-45c8-9894-6f242c12b183", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebdfaaf-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049362, "uuid": "a90e735b-4181-4d3a-8e95-f3cd5136db7c", "comment": "Malware payload", "value": "cff0e64c4040861569abc676eaffbbcc", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049362, "uuid": "7f3612c0-8d73-4ad0-9d19-c6b67e088eea", "comment": "Malware payload", "value": "cdf7fb73990a588f8fe32029e3b4794e7793b850eda21754a3517a62338f2419", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049362, "uuid": "ae26b626-1d30-49ca-b69b-a8d510c6fc6d", "comment": "Malware payload", "value": "853da593d2a489c2bd72a284a362d7c68c3a4d4c", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049362, "uuid": "f7d8f429-15ba-4caa-bd1d-e41c7241d5c1", "comment": "Malware payload", "value": "1154f9fe6a3e526a5629539e4b75d017c7715b22992d82f1d901ea573ab17f6103d2a8b8d76b6d5c68621e17a4ea90f3", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049362, "uuid": "e449c4b6-c9b2-4aac-a144-e0e27901f4aa", "value": "T1A024C0BB3E84B418C54EB7B88CDFCB923162BD50CFAE888F7791B75A19716984006D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049362, "uuid": "2184d1dd-7c33-42ae-b374-ba63e6f54ef6", "value": "6144:eZ+RwPONXoRjDhIcp0fDlavx+W26nARP4OfHe09haNvg2oTliFBGmh08wtFv:pE0IXPFwmuvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049362, "uuid": "26d766aa-85bb-4e95-a0d8-01a24b621642", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049362, "uuid": "b6a711aa-6e1b-4d84-bfde-11994f835a9d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049362, "uuid": "73cd9c55-9e29-4665-b2fd-f6ed3b1ad4e9", "value": "cdf7fb73990a588f8fe32029e3b4794e7793b850eda21754a3517a62338f2419.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397b88e3-1383-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744011477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011477, "uuid": "4a406790-9b93-4a19-ad2b-3d5479be677e", "comment": "Malware payload (Mirai)", "value": "9c96ea786da3774983250df3858447b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011477, "uuid": "ead8f196-3d56-42a6-9d80-8de17219bbe8", "comment": "Malware payload (Mirai)", "value": "ce3cc60206cdd5287c3c4f3be836105a5836ad3915cafecdc250081553e39eb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011477, "uuid": "3a94f08a-41b2-4d9d-90a3-9d50ade842d8", "comment": "Malware payload (Mirai)", "value": "f3f5ea9ac6dcd84e228cb360e272b3583bb9b374", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011477, "uuid": "0a7bf448-a778-4a9b-bf08-40ecdc346c7b", "comment": "Malware payload (Mirai)", "value": "4fceab6501729613fbbc56eeb14c986fbbc4f144b397f7310ac9e490991c0a84b678822dcf259c2ca8ede9f9c2cc91b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011477, "uuid": "8455b206-c78b-4605-a494-fa42eab759b1", "value": "T1D1B35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011477, "uuid": "adc66bca-d883-4717-9c96-896c11043c3a", "value": "1536:WTW/VCxsHZ6sS2Li62C8vqKTR5/PPVGAto2WszrW+TNe7T:WytCxkSx62NFT7VG92WcrbwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011477, "uuid": "c2984b93-e0d0-4fb0-883d-c2c168643771", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011477, "uuid": "3f0b33ac-a31a-48fc-83df-44c32f0f95b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011477, "uuid": "e86da6a2-9ca2-4f62-a649-1e5656baf752", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f253a730-13c7-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1744040993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040993, "uuid": "7eb98d8d-79a6-4d2b-80a4-75568bdc6e21", "comment": "Malware payload (RemcosRAT)", "value": "f580a951ed1da5de9bd9f16956fc3546", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040993, "uuid": "1b3771bf-fbf7-47e0-ac9f-ea1954e44147", "comment": "Malware payload (RemcosRAT)", "value": "ce7a25f25c13cb9baea92707f76f9f212c1551e6c7dc5e4ec075f9e159c1b5c3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040993, "uuid": "622b83aa-671d-4e33-839f-55c01e60f4ea", "comment": "Malware payload (RemcosRAT)", "value": "6364a4411b6a5f707aabd37223a1fc96c387f242", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040993, "uuid": "40b8a02a-683c-4749-a2fb-be8576c11700", "comment": "Malware payload (RemcosRAT)", "value": "90daca6cf32d3ad80ce290bac347fca2ab70e8cccd3ef7474e84a42b295514532c0ffe75b6c553a3ba8dcb7a7030c644", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040993, "uuid": "da78e9a5-8b0b-49dd-88a4-301f386c3ac0", "value": "T117D41260FAA1C866C717E47B74E3C58CEC29BE8D6E11D9069F637E3F1878611A4F9102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040993, "uuid": "04d0891f-a678-4eda-85e8-6e246d67d4df", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040993, "uuid": "64c18614-515a-400d-9dd5-37b35d522c84", "value": "12288:ctoOoMm0fx42zlTMI0QM8KyFHsmUY5Mj5ckvQGtGeNStTZfgZjT0gRhgL:NOoMm0fWPl8KGsm7y5ctc6CZjTFgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040993, "uuid": "634ca2b7-2e05-4d27-9b3d-cc4da468df1b", "value": 612547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040993, "uuid": "751d6fca-b62a-4353-b64b-91960f345b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040993, "uuid": "7e665b89-d07a-4148-99aa-f66a35c08d6a", "value": "Performance Report.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd75c77d-13d4-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744046595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046595, "uuid": "260c902a-0571-454d-bff5-ba3841a68d14", "comment": "Malware payload (AgentTesla)", "value": "3dadeee1f080dcbe0c8dd3e6bd7cf8e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046595, "uuid": "09a56e7e-724a-4447-ac39-596c6303c3cf", "comment": "Malware payload (AgentTesla)", "value": "ced5a13f13ae8d4b1e0f0f4bcb3b01049d146a737c1f272789c44cacd9c0e43b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046595, "uuid": "8cc5f8c1-7423-4ef7-baa9-cb6300fdbb76", "comment": "Malware payload (AgentTesla)", "value": "69e15ba156fda991e960fad5b6101323bc4e8b21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744046595, "uuid": "aefd079e-3429-4b8a-a5c7-6863cf3284a6", "comment": "Malware payload (AgentTesla)", "value": "d6a0a1d6621a22cdcd34068065b6b9642fe692514a8cc7dd56240e393dfee974fcfa11f065e2f0373c30b70e95598089", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046595, "uuid": "820fbef4-85cc-4a00-9992-cb1313b345f8", "value": "T184D423EA454F3533512854F6D24878C0922089AB2EE0DCA477E9377A34F6F9DA63F825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046595, "uuid": "c9a54402-aeaf-46a3-be7c-2803ba1737c0", "value": "12288:PeJyV0+FQONL8uMxBavqd11jlOOS+RquiJuS9v9ePvRKz1g1HK3kjz7:GJwemw1BPMOxguisSjQ5KBg1qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744046595, "uuid": "4de8708d-176f-485b-974b-d87f3834aa86", "value": 638510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744046595, "uuid": "a4014b7b-978f-4684-a06b-4f3155df20f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744046595, "uuid": "643443d0-4118-42f6-b6ac-6cd34fcb366a", "value": "New Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d45e25-13c7-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744040871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040871, "uuid": "76baf1ad-9338-41e1-a962-8ffdb97c6651", "comment": "Malware payload (Prometei)", "value": "2e1a34a873afd440a227e86a5ff66869", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040871, "uuid": "663bb43b-5068-4978-8044-c75871765cc4", "comment": "Malware payload (Prometei)", "value": "cfe2998af4c14077e742cc926cad7f8da664225ab814edeea4dd727de1eadc69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040871, "uuid": "ef9dad04-cd70-4b81-a572-6cfbd989334a", "comment": "Malware payload (Prometei)", "value": "719df558fcb97c13163c560c639b9d63033709fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040871, "uuid": "b3ad674f-ff7e-4482-87b9-f33e0b5845f5", "comment": "Malware payload (Prometei)", "value": "fe9d0b0ed7517404717a70b9635857d2c22ce7032aa237ea02912cfd32a35cbdec75ca698e5457c823e03de368f77753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040871, "uuid": "676bd3b6-c49c-4b09-adc4-75a644abda98", "value": "T1C5155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040871, "uuid": "402d2eaa-48e7-4276-a5be-827e1cd13c89", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplc:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040871, "uuid": "50b2715b-e6f6-4c6d-9ba7-5542cf2969c5", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040871, "uuid": "90671032-ffa4-4f80-926c-67a4a1fbb1c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040871, "uuid": "ca9c3e94-6120-4950-a8b2-5713369094a4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc117d1-1383-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744011534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011534, "uuid": "d9e8a651-5988-4004-adfa-43ed09b4884e", "comment": "Malware payload (SnakeKeylogger)", "value": "4ebd4959a89147dae15737fa491dc9c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011534, "uuid": "d6c3c373-9755-4a7d-ad2d-b12273e7bb02", "comment": "Malware payload (SnakeKeylogger)", "value": "d0024683c559b8681df0b7c3f9cb0e4c079d49534486a1a8db1f0ac8359579d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011534, "uuid": "8599c2a0-529c-4d05-b822-b18b12d69cee", "comment": "Malware payload (SnakeKeylogger)", "value": "4b9202aee4ca825f3a8738f419473e10efc29261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011534, "uuid": "07f83e51-b275-4ca6-9b49-028f6ce493cb", "comment": "Malware payload (SnakeKeylogger)", "value": "062c0bad46cf5c809e49193c5a6209a945c4b13357ecaad8125a584f3432949cf47fa20dfcb3f80680e4bccc39f34dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011534, "uuid": "06f6b423-49b2-46b2-88a9-a597049b65f1", "value": "T18B15C23D38BA12A78476D2A7DBE7F827B178942F3025ADB554D307A143C2947B8C326D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011534, "uuid": "75b9e247-d9d6-44f9-9c4f-cb75c55baff4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011534, "uuid": "7e7fcf98-3da7-4688-bffa-207c3463bdfe", "value": "24576:WvDQUrBpyuzBTztL/ODu/wnI7hp9WlvQM:1oVTz1WDu/II7hvWlv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011534, "uuid": "0741d034-d536-4078-8ef2-49e9ebafe9c8", "value": 894472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011534, "uuid": "0cedb6ad-aef0-490a-a279-5907d8ac2782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011534, "uuid": "61146608-5b45-441d-9b7e-760e65d2b28f", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24024806-1349-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743986530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743986530, "uuid": "bc7ee839-a168-4ba7-a2fc-306efe67880d", "comment": "Malware payload (Mirai)", "value": "f9f581f0ec95cbe069b121061348bd98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743986530, "uuid": "0fc40e22-5267-48df-a1e3-e00262e71e6c", "comment": "Malware payload (Mirai)", "value": "d039090e1c07c4acce0a69b33ce024d5975b3ee7673df8ed486a84991b2f4db1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743986530, "uuid": "a9e5b8d3-2798-48ae-9d90-d0e58d6a8120", "comment": "Malware payload (Mirai)", "value": "80a0f6e0fa90927358eb4ce84577110f452ad378", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743986530, "uuid": "c9ce9aed-c8a9-4857-a384-6a05dab21c7e", "comment": "Malware payload (Mirai)", "value": "a0b70ecc1b41a6831385dd0143067d51d4914c20ab551600488fa65afa453775073f46ebefe59c5f4d3cdca5b529ea35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743986530, "uuid": "5d8a93fc-ebb5-474d-9594-161467df5e7e", "value": "T16C134C1A7B7A1F33C1E89B3941AB9B0336B9EB8410A4D78F7D660E5BAE6171050173F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743986530, "uuid": "83221403-563c-4067-aa3c-3553b58e22e0", "value": "768:5SMkoM65sDiFr9ZEO4FANiqbdZxbATszlCgYn4PUnrof14/JHnFbNQ0Dues+:5SPesDixsDiIqZ0i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743986530, "uuid": "4040fc8a-8f65-4ee5-85e7-5c6d1b2ded72", "value": 44880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743986530, "uuid": "eb6c13da-4f26-438b-b4e5-883a09cc2e4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743986530, "uuid": "5fbfcbd2-bd27-4d1b-a167-40351af5d1bc", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c652a70c-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1744038772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038772, "uuid": "185f4de8-6f27-4096-8aab-bd18a487a637", "comment": "Malware payload (SSHdKit)", "value": "0cd5913abadca830ec01aac87baf6ebe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038772, "uuid": "554f860f-37f4-4134-b1f1-35a99e080ec6", "comment": "Malware payload (SSHdKit)", "value": "d049260d39fc2670a0fcc49126e0507acf6fdf7f5fe1649399acfeb2fec0e235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038772, "uuid": "e9710d65-3dca-4669-b42b-2aeb67e40051", "comment": "Malware payload (SSHdKit)", "value": "7d5b77b8141f305f752743abc20eafff71c8822d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038772, "uuid": "04c829c6-97cb-4b9b-bf0b-a9d798a6c958", "comment": "Malware payload (SSHdKit)", "value": "95d4f2718d418f1a14b8b0564afdc6590bb94e934d920583a3e798b7d50a4c9bca517a8b61be86a0affc4747b09f768f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038772, "uuid": "cb5d772e-5a6e-4987-9669-3511a9427b59", "value": "T100155B66F9508AA2C6C41BBBBB5DC75833531778D7DE7006CD085B2437EB85A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038772, "uuid": "88d0d7a5-eb71-425c-b856-b041686ed638", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmzg:00BnRED/TwOjX0a5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038772, "uuid": "a353c922-c582-4e24-bcb5-9d51d7dad962", "value": 957719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038772, "uuid": "c05c74f5-e5da-4176-b1c6-1ff506fc1ded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038772, "uuid": "3c84ed76-1c5e-4280-a05a-8dd068093781", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4897b4-134f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743989230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989230, "uuid": "378ca4a6-8378-4cab-9a2b-0e84d4ff625c", "comment": "Malware payload (Mirai)", "value": "cb095025fabaf4935e7cde669f9b83cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989230, "uuid": "de048c4b-7a91-4a10-a4b8-e53cbcee09ea", "comment": "Malware payload (Mirai)", "value": "d0a729eda4e98c132a68864f1feb9f2676840909d2584c4e8225ac058af1581f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989230, "uuid": "a7a2b6ad-2b43-434a-a4ae-08ecea577446", "comment": "Malware payload (Mirai)", "value": "f057ff497853eac9b47772ae58a6be561c16edf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743989230, "uuid": "a22cfd71-0c34-41e4-ae1e-6106ddff54ff", "comment": "Malware payload (Mirai)", "value": "7a3d057d23de2f0dba67c4dcf239ef7cb29219821ce677d4ea07786cef75bb6fd139edabab04d7c2e082a9988aa82268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989230, "uuid": "c760a9a8-1546-42fa-a9d9-4eeb108d9c14", "value": "T1DDD2E1A7E3B5EA39D0B2E47418397940FDB87F12620533BB005A197748996CA2331BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989230, "uuid": "84b3a831-39dd-45f4-96b2-3edb402e6082", "value": "768:qYSoXdJZZ2Pup2/GV62rqe5ozWXH4KhSx0s6:qYJdJZjM/Gprqe5oCXXct6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743989230, "uuid": "f4b83681-e9ff-4ea2-bec6-404fc5a16718", "value": 29424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743989230, "uuid": "2d167798-d8bb-4282-ad7f-e803b5166aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743989230, "uuid": "3b80594e-78c3-431d-b088-3da506718dfa", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e869fdd-1365-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743998547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998547, "uuid": "8a502e18-6ddc-4624-b386-d9377b124c5a", "comment": "Malware payload (Prometei)", "value": "e7fe6d348f1f4adffb92c60df448532e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998547, "uuid": "210a1b86-a23c-4cd2-a971-7827ed1697f1", "comment": "Malware payload (Prometei)", "value": "d10597504c0b13115946148d6e06f17894e478fa3b1aed265290999abbecccfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998547, "uuid": "211f4f11-c58a-49fa-aa22-dece5d81d97a", "comment": "Malware payload (Prometei)", "value": "7bfb099cf1b11b594aabe3b750d524a153537e53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998547, "uuid": "e76a14e4-e957-4e76-9ec8-4174d8a406ed", "comment": "Malware payload (Prometei)", "value": "8e1433e50f5f3d81e893cb0976ff5338ad3bce3b933fd86aa5be90856f7a1a5295e3d4eee6020af76ef210114e55a5c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998547, "uuid": "47253939-efe2-4f66-bc83-34f22b623b7f", "value": "T1D3155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998547, "uuid": "54f862ab-fb4a-447b-b4fd-1fe027036e22", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplO:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743998547, "uuid": "1a8bc522-758e-47c4-93f3-6d4676727aaf", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743998547, "uuid": "99fa51d0-7968-46a3-b857-0507f0d90a2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998547, "uuid": "cac03ffa-9ec6-44ef-8552-8e1a3466da2f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa1404c-135e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743995542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995542, "uuid": "2489468f-6f20-4cc3-a17d-57f09f40b70c", "comment": "Malware payload (Prometei)", "value": "872a743ffced8020a36caba7d589dc5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995542, "uuid": "4cdbb678-0654-446e-bc9f-d4f8e25536ae", "comment": "Malware payload (Prometei)", "value": "d1e4615f13f0891d3c795a4b964895616f2fcfa9c45d63264fcd5c0453b4c2db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995542, "uuid": "24c26d0b-b2ea-4900-83a5-0f8928eed240", "comment": "Malware payload (Prometei)", "value": "8800c15f83252abb7343bd01db7b73ca89ac4b6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743995542, "uuid": "0ef7813c-c62e-4565-9e45-d25725222ba0", "comment": "Malware payload (Prometei)", "value": "51ead840037424d1caa8aa0bb8770777f3277acdfe109749e52d7961ddf207176d98ca100ff7c889377f75553b710f4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995542, "uuid": "f16fb1f9-918d-43bf-873a-5162c137a05e", "value": "T16E9423F8C83D2E3098169B3CBB5A826CF0E15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995542, "uuid": "9fe3a5aa-518f-4264-98bd-64244453b1ef", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg/:25WOSACZSV6eKRH5EPiamb4DsDwwcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743995542, "uuid": "33cfe8c9-947d-460d-ab93-81d13447c26c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743995542, "uuid": "3b983f49-9181-4ff0-a193-947e7bb0cfbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743995542, "uuid": "58715566-6e94-4385-b535-0259d840cbc5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad3cacc-13c4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744039370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039370, "uuid": "6f2b2ff6-0f34-40a4-b872-11262003c73f", "comment": "Malware payload (Prometei)", "value": "b06df756e79e40529d2d8f71e73e471f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039370, "uuid": "17856b0f-6503-4b09-bd2f-a0150269d55d", "comment": "Malware payload (Prometei)", "value": "d2241467fc9622448fffca1bf4be3db9bb555bfbed922918bd565a4fc539242a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039370, "uuid": "5215f10d-30a2-4a57-8352-32d0106ad1e4", "comment": "Malware payload (Prometei)", "value": "99721c54f9d6cff371893776501e0df0ed7d6d92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744039370, "uuid": "03a784e7-d7df-4a9a-8abe-69a3c8cbf3ae", "comment": "Malware payload (Prometei)", "value": "b61647cda0e633b169d61349e5345ec82fa0ab26267caea371e17a602f98f5e40cdbcf8f296c99028e32b7b0317fbee1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039370, "uuid": "ba5f2b6b-08aa-4b61-b59f-38676c3a4129", "value": "T1B69423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039370, "uuid": "8fa7230a-d52b-4703-aef1-2a0aee110659", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgu:25WOSACZSV6eKRH5EPiamb4DsDwwc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744039370, "uuid": "fcf10dc5-b930-4f58-bc2c-2de5c1c2027a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744039370, "uuid": "37cf7a1e-a4e2-4461-9209-bd2a68d20dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744039370, "uuid": "5dbbd043-e478-4960-af27-ef7ff71411ba", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e352571f-1380-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744010473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010473, "uuid": "47dfcfdf-8477-4a1a-9837-c27f631d3d9a", "comment": "Malware payload (AgentTesla)", "value": "47e6993ca2c8e088e5d25469d14f693e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010473, "uuid": "abaaca12-cf20-43f3-b719-1f2b07f72eac", "comment": "Malware payload (AgentTesla)", "value": "d28358e40350fd9a8b4433a33131b7f567d66c1f9a20b6bd276178b585304580", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010473, "uuid": "e7afd906-de5f-405f-b864-115f9bfaff15", "comment": "Malware payload (AgentTesla)", "value": "97aee3ae9960890ebb73b4976108ea9f9d441db9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010473, "uuid": "bf188582-dd40-45cc-a33f-8ecdebb24aca", "comment": "Malware payload (AgentTesla)", "value": "fd422409dce75f74ff86d149c3658f9f675e2dd17f28c38ae93f986e8496e2be3ca945bde6efbc75549c47b8f7427d16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010473, "uuid": "abc73bb1-bc09-48f4-8133-b5dad90723d8", "value": "T1F905F064336CDC17D0B643F52921D27403BAAD9D7A21E3C66ED6BDCB38A1F815A007A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010473, "uuid": "cdcea2ea-d5d1-43ef-ba86-a6e6cc15db90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010473, "uuid": "845ddcca-1723-490a-8ed8-a866cfc43dd2", "value": "12288:sY9YqBCCwfDruBa3OwYLej/8Plw1laJ5Q0StW/ihgdw8si:GfrXyeMiYe0GAjdw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744010473, "uuid": "bddf6a08-f042-44fa-8d4b-a5ca519aad90", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744010473, "uuid": "5beeb56d-f468-4bd0-bdb4-0ffd6180fe69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010473, "uuid": "cc55df45-319b-499c-a5d9-2f20c3ba2d4c", "value": "TEKL\u0130F \u0130STE\u011e\u0130-52850_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a9772a-13a6-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744026768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026768, "uuid": "e5013f29-7c19-4550-81db-c42dfdb4465e", "comment": "Malware payload (Prometei)", "value": "28fa7fb685d8e4359d7d8f85c5b10a99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026768, "uuid": "e908ca45-64f5-46be-bc5b-0ba2e259ca20", "comment": "Malware payload (Prometei)", "value": "d2e2a81665913c1b23ff414281ce7445e288e0af445d246a6c4c0111279c63de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026768, "uuid": "8abb1ddf-777f-4089-95c3-e8bab674e1cf", "comment": "Malware payload (Prometei)", "value": "9d18b273a9e5c80aea321143d9e046876173d60e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026768, "uuid": "62de5474-4862-4e86-bce1-3abf44f1b926", "comment": "Malware payload (Prometei)", "value": "b343e3807eb6c5337c18cb3c0277023c48ea461394409304b199cd0db20fef8eb601f7d8205776e2bb62e0a41917becb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026768, "uuid": "ed1bae79-157f-437a-a615-faa75f95012a", "value": "T15B9423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026768, "uuid": "78ed0638-5422-4d21-89fe-61c8e02219e5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgK:25WOSACZSV6eKRH5EPiamb4DsDwwc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026768, "uuid": "a6c667d9-f3dc-4e1c-8e8d-7885a2a0ca38", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026768, "uuid": "0414d247-ec53-4e95-99f7-d8cc4ce9bd59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026768, "uuid": "0b6b4459-597b-40de-bb9e-890927d7fe58", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d13db9-13c1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744038180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038180, "uuid": "47b5b998-124f-484e-bea9-4dc5ef4b3a8e", "comment": "Malware payload (Prometei)", "value": "3bc2930f897c4700855aa4b9c58b5ae4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038180, "uuid": "2563a1b0-1fa2-4a5b-b00f-2b49336c3e28", "comment": "Malware payload (Prometei)", "value": "d322a4bb935ca14a6656d588552a71e8e31c76836126d90b8ae8f4cae13436d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038180, "uuid": "876f5b50-287f-4c9f-876d-573331f550e4", "comment": "Malware payload (Prometei)", "value": "20a9e8d94fce8b1b1b9b45427bd2d0d90b5e2dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038180, "uuid": "57a5e3ef-5ae4-4350-be4e-c3308524f184", "comment": "Malware payload (Prometei)", "value": "3ad529062800deef84818544e0be7ded148415ee8936858bafe9396063043befd2502e6de45ba2f05cdd3bf7ec91f9a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038180, "uuid": "0f0eb3a8-642e-46a3-a330-d3dfcfdbce52", "value": "T1459423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038180, "uuid": "729668c6-1e88-4f92-896f-1fad7f189dc6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgG:25WOSACZSV6eKRH5EPiamb4DsDwwcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038180, "uuid": "bf5233cf-7b9a-4527-8499-b0eef5937eaf", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038180, "uuid": "f7f86bdb-1e52-48be-9995-d61505c41cff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038180, "uuid": "862a7d0d-0696-4056-a99f-cbfcc026b693", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dbfb2f-13b0-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744031088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031088, "uuid": "e25003bd-1920-4d69-9bc7-b59faa55e8c1", "comment": "Malware payload", "value": "6bfc93f5ac980458a53f79ae3b36e05c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pniu-fun", "colour": "#DA1AAD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031088, "uuid": "a2d34ba2-3d46-4d15-ad6b-509ef560b7e2", "comment": "Malware payload", "value": "d40c00dbc6974e6cfd7e8d7ad9c918d873bb25ef1639cda8c41b3ed8d7623e7d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pniu-fun", "colour": "#DA1AAD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031088, "uuid": "887641df-0dae-4ac2-9e12-d3a972329c0a", "comment": "Malware payload", "value": "809cd2dda54e96a7653606d931d49f209821eca1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pniu-fun", "colour": "#DA1AAD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031088, "uuid": "240db50f-e199-487e-88bd-94e2715de38d", "comment": "Malware payload", "value": "630de828213fba95b6d4756d300958ef2959b91ef3a49f9b86d74baf9bea86507f184b1d0172cfa87ed6d6f6d9af20ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pniu-fun", "colour": "#DA1AAD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031088, "uuid": "2184fca3-73c9-483c-be75-d30bb38726ed", "value": "T1201833D27D4C00EED32A93356A09A57EF2BC6C72B63A418753C7F719AD32642BE0055B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031088, "uuid": "8f6803ea-c825-41af-ad66-7f7926a9c446", "value": "1bef14787409786a51680eca17b51a42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031088, "uuid": "2be9e5d1-c40e-41e4-94b8-404c383b95b9", "value": "1572864:/eKrHy9O6GOEjPcWXlrsxW73B/ecehcHAKXLFdtSEnCnYJcwRoKwwSE6t0WF3:RHF6+jrsxWocsQXJvZJcqwwwWWF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031088, "uuid": "2a836820-49f3-4720-8d20-9cd5d6b72599", "value": 90231528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031088, "uuid": "11b76e64-d98f-46bb-99f3-9147a2e5fc58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031088, "uuid": "62cbce9e-c6a1-4f8b-83d8-ff853c5e7146", "value": "Update.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c87976c-13a5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744026165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026165, "uuid": "655826da-4034-4aaf-8cd2-d2ad0e8420b4", "comment": "Malware payload", "value": "a821b79837f305f2e4c98f21699fdd9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026165, "uuid": "89d7cf40-045b-4648-99b3-c78c5b7ecacc", "comment": "Malware payload", "value": "d4382f5c64dc50a4e9e51636ddbbc755c8b8fcce4591ca8267a6fbfcecc740fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026165, "uuid": "2dc13d62-99cd-4fe6-8872-d303864be771", "comment": "Malware payload", "value": "cfc2146ff79beb55500bf8e933f0678e41271265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026165, "uuid": "9dc5413d-baea-4a52-89c2-1d664e00a0dd", "comment": "Malware payload", "value": "67de44da6a25b2f859696e6157da32146dc04a36a08f6c0360b0e67afd2ab4109e7ebdf9699188237039ad899e5813f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026165, "uuid": "9c6fdbab-7633-4682-949a-a91c34fab6db", "value": "T1BF0302BE03D8DA75DEAC1B76C31AD1EBE4C9CA4396CFF2E80740896C2C1374A5853845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026165, "uuid": "fa7bc35e-96fb-4ff9-8e93-0b1e62d5b6be", "value": "768:49agnwqJ1CMT2BphCc14qly8GhXQwXwATw4ZWnYjHJq3/gypcy:4IuiRCKM8UwAT5ZJq5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026165, "uuid": "525585e3-1e39-4372-bb23-2920bf810e04", "value": 38468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026165, "uuid": "7353fdf7-194d-4d6c-8e00-b77152ba171e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026165, "uuid": "42ab5a43-f409-4729-871f-32bf6067b0f4", "value": "hanoi.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3a09be-13f5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744060684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060684, "uuid": "98f2d29f-d45e-4f7f-89ed-050282ebc5ec", "comment": "Malware payload", "value": "5f9294f9175575505c123539858116bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060684, "uuid": "674e5ad8-e2ba-4c3f-a6f4-4059ca167e03", "comment": "Malware payload", "value": "d50e9a3f0f724d3f09e6e59d7bcd08320f4417b1c9ae0b1c0eb4153df988c441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060684, "uuid": "7d0f4625-8941-4ed9-aa85-56e74a16de5a", "comment": "Malware payload", "value": "1b3879dab68da53e7983c034670fe1d5ffb2fec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744060684, "uuid": "ff68b470-b880-447c-a6ac-912f7d3e0bfb", "comment": "Malware payload", "value": "6969395e066142249e2fc15adfe2d50dfa04415467deba18f0efa64574413a4cc7df15d07f98955ad82271e964cedb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060684, "uuid": "cf89e7b2-3970-4319-8b2e-903e3404781a", "value": "T1F5D4BD114ED5C55BF01DB97A50BD8E66BA4BC02F070B2BC3AEFFD0A263689B01816D75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060684, "uuid": "e6de3182-8500-4979-b6f7-78e39a2b500d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060684, "uuid": "947d777f-2fa1-45c9-9b0c-2ba2c6830f31", "value": "6144:sKHKBZxa+C/XYkdAr3YVraBIswWG0nIZHaGqQV3KmrN1Tk3UiGxTKOqti5Fhri38:GTx2YoAr3YVrbFWG0+qSrNS4KOqUAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744060684, "uuid": "54cc9d39-066b-4ed0-b781-d54e76839d4f", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744060684, "uuid": "9236568b-916a-491d-9523-22b66c7010f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744060684, "uuid": "2588ebb6-1236-40d2-a87c-395fac9eb5ff", "value": "MemesenseCrackByPugCheat!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4babc9b-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload (NetSupport)", "timestamp": 1744050741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050741, "uuid": "30cfb105-4767-4715-ad72-4aace0d1ed3d", "comment": "Malware payload (NetSupport)", "value": "fe290c6da721366cbc2f724ec3591cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050741, "uuid": "3908f728-6175-497e-b101-09cb4888fbad", "comment": "Malware payload (NetSupport)", "value": "d55b2dbdc471d6c66aae421174fde5a052d1814e436744290d788f88b208ae48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050741, "uuid": "bfb879bf-c431-4ff4-b99d-95dd4d128086", "comment": "Malware payload (NetSupport)", "value": "b3acd3d32e8a29a097532496d894d8bb448e32b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050741, "uuid": "277309b5-f2f8-4fec-973a-fc665ddbf94c", "comment": "Malware payload (NetSupport)", "value": "682dc4f2ea710e0731fcf14f8668b1a21041d2be2eade7fd223d548bce4d2fd4c5e00033e204969263e19d5decc89940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050741, "uuid": "4ea22f5f-67a7-4f39-8e90-90d0f4ee4e8c", "value": "T13576331039C996B1D573293B8378BE15B87DFE207B3588DB53646E078E229C19B30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050741, "uuid": "05a31543-6a92-4158-ac88-d9ce6bb77a5a", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050741, "uuid": "cc524a0e-9cdb-4daa-a030-d12165ba546a", "value": "196608:JxpiMlGJQaY8TknzMjqCtrChb82ByedmxXwA:JxptGlknzOqChChb827dmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050741, "uuid": "44201239-e084-459c-9109-dc3226a9cc1c", "value": 7139150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050741, "uuid": "3f9bd32d-60ab-427f-bdc5-47ccb7aa36ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050741, "uuid": "ad26783a-e478-488a-adc0-6426b6190584", "value": "fe290c6da721366cbc2f724ec3591cbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372efaba-13ce-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744043685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043685, "uuid": "0750766a-7c31-4867-b363-1c24a4f21431", "comment": "Malware payload", "value": "58b5e99f3ca24a9b9bbbb91b4b32c8d3", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043685, "uuid": "8bba251f-1433-44ec-87bf-9471930bfb20", "comment": "Malware payload", "value": "d59cfc669b3b5a79d419892724b07aa56e871f55b239e77cb991f90f5a9ca181", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043685, "uuid": "1e8d9d62-b9ee-4e02-86e8-0a2169b12d37", "comment": "Malware payload", "value": "1e87f6aaa97be8d26188af925e8826462cf4371d", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043685, "uuid": "c6f3b160-634c-4faf-9ee9-276d1e202baf", "comment": "Malware payload", "value": "3c8adeaf6a059da1f0083e17eb9c86e547472def41e331e7f15db4cfc66827189942c24738e51ed5ac6abf483b7f136a", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043685, "uuid": "857697e3-6032-4be1-87cd-561c4de7a01b", "value": "T146D4227381E03E3CD42D5AE7A4573134B8998D0B8BB0B5E4586B47DEBE4094E59282FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043685, "uuid": "14b6e3cb-eda3-4a4c-a1b4-8804de4d76e1", "value": "12288:QTGmMASiXccUAIv0j3+G2yixhN+5ZbLlTx+dmblMqWW8qak5NoI0IsmM:QTMu3Ei3+n/hN+/bLlwAblMcase1IQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744043685, "uuid": "d859f5cf-5678-4a8e-a046-63ef19f1f0d8", "value": 637416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744043685, "uuid": "1939e52b-08bc-4149-8c4c-5b185f88be7b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043685, "uuid": "8f7a5ad9-73dc-44d7-94f4-c2c4fec92591", "value": "SCAN_0000070425.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5577389-13ce-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744043870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043870, "uuid": "f3ae22b6-ad1a-4fbe-83fb-83c85f7fa8eb", "comment": "Malware payload (Prometei)", "value": "06014765f3b48c7ea205443007b2a79c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043870, "uuid": "2bff63c5-e4b9-4949-930c-a12d7d4fd9d2", "comment": "Malware payload (Prometei)", "value": "d6282f8c3ba7822dc5f9d0b1b82c45eb7145a2795d51a160c789c80cb1f0df35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043870, "uuid": "1598e0c6-5357-4e84-9df3-c26d653e01ca", "comment": "Malware payload (Prometei)", "value": "0c8d4109ce382c42e9036bfd899237eacb8f6ad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043870, "uuid": "25f3c2c3-f2a4-40e8-9b25-9c90dab6f882", "comment": "Malware payload (Prometei)", "value": "f1d56273685f15c7c8ef157400aabc83e8700e27529b66e8ec9ed0c584937f27954df452f25dcef08ad8a476ff17d0c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043870, "uuid": "53fa3dd6-4bcd-4f62-86fb-b79a020e6f26", "value": "T1FD9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043870, "uuid": "a0c9a320-e55b-43c1-83d9-6e603625778d", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg/:25WOSACZSV6eKRH5EPiamb4DsDwwcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744043870, "uuid": "45ca2f0e-d85c-40f2-abdc-de56b370d720", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744043870, "uuid": "1c2cc245-3c58-4d45-a6d0-4a26603ef7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043870, "uuid": "06eb5560-e7cc-4105-94e8-cc4aaf70d141", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42d4860-13f0-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744058498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058498, "uuid": "af9cd728-fe38-4d72-927b-a7d1def8683f", "comment": "Malware payload", "value": "cc1988650b5fe3e0dfb8632a77b2a9ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058498, "uuid": "0ddd7bfa-6cfc-4166-9aa5-da796affc53a", "comment": "Malware payload", "value": "d63135791ebcbead27ea97784e9076963028508ed4c26f454c24479ded5a71aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058498, "uuid": "0d3dcca6-fd3f-4ffa-af8f-9f049550179e", "comment": "Malware payload", "value": "b351a37e2e7c8ed6acdbfb2801b3f0160a8c7876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058498, "uuid": "f6eb581d-fd3b-43c7-856c-689db93135b8", "comment": "Malware payload", "value": "f91bb90a5fa16c0864500bbf4184c86595167a5f0ef028606be48a2ec690a9c2a42580f23d00d90f0308e98a42e06886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058498, "uuid": "d6a04acf-b3ba-4cc6-8d9a-3925c800ba3a", "value": "T10625CF26619692DAF59640B23B48A2707473F963833D5BFF80F4E325194AFD40B3E729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058498, "uuid": "0adc07c9-5d21-4bf6-a335-0272ed0e741a", "value": "b2c200f5e4fd63f73dca30ad3ac2c240", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058498, "uuid": "53fa2857-0de0-49d4-ab57-da3ec7d9a03e", "value": "24576:BulIExtUXbaVQfcZe1MEw4nvHloxA2I1I16Qq5G:BuyExtUSwcZu7vYAjIXqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058498, "uuid": "b3d0b494-9454-4826-b28f-3682555aef0e", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058498, "uuid": "05741f67-786e-451f-b3be-20f3633f4fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058498, "uuid": "62c8198c-35b1-4b07-a6e3-0132b7369ac3", "value": "SecuriteInfo.com.Win64.CrypterX-gen.3190.2103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e42df1-13b1-11f0-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1744031286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031286, "uuid": "c988ee53-9e87-4de7-a005-0b10f01462e6", "comment": "Malware payload (Hajime)", "value": "239841698dac42393d8393c9e77f7d69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031286, "uuid": "0a6d172f-e266-4a67-9eab-23c4de0c5ffd", "comment": "Malware payload (Hajime)", "value": "d6566a9e7a4246fb78c5f2cf9a0008de023059b903050924211c383fd0afcbae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031286, "uuid": "5477590c-6748-4c84-bcd0-bb89779db927", "comment": "Malware payload (Hajime)", "value": "35bc4d49114de4cc3b5a803a1e5357e80bc410ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031286, "uuid": "3cf1af27-2986-4e79-8a5b-59e2182ce401", "comment": "Malware payload (Hajime)", "value": "f26b974a0126244251542c287f4248cb8927bb0c88364dadd78e7bd68b161e93fccd46ec0989522c11695c874c6de3bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031286, "uuid": "a25d7038-d0c5-44ba-a16d-d9bb489e1d84", "value": "T11A33F18623A62FB2D1359DF5A7FCFF85A04A7D949FE61C0A7C213658B47135C28C8C19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031286, "uuid": "aa3b00e5-c48b-475e-b39c-ce8b08d7be99", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgsH:yYI0ARqw1qAEv7UIFM8oJorFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031286, "uuid": "451c5dca-0d0c-4db0-b4c2-405cfad7a8eb", "value": 50400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031286, "uuid": "28a86bd6-e6df-40da-ae0d-6631e6229099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031286, "uuid": "d07bc6b7-1ae3-4731-9d0c-6df9fb6359f6", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a5bccb-13a5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Weaxor)", "timestamp": 1744026119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026119, "uuid": "bf0a648e-a521-48fe-a29d-a731d45c9e11", "comment": "Malware payload (Weaxor)", "value": "4c74caa9c0eeb2c7637da9bbde9535d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WEAXOR", "colour": "#5F0C5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026119, "uuid": "1e9f616d-ae76-4a02-9113-9bd314f33242", "comment": "Malware payload (Weaxor)", "value": "d682d5afbbbd9689d5f30db8576b02962af3c733bd01b8f220ff344a9c00abfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WEAXOR", "colour": "#5F0C5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026119, "uuid": "d9a95ca8-ed24-41c4-8925-c76616b571bd", "comment": "Malware payload (Weaxor)", "value": "a10d8e59c8ea698349c073df06d509e958cd3333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WEAXOR", "colour": "#5F0C5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026119, "uuid": "834d052e-4d19-406a-aa7e-abc2ced8e963", "comment": "Malware payload (Weaxor)", "value": "ac94ca1048860577c2cec33efeef98bd71173dca85b69b1d96b9dfd3db6037207eb3f2d3a9d2b5f2dbf5aa08a6bec57d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WEAXOR", "colour": "#5F0C5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026119, "uuid": "bf2a048e-ef3d-49f9-b4d3-a6c82abb8128", "value": "T12FD47C16A2A800F8D0F7D2788A524916F6B7784613719BEF03E146976F23AE45F3E731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026119, "uuid": "5fe4a0c3-b442-4dac-9eb6-4ca7619b95ab", "value": "75fb6e3e6fea3482837cc877bec67d8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026119, "uuid": "def472d2-edb5-49cf-9b52-837c75fff309", "value": "6144:22hL5U1VUf8mNFy68PBhY3hqZuI0eJSsVGNfRwLYCvI5TDCDgfBoO55k+Js/dvWq:2EL55NFz3poPYIMHCDgWObyh9LZuoVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026119, "uuid": "5770ada9-cb58-4ba4-9308-0c59effdb22f", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026119, "uuid": "384bee97-aad1-4759-ba0a-4beb27de8259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026119, "uuid": "3a9b95fe-6e1c-4cf5-8436-23464a8179f9", "value": "d682d5afbbbd9689d5f30db8576b02962af3c733bd01b8f220ff344a9c00abfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d90268f-139d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744022570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022570, "uuid": "6667da42-f5fa-43a7-8527-b3e5c40a9ee6", "comment": "Malware payload (Mirai)", "value": "e0b1d4f5b13d3a47d634b45d2e1edb8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022570, "uuid": "8cd67003-70b1-4583-b1d2-e799b7f9b9aa", "comment": "Malware payload (Mirai)", "value": "d7609f844fe29a533430b66c225a2ca55cbda45204fe392e9f0201305a53c3d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022570, "uuid": "bb0a2226-3fba-4efc-a247-c37fd269eddd", "comment": "Malware payload (Mirai)", "value": "721c09fda2556b440ed5f9ad87237503f24c09d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022570, "uuid": "e7769246-79fa-4992-b279-5f68d7a0bee7", "comment": "Malware payload (Mirai)", "value": "b2c312ed195df2d5981e1c87db19ac13d67067df0d1e99c4b7c5c00c2533620ac89b749366e962ea6ee2b32ce292497a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022570, "uuid": "2f4db254-346f-4b04-8207-65da5816f9ab", "value": "T10F739F72F4002C91C96214B4F4ECEE740B136CE552D95C729DEECAB618B3AEEB548F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022570, "uuid": "540167e5-85c9-43ae-a08b-847e6b80575b", "value": "1536:8DMDSiFa+lgKOdHtkR+Vnor8XsPR/Udr:8DMDSIXaRkuo9PRUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022570, "uuid": "81025a18-8df3-415b-ba34-99079d2d72db", "value": 74972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022570, "uuid": "7b4538d4-ba8d-4aa6-ae8e-d4eb91d9c551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022570, "uuid": "9609e41c-0893-43e5-95e8-2ede8f9874af", "value": "hanoi.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43999154-1383-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744011494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011494, "uuid": "a02f5aa6-fd23-4b82-b40e-7297aa05481d", "comment": "Malware payload", "value": "82141637e78fb1d7ee8c5ab7c879258e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011494, "uuid": "d7c2afa1-3ef2-4904-b3a0-4752218ab6bc", "comment": "Malware payload", "value": "d84c092cfec130d89dc202f3a96dc671d789458db8ec1f17ce70c2f23065446e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011494, "uuid": "9153c5ec-72f0-4275-8ce7-37ee9fe42077", "comment": "Malware payload", "value": "f81d353eb18113b5c18ab00439bff492d7518753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011494, "uuid": "7b2dc239-53ef-4993-a376-0054b9758daf", "comment": "Malware payload", "value": "9c330acfb1a77334c7d54092e5a27ecac1a05d060268b065d0afffbe3e29e6c7031e9956bd65bf6e1410f66ef19de549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011494, "uuid": "0f93ec7f-9dee-49b7-9ae2-2bfb891b3b47", "value": "T1C23459217C81C432C1B31A30C9E5D2F169787D708E658A8F63987F2F3E771926625EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011494, "uuid": "4d9e3f88-63e4-4de6-aa79-251895c0b535", "value": "9d4745b4b8ed18dda7e4fbf0015900e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011494, "uuid": "467adf5c-e9c5-4ec7-8570-ca22c5c03b47", "value": "3072:E8y0es/5skqFTMv4hQC2mC4UAONfvoxPQc5VAACDMVg38qA2KGEF+KnVW8itdlMI:zb/skqFTqJHUPQQVAA9TUtXFWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011494, "uuid": "5c54d02a-2d5b-402c-9471-df567107996c", "value": 231072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011494, "uuid": "893a8f85-326d-4ab7-addd-44852622110e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011494, "uuid": "c0e71bbe-c191-4513-b956-fddbce0e53f8", "value": "d84c092cfec130d89dc202f3a96dc671d789458db8ec1f17ce70c2f23065446e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8dfd7c-138a-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744014487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014487, "uuid": "a34a24b6-069f-469c-a17a-c1ff400b8269", "comment": "Malware payload (SnakeKeylogger)", "value": "9aaf54e6eb2d0254da7ccb03ab2ff8c3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014487, "uuid": "8ebcd806-92f0-451c-bd46-13f6782bd7c6", "comment": "Malware payload (SnakeKeylogger)", "value": "d868240ec5f70a523ebd5d5fc62287bacb7899773a6693234875e9e28f370074", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014487, "uuid": "63f645ed-9511-4dc7-8c75-2e06eb952dce", "comment": "Malware payload (SnakeKeylogger)", "value": "0cde9121d9a5ad63b1882328fa6447355e5b2e38", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014487, "uuid": "4410c05f-1408-45dc-b1fd-131bc4799ac0", "comment": "Malware payload (SnakeKeylogger)", "value": "6c5d3abd3979239809f8ffe8d2610801b6c558c9ede5053e57a1f87b9e52d502ceb3ac8e1235d1fc8bdbb3321f295efc", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014487, "uuid": "abc42dbb-ef35-4d65-a251-2a185facf1d7", "value": "T1B4F423F7747DD342DE9E77C832618A80501371DE4DA0425CABB447A6523A6EF383E26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014487, "uuid": "38b56356-55e1-47f2-869f-6d0259fd7ca0", "value": "12288:Qi66DVvEloYln0OZ2uz5BybFNaTplj5fG7KxjdQJHRjCzDICYxC95p31O2vd0G:Qi66DV3Y6Na5VplapJwzUCYCjNd0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744014487, "uuid": "ba1fb037-fa82-43a4-9ba0-102d774c9b92", "value": 735593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744014487, "uuid": "1a76389d-6063-49a4-938f-e52986a1c29b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014487, "uuid": "9d5ace39-01a2-4b42-87f0-266a41412e4e", "value": "order OC23329258.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042402be-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994637, "uuid": "2730db50-b632-4e3e-943f-41f58f685c85", "comment": "Malware payload (Mirai)", "value": "8890d55506e7075bfaa81d2b85f6ed51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994637, "uuid": "a7608789-7e8c-40b3-8b0b-8d2b5e69e603", "comment": "Malware payload (Mirai)", "value": "d8817eaa70a66c8792c7b79625dda49c75e4f4d5cc26d40e48b818f171053ac2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994637, "uuid": "8b8c74dd-c084-41f1-8e22-5bbca655d256", "comment": "Malware payload (Mirai)", "value": "06fa629e4c359ce59d036bb0351f80c4331bde86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994637, "uuid": "173e0978-5f23-45c3-953a-4fcfec606e36", "comment": "Malware payload (Mirai)", "value": "84bd8b06cc0a5b5e317312bdce3ba01b3990c6bc1828c5ff92b2d34f3861f4ec69b5af3cf83eee5abbb10160ae74cab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994637, "uuid": "787a089d-f89a-4cd1-9f1e-697404f369fd", "value": "T15F731B9AB981AB15C6C1557BFE0F014E33138B6CE3DE73129D286B7477CB46B0E2A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994637, "uuid": "4f41f37c-ebdf-4dc2-93ce-142216d8703a", "value": "1536:uRnMKzQXzUd/TwNlT+anGcsIbiHoku6mv9Lx5RYv+05:DodkT+akoX6mv9LxH05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994637, "uuid": "f4522c4c-8317-474c-9932-4de594f39954", "value": 75052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994637, "uuid": "24f4c8d1-10ff-421b-ae1c-f8ab1977f6f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994637, "uuid": "03392201-4a06-4a05-b1e8-9ccd504f38aa", "value": "resgod.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729e66a3-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049369, "uuid": "b1fd43d2-c5fd-467a-80f1-7c7918f10f93", "comment": "Malware payload", "value": "6a7b74d11bb4764d68437955fa0760e7", "object_relation": "md5", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049369, "uuid": "ac2d7010-7831-48e8-8d79-35a1e5a245bf", "comment": "Malware payload", "value": "d9343e0e9232c62bff651c2e6fa09c80d3a90faf00537d4da876e1a8d4223f10", "object_relation": "sha256", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049369, "uuid": "97d2445e-28b8-4903-a4a4-a5fa30175d61", "comment": "Malware payload", "value": "2c06c01f9261fe80b627695a0ed746aa8f1f3744", "object_relation": "sha1", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049369, "uuid": "367013d5-aca4-4a73-a18c-91229c66f42f", "comment": "Malware payload", "value": "1e1f7a16097912ea47efffcf1c10deef5c59944a7fb1f1237d04b37acc18bfb4676b298390e05b9e04ee48724e3ff589", "object_relation": "sha3-384", "Tag": [ { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049369, "uuid": "0865698b-0b12-4ca4-b3a2-d65bc5999f6a", "value": "T1F214D0773A85F859C681DF758CEB82169255FC42DFAFD943374EB3290EF2984A05A803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049369, "uuid": "5a965174-01f0-4963-aeb3-fedbfaef1387", "value": "3072:nqZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAPBkkYLyn0lm5mcrYZW/IgnuorJGI6ID:qZ+RwPONXoRjDhIcp0fDlavx+W26nAPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049369, "uuid": "08c90171-e284-46a2-a5e1-73ba86de172b", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049369, "uuid": "43091968-5fa7-4860-802c-33975fc2bd55", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049369, "uuid": "fbf13d4f-73db-482a-9020-95964361f586", "value": "d9343e0e9232c62bff651c2e6fa09c80d3a90faf00537d4da876e1a8d4223f10.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86542579-1390-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744017189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017189, "uuid": "7c5a6895-62e1-4a25-a1be-527340c8ed37", "comment": "Malware payload", "value": "6e480846dc31a8504c141376009a1518", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017189, "uuid": "f0f80bb0-487d-445e-8450-42fa852eee99", "comment": "Malware payload", "value": "d9d4460669044287070f81fa6a49d46d0a5d9e9763676a26f92577cf8386e66a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017189, "uuid": "50b9e31f-20cd-47c0-9c26-5fd9c171bdbf", "comment": "Malware payload", "value": "a50863b70bf0858d0328bf922f420275561936f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744017189, "uuid": "1c8b571d-9b8c-4acc-8e64-749f68dcf321", "comment": "Malware payload", "value": "ee847d3bf1a6947b10417e3e8f5c1221d8af57945fc5abfee82b6fa6c2a195b0abafdcf88d4d3ff5c253b54d90f36204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017189, "uuid": "b31c274e-4b7a-4274-81db-8cd5d33a9590", "value": "T10E82D741F38802A7D4A2477AAC75634003B5EB69B65ECF5B60B4750A9C733D30A72F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017189, "uuid": "feadb9d1-e161-4af1-9dba-c892215a96e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017189, "uuid": "1ac69882-2bda-4975-937d-7b2aafcd26cc", "value": "384:4jGpPqljbwUqOpcpneAzATIpnOxzw9T93ouKuFTuhK:CKhOpDYVFxFahK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744017189, "uuid": "fba13c40-f9dc-4d80-a7d4-6a357b1cab6b", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744017189, "uuid": "8f96b8c0-bd38-407d-b787-7e08b8affd47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744017189, "uuid": "3b05a326-0e51-4197-8a94-7bbc57fe157d", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.1137.3896.1326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4d00fa-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744034354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034354, "uuid": "351c53d0-2bab-415e-a7d9-fc518a6cb1e4", "comment": "Malware payload (DarkCloud)", "value": "0e231e1b17eab283bccebfe08a9b7f2a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034354, "uuid": "e788b067-7ef0-4d4e-85e5-521bffc2f8ea", "comment": "Malware payload (DarkCloud)", "value": "da27581b9067d2fd36a516fd0ff1d8c04c01d809bf2a2ce12bc11b94ce43725d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034354, "uuid": "7c9374d3-36a4-4d6d-bd51-9aa39bb3f763", "comment": "Malware payload (DarkCloud)", "value": "1caae9f848f31595eb19bd789b855b4f310da1a9", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034354, "uuid": "0b89d5a8-fb1c-4354-b952-a8952e1962a2", "comment": "Malware payload (DarkCloud)", "value": "dd04e5bc1f6da8810fe4104963a3b3c70869790dbadfd10bfe1e793f19ee84527c799f932b753b3fd8d4d92f538bad9d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034354, "uuid": "6d1db790-c432-4aac-8f96-f85b99589dca", "value": "T12E644B11ABE88322E6EE17B4E4B106044BB1F987B57BDB4F5A84A1FA0C537505E2137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034354, "uuid": "d43cb04f-0c4f-410f-8356-1a633159c94d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034354, "uuid": "0fe56c3e-c011-4adb-a858-e2b93f71dbcd", "value": "6144:4klU/e8FFql0FhdZYW3fRWLrLyfPCpI/1vLChOy6UAHJyi:4klJ8Fe0Fhde2gLHySeNo6UAHJyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034354, "uuid": "eafa2c16-9649-4e10-aa76-738cf348ad75", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034354, "uuid": "7f9d490d-fda0-4a59-9bfb-226c8ce2aeb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034354, "uuid": "e05e8a98-f257-4372-b810-41fc70cefa08", "value": "da27581b9067d2fd36a516fd0ff1d8c04c01d809bf2a2ce12bc11b94ce43725d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8de7c0-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744050778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050778, "uuid": "de6acbbe-155f-48cb-a03a-aa46613d1655", "comment": "Malware payload (Prometei)", "value": "5ef53af581c8bd435c8493997ba09bc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050778, "uuid": "5767ecfa-1503-4eca-be45-e25cea9d9962", "comment": "Malware payload (Prometei)", "value": "dbd54ed0f10e6263e6cd2e6781ebf7b1d36f69ffc2d96d012a7875f4719dad08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050778, "uuid": "c67c446c-1fbd-422a-aec5-048c9a6bffd1", "comment": "Malware payload (Prometei)", "value": "69e51c70eff5cf810b40269c4bead20e62499bb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050778, "uuid": "62bef4a0-e88d-4de6-ab2b-27233bc24b01", "comment": "Malware payload (Prometei)", "value": "885fc5b0669370ccec488e14f7d7d254e755b2ea7a4c3e8d3d8922f769ec81ae254fa1b8ae3a106df8f760c08841e0a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050778, "uuid": "d080026b-033d-4366-a6fa-45268d3f64f6", "value": "T19B9423F8C87D2E3098169F3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050778, "uuid": "4c1950cc-b444-4b95-a008-6c77b61e27d7", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg59:25WOSACZSV6eKRH5EPiamb4DsDwwcJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050778, "uuid": "9a0ff9dc-d3ef-46f1-a0ff-38843d481877", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050778, "uuid": "da1a78c5-8042-4353-9b29-4d49d006cc00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050778, "uuid": "ceda2ffb-e712-4eee-8970-e71c45ff209d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16bfd68-13e1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744052051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052051, "uuid": "347ce229-24c8-4081-9297-c759307bb551", "comment": "Malware payload", "value": "bb255da02849a18854f92349ec6c4ad4", "object_relation": "md5", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052051, "uuid": "e69272af-0361-47c8-b226-1864dc35eeca", "comment": "Malware payload", "value": "dd01a6fe608a5e0252d76526c7ff35150ccde448f638b1c47b7abca00dfabe77", "object_relation": "sha256", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052051, "uuid": "4f167745-bec4-4212-a0a2-c07522b40b1c", "comment": "Malware payload", "value": "255691db29adc2bb11c26381221e945295204a75", "object_relation": "sha1", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052051, "uuid": "5cf1812b-2d13-4015-8063-da569f8ff2d7", "comment": "Malware payload", "value": "2cb8cd4db6273152be97aa2cbfd2ee8880ad56a1c46bc6b9c54f8e989be3e8ef5ae91b94675e3c87eff082567a762d5c", "object_relation": "sha3-384", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052051, "uuid": "6790877d-ab76-4bd2-ae1e-ed0777371e35", "value": "T192C53305CF01425C4669ACADFC8F8C1CA599ADE5374CD4330BE6E3D4C5BE6AD1EA40E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052051, "uuid": "6409bb4e-7351-44b6-8820-a7c237557de9", "value": "49152:MmgXC6SEmur7kOGWA8EkcRq6Xhs1Xg1TlcTcb+H5MvdQ8NSGGHVlp8Tvi:M269r7kOGWAzvXyRg1Tl56ZZ8wGuVlpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744052051, "uuid": "d1e88d83-3c37-4aed-83a3-ff09cd6151bc", "value": 2656771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744052051, "uuid": "1873702f-a057-4dbe-810b-279ddc2cf7ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052051, "uuid": "37a337f0-19f1-4671-9b09-0c5c51661d6a", "value": "nfe010425.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010281f4-137f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744009664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009664, "uuid": "2d178ebe-d8e3-4445-8236-5b73f224016f", "comment": "Malware payload (Mirai)", "value": "72e927ed67f8e7fd40923aa3758f4270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009664, "uuid": "8ee7bee4-7dcd-4b8d-b232-819525ea511d", "comment": "Malware payload (Mirai)", "value": "dd2156ff311974fc3980c3b87b5237f29dcfaead933e07b35e95b94483dce5cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009664, "uuid": "640374af-f95f-4fcf-98e4-905dcb032b3b", "comment": "Malware payload (Mirai)", "value": "2ca9088851d3e3d87b35e40523b77cdf485c664c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009664, "uuid": "e3d86df1-7515-4a54-9e51-c2d220438695", "comment": "Malware payload (Mirai)", "value": "e7bd5976a0a67c232d2ec1feaf84989868da2757d5b0bb219dcdef7da037b77d3c3a5bf26b2d9c8b5e51f8d58200957f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009664, "uuid": "e475e5bd-bf35-4e3e-9d88-2e3fcbc5a538", "value": "T14004B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009664, "uuid": "9925b3dd-f880-4f26-a71d-686ea590b05f", "value": "3072:nKpzG3eNkSfcQqmav8SqaRVlnYz65sVt:nKY3eNYQqmeqavlg65s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744009664, "uuid": "090fde4a-74ab-4f13-9828-595acd2e3a5d", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744009664, "uuid": "75b39e7e-0b0b-420b-a6e4-794a1f0d2595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009664, "uuid": "2ae420ed-6540-493e-b7df-9ea14aa21d65", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c4fea4-13fd-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744063812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063812, "uuid": "5b34faec-30ae-443a-93de-aef338d4fb3e", "comment": "Malware payload", "value": "58276678df8173d376cb8b48451a44d7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063812, "uuid": "22235567-20c1-47ce-8cba-a9b5a05d5afe", "comment": "Malware payload", "value": "dd7782fbeee2a41a598159563965a8e220804a58c51c624af7953bc9c3b11852", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063812, "uuid": "b77ed1ee-2473-4fa5-926c-7dbda7601fc8", "comment": "Malware payload", "value": "295178be7612ea77f03db0746f9d2f7392220b87", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744063812, "uuid": "9137d06a-25af-4d9b-85cf-0cd956fe3c53", "comment": "Malware payload", "value": "90aa088d3176d097cc403492b4d846d76936971d73dec6f19c16f0b6fc8476f28077dc0c7654ca7fef1b6c055cc0e082", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063812, "uuid": "8dca54a6-33f2-49d7-99d1-6910a9036a68", "value": "T1BED0C266268B5129321029C5D0BD714AB06EA146470A6C1239E580F59CB0CE25638C7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063812, "uuid": "1f21db3b-aeae-4f50-b6bf-cbc247462710", "value": "6:hcc+oABqzP9mbIBEQwuf70/Zw0VMkiAiou4yALf5CXhRCp+ou:vhAMD9mbIOtGsZwtkiAlLfoCptu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744063812, "uuid": "ff2ce61a-f2bc-44ed-8f18-886b547ce230", "value": 277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744063812, "uuid": "5cfbd543-856a-444d-8df9-26f3d126c10f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744063812, "uuid": "9ea76734-5850-411f-9b31-398c2cd5ea19", "value": "HEEHEE - Copy.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f43a1b2-13c3-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744038894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038894, "uuid": "e789d992-946c-49fb-987b-29f502de01e9", "comment": "Malware payload (LummaStealer)", "value": "f821fee0b2ef0759fa81a35e85a60670", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038894, "uuid": "10014776-6e89-4357-8769-be310fb0634d", "comment": "Malware payload (LummaStealer)", "value": "ddaa39d01fe0efbda9c00b4140cff7175e34565a67fbc34e91a1be1ce7479c5e", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038894, "uuid": "f76d8fce-483c-4b45-9cc0-0977ab73267e", "comment": "Malware payload (LummaStealer)", "value": "5a3a58bb12d182383878d798a895b4a73022a878", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038894, "uuid": "f91b3ccf-3d7f-4910-bef5-6a1f1e27cbb4", "comment": "Malware payload (LummaStealer)", "value": "e2f4adaf9b3eaf28ae44e6ee3038c8333b4f5ef59916aefb6e93838bdcff918390027bffcc6f4788f31fa834eccef6fe", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038894, "uuid": "62df28ae-9ff1-43bb-8bc0-c6cae7f01c37", "value": "T170B71962AB1131A3C45732B1A10645B93B354E21A71722CFDA8D3D9A1FBA1ED873D337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038894, "uuid": "c48e818d-7009-4daf-8a45-d9e9ca7e9477", "value": "f3795cbabe5b17ca0ff8bab74bf7bda9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038894, "uuid": "b28d9d5e-c5f0-4821-abea-64bf3516cf83", "value": "196608:FSsMUj43ZYkx89dD+cPLE7bUj43ZYkx89dD+cPLE7K:CU83ZYk+ziELE7bU83ZYk+ziELE7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038894, "uuid": "c3946317-514f-48e3-b88c-dfb28c2997e4", "value": 49197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038894, "uuid": "650c9a69-5d69-4305-b6cb-638499beb0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038894, "uuid": "2ef3e867-c46c-4f2f-b449-532e258403ee", "value": "n8_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9641ab66-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1744034396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034396, "uuid": "c2b1ff6d-9135-4bbe-8371-89eae63109c6", "comment": "Malware payload (DarkCloud)", "value": "111c327a73494906fcca0ea1135afae7", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034396, "uuid": "fdd50fe4-5adc-46e7-9da4-847dfc804435", "comment": "Malware payload (DarkCloud)", "value": "ddcb6ff5ce9cd75b9b7457b787b165000fab3bf4441509d5a1394983dd0bcbcc", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034396, "uuid": "2c0bb841-3a25-4bf7-8ea3-b29d82aab2e5", "comment": "Malware payload (DarkCloud)", "value": "49885ac1a4a0b9edc8c163031e9735d8863a9408", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034396, "uuid": "9f75ecdc-682e-49ba-96ff-612a86ec4792", "comment": "Malware payload (DarkCloud)", "value": "935ab505ebd9f8e6244e92aa36287cd4e800250e772cf7e1bd39503a950f3791998414a101b137bafc0a3a319db52192", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034396, "uuid": "93c77604-4246-4dbc-b66b-a210f2e51c32", "value": "T1E0A3F7177B8BC5B3C640577FE9BB690013A8E382B24BD70A394E275E5C077BB9941227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034396, "uuid": "d377b77b-695c-40a4-89e4-d07dae1c3f91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034396, "uuid": "27a90220-a656-48fb-8f75-2433a93aa481", "value": "1536:UxxZKHefxJbY/FQm+/kOdDD3zAYQmADnIbWvSxJ2159gEMOA:+Kxm7OmUIbWAI159/MOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034396, "uuid": "fecfba92-fc5a-42d3-baa7-c37aafa4d15c", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034396, "uuid": "0d6da001-c9e9-4db7-a11c-3446799d0d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034396, "uuid": "700939b9-4f90-4b0b-a8a2-843923087346", "value": "ddcb6ff5ce9cd75b9b7457b787b165000fab3bf4441509d5a1394983dd0bcbcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7580a45-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744038773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038773, "uuid": "cb99d426-f5f0-47bc-956d-2423779627e4", "comment": "Malware payload (Prometei)", "value": "277f17cc7320c2656a35f6fe73fa8792", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038773, "uuid": "1fdd9034-fffc-4719-806f-40329070d8bc", "comment": "Malware payload (Prometei)", "value": "ddcc0806f16eba9fe0180c3bc4488e9c5b84f7a0057ada6af4e811080c5d148e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038773, "uuid": "4126f139-3f45-4d94-a951-1c9dda86f5db", "comment": "Malware payload (Prometei)", "value": "5423350ec11f90d9e151b9dbde02b16699465985", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038773, "uuid": "e0385b92-d4e9-4c66-a3ef-01663507462f", "comment": "Malware payload (Prometei)", "value": "5fc6923620d4f5daf9196bf274b630e63781b8af235e30dc4adbbf0d3270764e52b6c39213466adb340aa3ea4328c5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038773, "uuid": "c704ba3a-2de7-4fd5-9516-c29d3e4739e4", "value": "T1719423F8C83D2E30D8169B3CBB5A826CF0E15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038773, "uuid": "2ac4a52a-8182-4444-b2c2-2566a5a8a508", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgF:25WOSACZSV6eKRH5EPiamb4DsDwwcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038773, "uuid": "52461720-07a0-4473-9b10-ef7ec607d5a6", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038773, "uuid": "2de40923-5df4-4ba5-a0a5-644c96322a10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038773, "uuid": "5ea569d1-7541-469b-903b-33c01a5d8c40", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09098b69-13a4-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744025569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025569, "uuid": "f6d734fc-c136-445b-ad20-7423fbfca9bd", "comment": "Malware payload (Mirai)", "value": "0bd98afe8fa98db0ba2d159cb3c7afa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025569, "uuid": "f8fe6c9a-65da-4969-a739-118a2e86ed09", "comment": "Malware payload (Mirai)", "value": "de57b4df7630eebaf11e869e8b942b32d677e3cdae932196156e9ffb13c33e1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025569, "uuid": "1d28700e-3bb4-43e1-99e8-72f54bc038a2", "comment": "Malware payload (Mirai)", "value": "1004f730159429c448555d0f85aedec955de4170", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025569, "uuid": "34ac7c65-66a5-455d-9bff-56724986d92b", "comment": "Malware payload (Mirai)", "value": "71b2beb56447cb0535634a422e091cd3042f12153b2545514384a02c243b671d1b7e032c73af6ae953336ad3b9306b53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025569, "uuid": "f3d6b62e-c671-4da0-9432-a0cb4841bcc8", "value": "T1B3931AC7F400D9BEF84AD77708934D1AB670F3E10A430A3667677A6BED351A5241AEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025569, "uuid": "3f284662-16b8-46bf-b16f-7ce7f21dbbd6", "value": "1536:BjfT/n0au8kqgZCQeuacWjcW0JcWcBQrEa7xPYVIVQr/FdRD/ngou:BjL/jkq+CQeuacWjcW0JcWcBKEauWGx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025569, "uuid": "b6fbcb6f-8db3-437f-a9b1-a47ed68297b2", "value": 88868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025569, "uuid": "ed7872f5-a6f8-4f3a-99b7-909f906abdc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025569, "uuid": "57455fb2-29cd-4ba0-b8e9-fddebbb0305d", "value": "hanoi.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42870296-13a8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744027384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027384, "uuid": "9c838fda-f31a-4112-a8cf-0310e0d91cd1", "comment": "Malware payload (Prometei)", "value": "de8db9d41a65ae193a004d096cd258cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027384, "uuid": "44f583db-d3f1-4b96-8e83-5b36d2f7a2c1", "comment": "Malware payload (Prometei)", "value": "de8d80fe14acc484088b717a4978b17f98e86aa4a5767002d0c7558bdb381742", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027384, "uuid": "3f5293e1-baa4-44d4-8e68-274efe4d91ba", "comment": "Malware payload (Prometei)", "value": "dd54b5ac93cf520279c66afcf0deeadb77d1f245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744027384, "uuid": "e280e67f-6172-4f0d-9d8f-d9e5725a0e0f", "comment": "Malware payload (Prometei)", "value": "85837c76a8d15057b6cd3c7c6ed76d6be15f7b5d314f3932633af6bb47829efd3a19b4715d067fcab98058eefe5cb506", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027384, "uuid": "68789053-2cab-4d55-a7e4-7590cfe80bd0", "value": "T1FF9423F8C83D2E30D8169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027384, "uuid": "7422bdcf-565b-4363-8e7f-eeababa2ada3", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg6:25WOSACZSV6eKRH5EPiamb4DsDwwcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744027384, "uuid": "a1cfe1a8-c501-454a-8e4a-69e50b35a6c1", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744027384, "uuid": "72f01d61-ba3e-4ccf-99a0-2a9f1c3ae926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744027384, "uuid": "15adc1bf-f9ef-47b7-8f51-c18a1e1db886", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5653f7b-138a-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744014664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014664, "uuid": "eb0d9637-9af9-4951-a827-365c4dd1f978", "comment": "Malware payload (AgentTesla)", "value": "5d599f172d2ada29f5012a57cfb77df0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014664, "uuid": "2f51eac6-bba2-418e-be7e-0b3a154ca214", "comment": "Malware payload (AgentTesla)", "value": "df94e5873b903dbde6d9a249f7fce4d71a7f60b5e5805b5c43ad5e81229ed41c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014664, "uuid": "02e283fe-5870-4559-9f80-acb79765e4cf", "comment": "Malware payload (AgentTesla)", "value": "a5720e0a9166b6981fd3d61aa5b60101ed45c9a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014664, "uuid": "7faa0c4a-4fef-4f3d-ad43-4f41ae1a8645", "comment": "Malware payload (AgentTesla)", "value": "39aa2fb47b06ce637ffc5768d3f692b33cf4aa329ccca405de755cfade4f235f0b76451c32a50061484e192493c617b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014664, "uuid": "4708c9a3-afc8-4eaf-af65-8eb89740e943", "value": "T186E423F382401AC06FB3B128878DD8B1734A5CED3D39455A2098E1F269E567D1BDADB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014664, "uuid": "35b420f8-87fd-49a7-9195-f7f92f59008e", "value": "12288:F1dcJI6AN6G3akdKHlTa9vH6I5ZbM5f5zwwdC2Y74JW6KK:F1dca7hIluvaI5Zw5fCR2Y7QZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744014664, "uuid": "28160f44-acfc-491c-93ff-879f3f6eda12", "value": 680007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744014664, "uuid": "6ff9c7f5-5934-4f48-ae27-e97e9b220a16", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014664, "uuid": "f7eef259-d6e0-4548-8204-b976679a689d", "value": "DHL Delivery Notification - Scheduled for 10th April.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7a348c-13f2-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744059450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059450, "uuid": "53ea57ef-19a7-4065-9412-220fa50fcece", "comment": "Malware payload", "value": "4f2458aa2b58add4567c5c6c3a14983a", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059450, "uuid": "5c15165d-31e3-4a3f-9486-436d94a9ece8", "comment": "Malware payload", "value": "dfa63724dafde66f0aa424330d7e2e9a15134bd877f9d41d09e8581419409d88", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059450, "uuid": "5c7dc614-b9cb-4a80-bea5-d4817c86083a", "comment": "Malware payload", "value": "b48b93428d0cf03e11acf39d66e5a0c2c9411b76", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059450, "uuid": "85b9c074-a4ca-4158-a956-806bfa639a1a", "comment": "Malware payload", "value": "3f15e727b36ab28a433953162380a86f6ca553e02223918bf3359769bc2ca1b4f93bf9ac594bd4e58204421acf40cf1a", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059450, "uuid": "9f0327cb-7b89-44c5-93a2-12009f50b193", "value": "T10855335116A988EFD5FF6540BEB2DCC8552F35B6FFDD168A80083370992E0267EF9281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059450, "uuid": "59dfe568-a7c6-4650-8032-64219402b78c", "value": "24576:OvlCZf7e3Q6OQ/QxTJ7ILzYlsRhjw6LCvavtxU6bJOt3ztV3lz/S:OvleRxTN+ke3eSvFJujzlDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744059450, "uuid": "c01ab5a2-f0c4-45df-a306-89963f01f7d3", "value": 1328994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744059450, "uuid": "16ed1034-da8c-492c-b02c-b051102bdfb9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059450, "uuid": "225fb74c-7a5c-49da-ae97-bffc0c699f70", "value": "stellar-data-recovery-pro-free-v1.2.5-alpha.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9ff9bc-13e2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744052578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052578, "uuid": "72195a05-6135-4038-88ae-304bf68114a2", "comment": "Malware payload (Prometei)", "value": "95ddf210c4ff120debb4c5a021f81490", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052578, "uuid": "bfeb7050-6a20-48f9-aa0f-1b7f2c4a22bd", "comment": "Malware payload (Prometei)", "value": "e0b6d71b34f1661b326251d6d5501b61d06e061f54c65039f39f49e4b6d049a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052578, "uuid": "d6ccc72f-37ed-43cd-80b6-8fb8bc84f1bc", "comment": "Malware payload (Prometei)", "value": "e20d5721bb89c5e5cc48814dda6c353caa101834", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744052578, "uuid": "b7b35f25-81d5-4af4-a9f1-a75ee85e7f44", "comment": "Malware payload (Prometei)", "value": "5a70db0b8e0d798ac6670c83f050eeaf181b7a0c4fda8585bbab3607f9d27eb836f7ef473d74fec43c6e0e5a881088f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052578, "uuid": "0933a2be-9d44-454d-b304-d6fd73260a79", "value": "T1439423F8C83D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052578, "uuid": "914615cd-9960-4945-9206-a681c76b783c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgr:25WOSACZSV6eKRH5EPiamb4DsDwwc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744052578, "uuid": "901a1e7d-4743-4575-8221-0f19351e1c16", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744052578, "uuid": "ba4e810e-070a-46ab-94e1-b2266dbadd44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744052578, "uuid": "9409bd70-7532-40f6-8d4a-8139f1ce58ad", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df9e97a-13a5-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mydoom)", "timestamp": 1744026087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026087, "uuid": "3bab4547-03ee-4585-b806-5e9e6fabba90", "comment": "Malware payload (Mydoom)", "value": "17166ab86116b21d6dfa7b83609e118f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026087, "uuid": "a01ceae0-f6ca-4b56-a8c4-4ef8439fd302", "comment": "Malware payload (Mydoom)", "value": "e17ec173f231d4744237619275d844c4b7f571f45316d2791b726fdf7459917f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026087, "uuid": "a165f15d-a523-4ae5-b152-95bff4452e0f", "comment": "Malware payload (Mydoom)", "value": "b0cfbbad85b04e3024c0925966b92caf0b24c85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026087, "uuid": "5b584e85-4733-402a-b4f1-85b86c807139", "comment": "Malware payload (Mydoom)", "value": "5f4fb190a0e0fe9ed3ae0f22d1ab747ce41078af84e13ffa95cabfb73a167ce15d37289f4dde8d95b2e4e412a1f63d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026087, "uuid": "88530066-c6e8-4d85-936c-6de9538fdeb4", "value": "T14AB47C45F26E8BE8D593833C89979102FEBA758517108BCB43944A711F132D26AFFFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026087, "uuid": "f10f3900-929b-4c9f-9c00-b818d4c2d742", "value": "592508915eae8e925921ea8470020aa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026087, "uuid": "f77c4842-ecf6-47f6-bd2a-7adcadef4147", "value": "6144:AoR8qOhgebFxrClsISKKuzXb3ZvObcdmXvT9dss4AnB2q1O5TbZyVjpnFoZWAnLQ:r8LhVem0XjZ549dvoq1Uujp/ASld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026087, "uuid": "5cede1d8-4e41-48a2-b49e-b3caa83fb3ea", "value": 519680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026087, "uuid": "a25f8e0c-4115-40be-bafa-e18ac6c6da3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026087, "uuid": "6796c469-25e3-4248-87ff-79c95c7ba508", "value": "e17ec173f231d4744237619275d844c4b7f571f45316d2791b726fdf7459917f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec1dddc-13af-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744030518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030518, "uuid": "eecb4fa8-f538-4ad4-a23b-628de7eb87c0", "comment": "Malware payload", "value": "33d04e8a112ad9209b165249f967cfe8", "object_relation": "md5", "Tag": [ { "name": "18-231-162-77", "colour": "#81ABF3", "exportable": true, "hide_tag": false }, { "name": "clien-ranchocentral-com", "colour": "#2469BC", "exportable": true, "hide_tag": false }, { "name": "extension", "colour": "#4800AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030518, "uuid": "bb9382fa-d795-491f-9311-5688b087ece1", "comment": "Malware payload", "value": "e1b09ac54179c487b68e25bd938b963b50e037639e4482488ee60ae7752434a7", "object_relation": "sha256", "Tag": [ { "name": "18-231-162-77", "colour": "#81ABF3", "exportable": true, "hide_tag": false }, { "name": "clien-ranchocentral-com", "colour": "#2469BC", "exportable": true, "hide_tag": false }, { "name": "extension", "colour": "#4800AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030518, "uuid": "fbde9bcd-40fd-4be6-9e0c-0ef9bea5efc0", "comment": "Malware payload", "value": "517176001dc749098aedc7be424eb0de3d8d4bd8", "object_relation": "sha1", "Tag": [ { "name": "18-231-162-77", "colour": "#81ABF3", "exportable": true, "hide_tag": false }, { "name": "clien-ranchocentral-com", "colour": "#2469BC", "exportable": true, "hide_tag": false }, { "name": "extension", "colour": "#4800AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744030518, "uuid": "9257c17a-55d9-4076-975e-ecc3a575432a", "comment": "Malware payload", "value": "2815e9a595eddd936ff6bcc776708b07ab3215aa6c96ba1287a94ee37c8f67fdfbaea5fdcf48d308d6a3f287a8df478c", "object_relation": "sha3-384", "Tag": [ { "name": "18-231-162-77", "colour": "#81ABF3", "exportable": true, "hide_tag": false }, { "name": "clien-ranchocentral-com", "colour": "#2469BC", "exportable": true, "hide_tag": false }, { "name": "extension", "colour": "#4800AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030518, "uuid": "6873dcde-a222-42e9-9067-db652cd0ebda", "value": "T1FEB5AE11B2C6C236D16D0176E999EE0BA639BD73073046CB73F4797E1EB28C1963A712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030518, "uuid": "dc1cbaeb-d9c9-4208-9088-9119665f2525", "value": "49152:1VYyx8g/F7DP5IeWK9YwPhH9D+05jvTleHBG5q7v:j/tqmD+qleh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744030518, "uuid": "584aba9b-78f3-49b1-96c6-b7be1adeef39", "value": 2284032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744030518, "uuid": "4ef0c762-11af-4676-b8b6-ef416b9738f0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744030518, "uuid": "3f2af76f-080f-45b6-ace3-01c561cf91cb", "value": "aplicativo.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf07d84d-139b-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744022009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022009, "uuid": "169799db-5412-4fbd-982d-c0b56d74d8aa", "comment": "Malware payload", "value": "e16d8c6f426f6493fbfe79dbb276fdd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022009, "uuid": "2c4dd356-1720-432b-8a3e-e7094d223002", "comment": "Malware payload", "value": "e1d95cdb4081758e387ef25aaf8a4aaff5ebd35426f907afb770211b22ecd1af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022009, "uuid": "6fc2d8a0-c3e7-4963-ada8-54324bf20d42", "comment": "Malware payload", "value": "b728a9195cb040bf1e5e6b2ba4390fa7ef84fb87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022009, "uuid": "e5b51f81-53fc-4600-909a-c3b213d172d8", "comment": "Malware payload", "value": "a64735e2a53194e9da12d04bbff82ee3c07fb7976f70cd30eaf9240926fd7bb7367455560320f19470d564057ebf034b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022009, "uuid": "1f84cd3f-1613-4324-a92b-9a0a44eeb80c", "value": "T1B5656C82EBA44E26C51F177DF4B1361353B1D08D1357FB0EA785E22E7E9A3408A5638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022009, "uuid": "e65bedfc-45bb-4f01-bee0-1d1af08675c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022009, "uuid": "f3fd6857-eb3e-495b-ae50-b5a4f1dfa041", "value": "24576:A7FxdhcQTb/k2UlfKAaXgfuQTKbePiNH0Qxa7GSOBsByPqWachfuL6OV42siE6pu:A7FxdhcQTb/wBKAaXgfuQTKbePiNH0Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022009, "uuid": "139deca9-928f-4e21-8fa5-bd13310f214f", "value": 1531392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022009, "uuid": "a57c2ec8-8d68-442b-9d0a-8bada536efe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022009, "uuid": "d89b35f1-17f2-4c6f-97c5-0a780f71e49d", "value": "MinecraftLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84f5858-13c0-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744037916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037916, "uuid": "31bf7041-3485-41b2-9535-4ce07a35bd52", "comment": "Malware payload (LummaStealer)", "value": "d11d9f43b47abb51a9d090b399dcc30c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037916, "uuid": "893debdd-6bc2-4a70-b062-f3aa00c54798", "comment": "Malware payload (LummaStealer)", "value": "e1da4e702d1916044363c0239442e28d86560c0adf829da9fa5c71958be585a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037916, "uuid": "b4077590-3cd3-4041-a7c6-de18a743b63f", "comment": "Malware payload (LummaStealer)", "value": "e48c970477416f7ecdfb3409bcc945a89054db35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744037916, "uuid": "0aa2daba-50f0-4efa-b607-47ce8172a9af", "comment": "Malware payload (LummaStealer)", "value": "c7fe43beaea68536a3edba99b1036bd6eb7147e4fc798acfd3a106c6a4b04c356986ab64c304355273414b45896ea69a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037916, "uuid": "1699fc7d-1e20-41f9-9fc9-00c099a0c49a", "value": "T1AFA66C27A70012F7CB83197ACE17DBD5AD3AA6103311095A629D1A8ECF335C85737A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037916, "uuid": "b2800a77-430d-423e-8f4d-2cc6b057fe85", "value": "fd3086d258f68059da2e5198b10292e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037916, "uuid": "81e6b27a-7ff2-426e-b4cd-30b8cf52d16a", "value": "98304:sNEnNy2cm0/Ry2Ka7rLI0W0h12tdM8fC3OPrtxaG7:sJm0/Ry2z7rLIX0hOa8a4aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744037916, "uuid": "01e0eb6f-df84-460c-b74e-e13f98075778", "value": 10311911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744037916, "uuid": "2b941fa5-c3f7-44d7-a203-83b8e42300b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744037916, "uuid": "2360bad4-c6bb-440a-b357-da7e5b48ce15", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7549404e-1374-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744005135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744005135, "uuid": "2680459e-18d5-42bb-b88d-e5385cd00bb7", "comment": "Malware payload (Prometei)", "value": "f6fa7b6906b172c4ee8304bc20e20016", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744005135, "uuid": "eb82a6ea-b4c2-4148-80d1-a812bd73b992", "comment": "Malware payload (Prometei)", "value": "e1ff0194b61cc3146b98311217eae8fbb414bc4346cb73409dd112fad52f19bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744005135, "uuid": "95d633c8-36e2-4626-8bf5-20f79e727890", "comment": "Malware payload (Prometei)", "value": "73e23b78e8ca3af2c2aec570f7243474dbd300bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744005135, "uuid": "ca47e5ff-74b2-46fa-afff-50cb3fb34476", "comment": "Malware payload (Prometei)", "value": "01e4d790309260ce473aa66a3b205d0c90a3050441a8f43257b6824923edda5490f098cf0a22fea158c314d218218bf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744005135, "uuid": "4a9f4155-f141-4366-8bd6-fea87776e330", "value": "T1EE9423F8C83D2E3098169F3CBB5A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744005135, "uuid": "e0cdf056-f8fe-4c29-82fc-ed54992d5dd6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgY:25WOSACZSV6eKRH5EPiamb4DsDwwco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744005135, "uuid": "0b5bc31a-81df-449c-b822-a7d9cca1358d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744005135, "uuid": "c36a8dfb-8e6c-4f06-84ef-342461194beb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744005135, "uuid": "906cebd1-0878-4391-873d-cc4b33054e4b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c199380c-13ee-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744057661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057661, "uuid": "fed3bf06-c1b1-4ce2-8e08-539d0f814f21", "comment": "Malware payload (Prometei)", "value": "50c2453d90360ad0586a32ff38abd18a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057661, "uuid": "9b11b142-86ec-46fb-b4fc-f4b365ad7f42", "comment": "Malware payload (Prometei)", "value": "e21999663a885f615530520efcdd537dea8a8819107ae8acb75299360ab3bce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057661, "uuid": "ca8a6cf4-b95e-4fdf-b15c-c5381c3d3751", "comment": "Malware payload (Prometei)", "value": "c86816ab7273b69b68dee5ae64b4e3389379bab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744057661, "uuid": "e21b4218-bf70-4d09-b6ec-df0bac2e37b7", "comment": "Malware payload (Prometei)", "value": "fcfb7205849cbed55e9307d88f3d82407fc6c052ffe03bcd674a97334a5aa1093bf7e8ba5fe5ea6079c090b1c14eba56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057661, "uuid": "98866c28-1d78-4061-9add-2a54b00cc881", "value": "T185155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057661, "uuid": "f93952e9-4d64-42b4-b2ea-065d5aecf9e9", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplX:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744057661, "uuid": "e2c8e64c-57af-4058-93b6-0345589f6134", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744057661, "uuid": "fbf0ecf7-88fe-4b51-9d42-ab19064e728c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744057661, "uuid": "e5a1a792-982b-4d67-a444-63ddb2ee39c6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600b0e0f-13b2-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744031728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031728, "uuid": "37f1d8cd-c1dc-46dc-a4fe-80397cc3c250", "comment": "Malware payload (AgentTesla)", "value": "e95d957e1139815102da59f801c82f35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031728, "uuid": "ac8d27d9-8861-4e69-9f41-b9aa447acc52", "comment": "Malware payload (AgentTesla)", "value": "e28ab1b33d7446770039a494f9642261f70e85d95439f22bc61e6267c21b53c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031728, "uuid": "5cb2425d-bfaa-4c43-bfab-5f40244b9426", "comment": "Malware payload (AgentTesla)", "value": "11ff449dd8ef223e40e2fbc172ce0b807e8a7e22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744031728, "uuid": "0d0e10fe-e817-4d4c-a0f7-e5a615bbfb36", "comment": "Malware payload (AgentTesla)", "value": "ca5205cc7b9578238bb9e646fb66452291f63c5390dfe64e93fc03df279e8fba1e88e57640669727b415e94de52c7260", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031728, "uuid": "877871ad-e883-416c-b00d-d914d176913f", "value": "T1F305F054336CC917C27693F51430D3B807B95E9E7621E3829EE6ACDB38E6F425A403A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031728, "uuid": "4b5a1854-15f2-49fd-b377-26e8cbd0e12d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031728, "uuid": "156872b6-c626-4b2b-820b-c6d742c52439", "value": "12288:cYTYqBCCwfWpmNcsDie7OY1IQiuUpYGtZWSD2PBdobsXN08xIQ/Z1:Yf+pm3ie7X3bUyczD2Po+08CQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744031728, "uuid": "0c215116-f6ea-44d0-b65e-42530f88c4c3", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744031728, "uuid": "0910add9-dc8a-4c15-9b33-0a529022e5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744031728, "uuid": "d4fc081e-320f-4dcd-81d2-0290c3d1a63a", "value": "Quotation Request QU021182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85df3d7-1381-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744010858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010858, "uuid": "2b42e18f-f811-42d5-97b9-abbe34626a1f", "comment": "Malware payload (SnakeKeylogger)", "value": "8fc81e9a5acbd3b807bee26dadefcf5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010858, "uuid": "635b86f0-4c69-427b-8113-d1581dc2e893", "comment": "Malware payload (SnakeKeylogger)", "value": "e36801a3e24d697a55c6b00e156a88d1a27d81b83ab4c50f1ec6e6ca7d455d31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010858, "uuid": "553bc97e-a412-43e7-a4bd-4a937c819861", "comment": "Malware payload (SnakeKeylogger)", "value": "534673f878a059d25da059fccbf810b32b2bd7be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744010858, "uuid": "ba4495c2-f700-4ce6-bb67-85b83e2137db", "comment": "Malware payload (SnakeKeylogger)", "value": "a599fc773cfb2f6b0f6a0fb701bc28c1e7b6de048c776e419729f8bf33126476525ccea8e7b62a9b5a13a61cbdc9ab52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010858, "uuid": "11d222ba-8ef8-4f91-ad5e-e1795de379a8", "value": "T1D705F164336DDC07C1B642F41920D37803BAAE9D6522E3D7AEE6BCEB38E1F445940697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010858, "uuid": "74186688-e9ed-4a38-b839-365a966a67cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010858, "uuid": "914d490d-81e5-45bf-a482-cbdb3c476bb0", "value": "24576:MfWRbPNYbSF1XGs8v9Obrrf+vAS9FAEdQ68q:9rgSPXGs8Fkr7/kACP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744010858, "uuid": "b9e975e1-ef69-4672-90f8-b548fd14667d", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744010858, "uuid": "a23ed67a-07b6-4071-b1c9-03d311a4c018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744010858, "uuid": "b2b15de6-3163-4ee7-82ee-d34d9b6851bd", "value": "YASAR_SIZDIRMAZLIK SIPARIS FORMU RAPORU Rec. N0 r323282 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daed003-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744015403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015403, "uuid": "95920000-6d2a-4b7a-9493-c1ecc3eed091", "comment": "Malware payload (Prometei)", "value": "cf3cb333b2c391e7c5bfd85497a02c58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015403, "uuid": "19f208a1-4531-4fc4-ba49-0e31a556bc16", "comment": "Malware payload (Prometei)", "value": "e4508bcb58aacb7508aa0ccb282b88537a1d594e058f7fe6581a07b03ae540bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015403, "uuid": "c033d576-8598-4db4-9755-44ca14f0ae2e", "comment": "Malware payload (Prometei)", "value": "46df9df700590c209c4fb8cb931bfd89fb87ee88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015403, "uuid": "e9185f0d-b18c-42c5-921f-e4508e356b10", "comment": "Malware payload (Prometei)", "value": "ddcd19acbb8b1e858b65d861e784828c99b7048466d6d84eabb964c022ac4054ec65c34162684097b181aaf7cf517d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015403, "uuid": "93d39c3f-621d-4f7b-a677-5959e112a234", "value": "T11D9423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015403, "uuid": "b46ec557-aab9-4587-a523-04c6efae2a12", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg0:25WOSACZSV6eKRH5EPiamb4DsDwwcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015403, "uuid": "c3034f7c-bb88-4b0b-bbb4-6e0c3e0694d1", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015403, "uuid": "78c1dab2-6097-45d4-9a35-79d3cbfce91d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015403, "uuid": "4ab1e72a-d316-4356-9cbc-6474f7dfe130", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169adce7-13ac-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744029028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029028, "uuid": "4f637627-e4d2-4ea0-8c7f-985cae7db9db", "comment": "Malware payload", "value": "2a9a23bf922ab16301202be125d3a3c6", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029028, "uuid": "9caa43c9-d50b-445c-8506-e2851af945c4", "comment": "Malware payload", "value": "e47affa752ccf254920830c295281a46cad860a9d5d8b63322901b270f3d3285", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029028, "uuid": "80599316-0a1c-43d1-a6f7-bac64fff1a9c", "comment": "Malware payload", "value": "846b08eb2124f329c984cf61165ac99cfd108d92", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029028, "uuid": "d4d8b9b8-3db4-4b49-91a9-3b106a14c143", "comment": "Malware payload", "value": "82d54b7e4eb9425dba911d92e9faf01ef5bcff10fac0c744eadd012c1283542ab9d8bd51a3a489c6f306038a6503c5d3", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029028, "uuid": "809d91a7-c8a9-4c47-bb76-7f7934bb528b", "value": "T11E91FB3D8AD56DBD0365B37C2E8DCE1E489CF410F9159A2E70892140A7633863EB96BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029028, "uuid": "964d8fe1-b274-4515-84c9-bf2a62967319", "value": "96:1HMhkm3Q3mZadATHJnxcLGbgZbrZOeEKL:1H7FfKDJngGbaQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744029028, "uuid": "486b5103-a1c8-41f2-a2b7-443ddb8501fd", "value": 4303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744029028, "uuid": "dca26f13-475f-417a-a492-cbf8f4b5ef50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029028, "uuid": "37da27cd-963f-492a-9094-9c03560ec18f", "value": "tos1 (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df159a82-13cb-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744042679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042679, "uuid": "4bd53649-c39f-4c8e-ab40-c1ddbdf57215", "comment": "Malware payload (Mirai)", "value": "7849949549b8e03df56cd0ab97394382", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042679, "uuid": "3db7e1a5-4669-4ccf-ac7f-e3d73eb5679a", "comment": "Malware payload (Mirai)", "value": "e47c3df06f1667b25326c8328f5453924bad89059442dc0cc5d8cfa95e3fc3a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042679, "uuid": "11fdf4b2-e0e2-4269-bfe5-a60f2c902d22", "comment": "Malware payload (Mirai)", "value": "1f0a22e752204f9a60f2adf425893ad2bfa05f0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042679, "uuid": "5db47e5d-271d-405b-89dd-4db83a07d403", "comment": "Malware payload (Mirai)", "value": "9a80b850a253968bfe5ff6aefe171a9f9838ecdc48b4117f3ca873f38d770cd274c6969fb1f79ae9d1130cb6633f21e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042679, "uuid": "fb25235b-e60d-4cf7-8ad5-2d8b12236465", "value": "T1987329DBF800DD7DF80ED77B44530A0AB270A79106931B36635BBA67FD321A45822F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042679, "uuid": "811af1a4-6096-4951-a787-c121bef2c93d", "value": "1536:z3OL3wr34Qu3EhvOy0sxom2YFH4ZWp6wtwb48FyRXFORZkRawHUzN6NzbotcuObI:z3OL3wr34Qu3EhvOybxom34cp6wtwfyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744042679, "uuid": "e2a7b19c-cec8-425f-8b68-77918ff921f7", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744042679, "uuid": "1cb990fe-c90e-4b86-a797-5e8151de3aa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042679, "uuid": "5340b29f-1f54-4b5f-bb72-2729fad3af65", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173f43b7-13e7-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744054369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744054369, "uuid": "427765ed-7080-4189-ac9c-5ed502445b14", "comment": "Malware payload (Prometei)", "value": "ada401cd8c51e3e494fb9b01f49e621b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744054369, "uuid": "c6420a0a-7bac-487b-bfb8-4f6380d934d3", "comment": "Malware payload (Prometei)", "value": "e4a261a7947c85045df7a8cee84d0485df1b8e244e2e55d64b01d1318f4f83ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744054369, "uuid": "69b42d48-7c7f-45b3-a30a-5a33d106881c", "comment": "Malware payload (Prometei)", "value": "1001bc7c73f1922558b6de69af8d8fa7d6c20f63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744054369, "uuid": "fa6b4241-9277-417e-a81b-91b5e81dc981", "comment": "Malware payload (Prometei)", "value": "050a64e120f8b360c5516870f9a82948fa8b8df14a7ee56dec49ef8b9e5abe83ee4dfc50b106184595a05eda7c729500", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744054369, "uuid": "908fc759-9e2c-4901-b374-a544a52388c5", "value": "T13D9423F8C83D2E30D8169B3CBB1A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744054369, "uuid": "50dcf91c-3b27-485e-a21f-d5bbd515804e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgf:25WOSACZSV6eKRH5EPiamb4DsDwwcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744054369, "uuid": "bebfb724-2e87-44de-ab68-274452d9d3f2", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744054369, "uuid": "9425499c-57c7-4937-8367-8129a9427aa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744054369, "uuid": "eacd9541-49a6-4f07-ae14-a7032c7d1dbd", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a92f0c-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkTortilla)", "timestamp": 1744034348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034348, "uuid": "3ded2e84-422d-43df-b82b-2cf5184415bf", "comment": "Malware payload (DarkTortilla)", "value": "711a852cb4f94c6216170ef6f62ae32f", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034348, "uuid": "8fc21022-ae48-4f78-8aa6-a18380799fe4", "comment": "Malware payload (DarkTortilla)", "value": "e561cec3f0ca5e6f5d4ab32412352763ad9b489e5ebbdb240df83ba0fc51099a", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034348, "uuid": "20498a60-b113-4b4f-a08b-244da861ed4f", "comment": "Malware payload (DarkTortilla)", "value": "b4192598d4662213b6d76c5e8b25b26f6e4f3e52", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034348, "uuid": "55ef35b0-9499-45c4-b05a-63ee3ee5f7ce", "comment": "Malware payload (DarkTortilla)", "value": "49ed7e6535e6010f70c735d364554e2147508ca688217729f0254206e7425e249c248d53f13e8ffddc5004d6765c93b7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034348, "uuid": "2097a1de-0be5-481c-be32-0db170e32105", "value": "T1CDD4BE3857E96524E1FF3F3690BA011557F2B997D926E32D0A9426F98F327C08C127A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034348, "uuid": "dfd79e69-a788-4377-9985-8234c541cc4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034348, "uuid": "77e66127-b340-4b2e-b239-6723cffea4dd", "value": "6144:h2J1coPK2Pyb0YYLKeCprl0FmzcZHt3FvKfUQPFH8PN/5cxIbXaY4fqyvzU9jIjW:sjVPHKeWl0UyRRAP6V/DtyvziAQVRMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034348, "uuid": "310e8637-01cc-4233-a561-b9df29fc0ca8", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034348, "uuid": "3b475fec-8855-436e-b68d-984a80eb6c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034348, "uuid": "6d2dc64f-8851-45b2-9a7d-0f96f4de77f8", "value": "e561cec3f0ca5e6f5d4ab32412352763ad9b489e5ebbdb240df83ba0fc51099a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f138922b-13ef-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744058171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058171, "uuid": "c83ddfbb-0898-4be8-aca3-19560f78a1f1", "comment": "Malware payload", "value": "5d15f98caceca728c7527317c848aea7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058171, "uuid": "c4868edc-d5ce-44a3-aa66-f8449e9fa19b", "comment": "Malware payload", "value": "e622ddf16fe05040868c9d44fa5ee571a90c80a9cc3cbc7686e3559db3670520", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058171, "uuid": "3e1c46e7-397d-4c93-8a91-c39013db0508", "comment": "Malware payload", "value": "aef15e7eb893bf95b77f0feb2e66caacdd4f76a3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744058171, "uuid": "8d1d3c99-cbbf-4642-b3ec-6521cf9c0f8e", "comment": "Malware payload", "value": "ac7fe0257ebea44fa216c4c0299882971ac26610e50be5da90f752b8911da297b629305bfec9e772a52af89a71da2fab", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058171, "uuid": "f460d413-08e7-4fb1-b0db-2832410363fa", "value": "T1B265B05C94F09C912028FF74AB96F7C788E913962B2B4B420FE591963352843FEA7375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058171, "uuid": "d6c8847a-da7f-4d2f-8913-69570ec21e73", "value": "24576:NRrWHuv5K/FfcNc0MMe6FcBHM/gRCTva4:uHlL07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744058171, "uuid": "3af98cef-ff5e-45ff-8f1c-59073f93b1c7", "value": 1410664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744058171, "uuid": "4429bbca-aa53-40f9-8bce-64590c5d81e1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744058171, "uuid": "eecc9737-ff8a-4a34-91ed-45210dfb6cdd", "value": "Client.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb082d9-13f2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744059162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059162, "uuid": "aceff833-9bd0-4368-95bf-a84e92383223", "comment": "Malware payload (Prometei)", "value": "d321e6897e7a63da75a7f92112162d09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059162, "uuid": "7f5fc229-e4d8-44ea-9550-665db02cb0e2", "comment": "Malware payload (Prometei)", "value": "e69f37a94a56b6297d5a32a88cd82b69938f281807bc1756768d4460c4d961f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059162, "uuid": "e0f7ea17-74cf-4644-a12b-3e5a64e010a2", "comment": "Malware payload (Prometei)", "value": "6b237bfe91949723470e8a41ef3528cde9ca494f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744059162, "uuid": "a42d1eba-f73e-4915-b0e6-cfea9c891acd", "comment": "Malware payload (Prometei)", "value": "eaa477f5e00d49c8669c3ddd643afc0bc64f25d343deab9c9fa867bea61d03178c8cb21973739ade6463fd5b2e003dc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059162, "uuid": "b97db0c0-f33f-46ec-b7a0-d33298a82403", "value": "T12E9423F8C87D2E3098169F3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059162, "uuid": "6694160b-4cb2-494e-befa-e990ac410a68", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744059162, "uuid": "7ef8da70-7727-4200-b0cb-5f2f0e1fd8e3", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744059162, "uuid": "f3190101-4868-4398-ad9d-152bdfe57888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744059162, "uuid": "6f554704-943e-499a-93e9-c4a9c4a46f30", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a9fb67-13d9-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744048733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048733, "uuid": "2cc5a2c1-0fc4-4a5b-a8d2-545626a00503", "comment": "Malware payload", "value": "fcf24756017b198c6a80891af305894f", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048733, "uuid": "f36b5db2-86bb-4446-8146-71eb36747283", "comment": "Malware payload", "value": "e6a814c418bd4388bdb6969236f1d479f0902f1f4783cda9f210abeceafbd008", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048733, "uuid": "b3557c23-28df-47fe-aa37-1c4546f8dbf5", "comment": "Malware payload", "value": "426b0be2d7f728757c9d20e3d35235e0f9a0a894", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744048733, "uuid": "2ee11bf6-b1a9-4493-a9cf-099ad7c35b4d", "comment": "Malware payload", "value": "1727c5f57ac9c9ec43e25250ca6f4ba434c033848ae23a24f1a739379d2051178f432672943bbe83fcec75ea694035ac", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048733, "uuid": "709a830b-9ca6-47ae-88ae-602d9b8940b0", "value": "T15CE3D13B7F0C0741D8AE8B30955D43A24616F5C2067773A75C2482FC5ED67F9AEA8B0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048733, "uuid": "8d4dd0d3-10fb-43ea-87e7-157be8b33c51", "value": "768:uj2gmOQuB/Usxi4S7+7WEQN/AMQwKZBdsV1ARZod6RW4dKxV:BsUJ4S7+4NK5GzA//Rxsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744048733, "uuid": "d6a6724c-b67d-482b-90ae-5ad1dd39626d", "value": 151280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744048733, "uuid": "37afa35e-04e9-4305-b3b6-cb0534e33e19", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744048733, "uuid": "37816c98-721e-4a4f-ad6f-fce5cdb6557f", "value": "e6a814c418bd4388bdb6969236f1d479f0902f1f4783cda9f210abeceafbd008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed780a64-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034542, "uuid": "a16aa7e3-4ba8-4689-9b26-2ef28f5fe2db", "comment": "Malware payload (Formbook)", "value": "c13efa7fcba412fed784ef415ef46b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034542, "uuid": "bac55007-6570-43f2-b45b-d1e61f5103c6", "comment": "Malware payload (Formbook)", "value": "e6f8c55e28db20fd767010b1bae587df65c60c8902216e64f4dbcf2d885c72b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034542, "uuid": "d0afa58c-5996-42ea-b07a-f3bf68098dd1", "comment": "Malware payload (Formbook)", "value": "0f0d54c6d3662f1200cc39dad47f5e9c9cd2d1d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034542, "uuid": "2006d45a-bffd-4fe7-9224-7d3c8fd8606b", "comment": "Malware payload (Formbook)", "value": "316c03045913532ac3d8948fb65263b1920db5ab869c2cb2cd8bc96bf98b426a37336d4454ee99c5b5d18e8eead3bbed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034542, "uuid": "ef097278-4b18-4624-8ce1-ad4c62ab67b3", "value": "T1AEE4DF5C3610B58FC807CA759E98DDB4A6606CAA5307D303A5D32EBFB90D6A78F111F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034542, "uuid": "7fb0f363-60a2-446d-a050-81782b24af46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034542, "uuid": "0c1f0b30-6c9c-4ebc-841a-10be4eeea3d3", "value": "12288:UsBDL7xlloF3cBLiu4x0OcYWoLKymfDy8SsiwOXcIY2qUiiyGalEpiDJyo68HkgA:UsBDnl4cB+bx08YDy8SIOXLY4i3mp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034542, "uuid": "77ebb62e-55df-43ec-afb0-bcbd581ff9c2", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034542, "uuid": "09f3b0bd-f31a-4451-9a87-1685d81b4abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034542, "uuid": "9517c18c-bcbf-4af5-9938-660d9c90190c", "value": "e6f8c55e28db20fd767010b1bae587df65c60c8902216e64f4dbcf2d885c72b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bba53e-134b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743987743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987743, "uuid": "bdbddbf6-a1c6-4f82-8a8c-e47442d73a32", "comment": "Malware payload (Mirai)", "value": "87b45e683cb6ae540e407369cf796ada", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987743, "uuid": "503bf79f-4485-4f04-aa29-cb0dfbf56264", "comment": "Malware payload (Mirai)", "value": "e763ea46a8a7f8afad614395e93796e3823ebabc7b778cd978bfd7208c4c826e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987743, "uuid": "657b0768-d5dc-421f-b5f2-9dab8a255590", "comment": "Malware payload (Mirai)", "value": "603bd1de40dd415f9c6a9495082c53787a990c96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987743, "uuid": "d6fa0414-f663-4433-a892-5ac2aed9dcd4", "comment": "Malware payload (Mirai)", "value": "a2ac792b22caacf9243f2ed93f278207d329576ee9cf4523cb8420f4822f82003645b90f09494cb299431c2914a7c9be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987743, "uuid": "c3cd4728-4f85-4408-b3c0-f5d438050212", "value": "T1D06301B1E122FC50E680BE3A0D69C699027913BA93C725BE17449B18C3C37855B7B9B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987743, "uuid": "12384546-ca23-436a-8a77-d519e83e1360", "value": "1536:YtgRJ6FOY96Jh7GjYl/K3oi4PEAgxzvlLyfTtrR6M6ijX8Ug81:YtYt4UEVZdLyhtHB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743987743, "uuid": "cb5d9614-c137-4546-9400-221ba737f7ea", "value": 71760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743987743, "uuid": "07a45f32-2ee5-4b98-8a77-c39efffb0fa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987743, "uuid": "7764711f-5d4c-407b-89e1-2ffb40614d2b", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26732335-13be-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744036785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036785, "uuid": "3889c0cd-36a8-4269-ac42-d6b341ffe5e8", "comment": "Malware payload (LummaStealer)", "value": "4c9d56415234495e4c82cda0877c8cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036785, "uuid": "ffdf4945-8028-47cf-b676-548fc286f861", "comment": "Malware payload (LummaStealer)", "value": "e793e303338b028ab2364d28265fd7c7b6e02c0a9e39881b5c1f6aefb8dc0780", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036785, "uuid": "a4dbb300-add6-4e26-9f12-363428118148", "comment": "Malware payload (LummaStealer)", "value": "bf6dd87dc1d1eaf2246962e3b0326e932aebc3e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744036785, "uuid": "d5767ffe-fc4c-4bf1-996c-575a01b4075c", "comment": "Malware payload (LummaStealer)", "value": "cf1b68abf07f5ee27092f80b18d1815fa6657e0f2104e0da8040f8cab8b38912d12c770c982129f60e842e80d27b13d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036785, "uuid": "14fd4a75-1f7b-48f8-990b-18d5235a9da0", "value": "T127562202EEE224D5DC4984F71E029B193E542F67711F9C69BB8BF28797B2E2476061C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036785, "uuid": "cf8f1b31-7dda-4673-a998-eb2257ffe730", "value": "bc35cee4bae32c49ac8f81e5020fed39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036785, "uuid": "f3c82d3d-4b74-4cc8-b307-48304ca9b535", "value": "98304:q1jjJWELOBTZb+M6ZxOOYP3vI5n5iHXdf2mwHwE9hyThLOnJ0v/RTL+1e0GI4cep:q1jjJrLOBTZbn6PvYPe5i9zhsQhLoC/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744036785, "uuid": "ec0f25ad-c0f1-47f2-b964-8b9c95c5109b", "value": 5985792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744036785, "uuid": "e1ff1463-3122-4901-a07b-fb26c31a204b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744036785, "uuid": "c757d338-62a0-4219-bb00-24fbefba68a8", "value": "\ud835\ude4e\ud835\ude40\ud835\ude4f\ud835\ude50\ud835\ude4b_\ud835\ude44\ud835\ude49\ud835\ude4e\ud835\ude4f\ud835\ude3c\ud835\ude47\ud835\ude47\ud835\ude40\ud835\ude4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37941b55-1385-11f0-ad17-42010a9c0004", "comment": "Malware payload (Apos)", "timestamp": 1744012333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012333, "uuid": "bc34528f-cd11-4e56-aa1d-f7419ac6e1ed", "comment": "Malware payload (Apos)", "value": "0f8b20c367c6cb2c2726a3495d1d8d28", "object_relation": "md5", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012333, "uuid": "6dccb199-78a3-4b7d-8837-d5d36b20d312", "comment": "Malware payload (Apos)", "value": "e90249a27ea1181ac71f789c0c563d008cf920c5847b41c7a790952139b84808", "object_relation": "sha256", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012333, "uuid": "0b2ed748-0fd5-4a5b-a5ad-42a82b4f64e3", "comment": "Malware payload (Apos)", "value": "76376acbe82a4dc22cdf93e1caf01bd67992164e", "object_relation": "sha1", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012333, "uuid": "34ae1a74-35d6-46bd-8bac-09b54adc665b", "comment": "Malware payload (Apos)", "value": "31a23bbd8392f150dc6ede72f620bf2eee72e420f935dd0a7752320239174e619d271104b73cb451a11db31a1558ecf7", "object_relation": "sha3-384", "Tag": [ { "name": "apos", "colour": "#148A37", "exportable": true, "hide_tag": false }, { "name": "aposlocker", "colour": "#C46FDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012333, "uuid": "36509b0b-6fcf-4a56-9f51-569766e9ccd9", "value": "T128C52209F7D804F9E0F7A134C9968812FB7A7C4E43715A9F1398666A2F57390DD3A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012333, "uuid": "02e7b159-87f3-408d-9eeb-efc8a3d53674", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012333, "uuid": "8daa3182-082f-41de-a547-ff7400cacb88", "value": "49152:RZB1G8YMx0r+dBkCN9S+1qVoOH51LkiKT/PLzi6jmeZDwS27fIiOs:j3Gsnp9YnZlKbXvcSiIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012333, "uuid": "aa24e832-2d15-4c2e-b73e-ef8396b44e35", "value": 2717633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012333, "uuid": "8ba9aa8d-2df8-4154-99cb-acd74d10bf7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012333, "uuid": "ed84d93e-5be2-461b-901b-8948cc17aff1", "value": "e90249a27ea1181ac71f789c0c563d008cf920c5847b41c7a790952139b84808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4f67b5-1360-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743996743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996743, "uuid": "8ccfad14-bcef-4cc7-a947-8f1dd6430654", "comment": "Malware payload (Mirai)", "value": "89117b0e9258d44ecda1f64b54f1b798", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996743, "uuid": "6e13aada-0299-4e12-8f16-40ed3fabe963", "comment": "Malware payload (Mirai)", "value": "e93bb0828b3aff3be9542becd44d70a6740f6c4102c4e9ecc5e00392eba8a529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996743, "uuid": "6c6af0ec-59e1-43c5-9efc-bc7f3e54131d", "comment": "Malware payload (Mirai)", "value": "d466a5bb0c0ce6f0032235d91a569808577338d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743996743, "uuid": "26058ac8-3d48-4b07-8e8a-1c4f81510715", "comment": "Malware payload (Mirai)", "value": "e4d2d1bb7a00e1312d83f023fbea6d79c384d5c1ae28116bc05f40017f033b2f4ac1d0df9bc6767a746615ad4c20c91f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996743, "uuid": "8888e9dc-d941-4cd8-b85f-11be2fc3f6cc", "value": "T1E2C2E1B4E6055F69DEBFADB06CC1D9F533A20DA4A7C7CE4064C1EF331612A046619ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996743, "uuid": "dfcf3b97-b439-4640-b59f-b9a1a6f57230", "value": "768:KiQLDqbw2DR5CNd1kyUYWcoYHajBqq1QXiB0h684uVcqgw09M:KybwyXCjSypd6jRQvk84u+qgw09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743996743, "uuid": "6c7b0455-74d3-4d57-b4ae-71167ea2675a", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743996743, "uuid": "6456f8b3-bdfe-4843-beeb-d1cacd5ad796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743996743, "uuid": "070bfb8a-315d-4ddf-b901-35ee2428b45d", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f4ed1c-1364-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743998242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998242, "uuid": "9397b2c1-e74b-42c1-91e0-e2f444c55ec9", "comment": "Malware payload (Mirai)", "value": "dee3fd3f96238bacbe3be6a4bb33c0a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998242, "uuid": "55c85dde-4242-49ea-8ccd-6e920f1bb44e", "comment": "Malware payload (Mirai)", "value": "e9a534eed0aa69b305d09a873537a54e96d0105275901d93ffc8ff2ecc0fda21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998242, "uuid": "cbab29b2-189e-4927-a91f-7cda138b6fcc", "comment": "Malware payload (Mirai)", "value": "02eb5c282f32d9b8969df7af83d3a57575856f8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743998242, "uuid": "a59b0ed7-e2b5-48f0-b991-740598cffa7a", "comment": "Malware payload (Mirai)", "value": "db834568f9c0cdea0249217f81057e1457edc6585151cb5fad583c65cb40a4be081361b708fcf37585c4c6d037c268dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998242, "uuid": "5551c6a3-7802-484a-80db-f0264987b948", "value": "T1C043F1B6587F4636E568573F17AD2304762A1416F08A2F5B04EF20EBEEE2CB544A0761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998242, "uuid": "fb05218f-0eb2-4d8d-ac92-eb89064e1d4e", "value": "1536:RdzVE14WCohNMXgh0VuYb7X5815/d/9JVkl6:/G6J8/0VJyrG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743998242, "uuid": "515fa424-b732-4622-9c38-fb6eed24149d", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743998242, "uuid": "6f5f3773-563d-4b88-a102-e58bd20a451d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743998242, "uuid": "d63c7416-58fb-4d88-a267-7aa81c09040d", "value": "morte.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d5cd18-138c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1744015395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015395, "uuid": "13cdb453-41c0-431a-85cb-11f2b1308252", "comment": "Malware payload (Gafgyt)", "value": "d29036ff3f241dd8a86af3daaac63b13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015395, "uuid": "0c54c11a-bad4-4c8d-98d4-74a8dd1c230b", "comment": "Malware payload (Gafgyt)", "value": "e9d6e4d3b5ce6326dbaa6a0cbf9f979be35f28ea319c199c77639159bac51594", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015395, "uuid": "c30bf95e-6e43-4e7c-8388-9e689f3532fd", "comment": "Malware payload (Gafgyt)", "value": "372c9a574192fc41a7deb0a15a44e88dd4b09bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744015395, "uuid": "d81d395e-7139-4a74-9bc4-0b5938a6f9ab", "comment": "Malware payload (Gafgyt)", "value": "b4770c1ae0025c55aeaddd499da7d938a392f275a13180e1a3d016d915544f83fd3cfee1c4aa9650f0abadb4729097e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015395, "uuid": "5f0eeea0-3a67-48ac-a771-7f18898adac8", "value": "T13B832903771D0B43C0AB6EF029FB27F1876AF96116A36180B10EFED45772AB42512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015395, "uuid": "4370e19b-25c8-487b-8092-4277e699d655", "value": "1536:lQ2P4MoLMZ1wl85JuGp7kchcSj3Sv/Rz84CjGhBEmQ7Vh2jqnaz7e:ldzoLMZ1wltGl/cSj3UJ/hBEmQ7Vh2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744015395, "uuid": "ccc42720-c8bd-4934-9ac5-df64e789d7c3", "value": 81327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744015395, "uuid": "b26e8a8a-bca7-4403-84e7-9684c2fb3d00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744015395, "uuid": "4abf0b88-cff8-4abc-b30d-cbf1268d2d0a", "value": "snype.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7efddf-1382-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744011192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011192, "uuid": "5eebf955-8edd-44c6-97d1-b080c45a7e06", "comment": "Malware payload (Mirai)", "value": "eab5c01b14ff11ba17ed0be3c1fc4ec4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011192, "uuid": "48cdade6-7ea0-4816-9ace-858e41730f37", "comment": "Malware payload (Mirai)", "value": "ea72bbab8e0cab5e81763eae4905f417aa0f736b1fa481e8ba66d4234ff2e333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011192, "uuid": "0fe4482b-3ffc-4a1d-ae86-5caf9e5f4350", "comment": "Malware payload (Mirai)", "value": "bfec0996b89faa1a97a2e356eee760148a87ced3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011192, "uuid": "80e248f4-603a-42bc-a883-b5306307903f", "comment": "Malware payload (Mirai)", "value": "7746f6dbbe4f36647606c131189f7655da1b16ff78523ae081a272c717d8e9e552d2aae47ff3c248b11b531fb4f4179c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011192, "uuid": "5721c1a1-6799-460c-a045-49b013fee90d", "value": "T139E30B46F8814B12D5D111BAFE1E128E37131BB8E2DF73029D246F647B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011192, "uuid": "092716d3-461e-467f-916f-7120ab9d1e10", "value": "3072:DHea4CNoUjnwJIXMb6Azz1az/AWdYV8P4KL0:zePCNoQ6IXufzhakr8P4KL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011192, "uuid": "6b4e311a-81c5-4bba-b0f6-a1ac74e5ea7c", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011192, "uuid": "dd82da29-c9de-464d-9597-7359b07315c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011192, "uuid": "74360db7-4f16-4fc5-9b5e-c1cc7201ea7e", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fa7333-13a4-11f0-ad17-42010a9c0004", "comment": "Malware payload (JLocker)", "timestamp": 1744025970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025970, "uuid": "6220ffba-7db7-42c1-be67-017014068e06", "comment": "Malware payload (JLocker)", "value": "aeb06e5cdd5da2bc5259516fb738ac78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JLocker", "colour": "#6023A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025970, "uuid": "d39f9ee6-f13f-4aae-8d83-d911d615f230", "comment": "Malware payload (JLocker)", "value": "eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JLocker", "colour": "#6023A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025970, "uuid": "77ccd148-ff19-47c3-8991-2086b2ccc1c4", "comment": "Malware payload (JLocker)", "value": "012e54cfcb203e6250f7a086ff2fabb58b0f490f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JLocker", "colour": "#6023A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744025970, "uuid": "436d4fa1-1847-4d54-aebf-968a0e7418f4", "comment": "Malware payload (JLocker)", "value": "1c8574b32cf5ebff2f7ead065ccc01331fa158f6a9e85d3847e7b1c92ee31c00d77fa2d43156201a2a709c953f22f6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JLocker", "colour": "#6023A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025970, "uuid": "e8f538f9-49b5-49ed-8fc5-804aafa4780b", "value": "T12F552A257A4A98BDC19AC47483464A722A7130CB1B35BDFF44C896783F6AAF41F3D724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025970, "uuid": "6bb4ddb0-f83c-43d9-8308-3bb6f6329d0d", "value": "90803b542435eb267bbf54521c4b8e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025970, "uuid": "4e230b86-e694-446c-94f4-7ab6db0f3ac8", "value": "12288:+VyrnHTzVU8waEmUk6cLVe9QrJ2wJkHEr1SBmuxaMjCjlk9mCck76xBrqz81RRBl:++HTvLL0uldJkHErqmWXn0f/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744025970, "uuid": "5a57971d-b896-4794-a5b8-4a3740e9986c", "value": 1288704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744025970, "uuid": "e71242be-ac8a-488e-8d12-124e0f317c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744025970, "uuid": "cef9ce03-8d15-4a71-a093-168a70e0604b", "value": "eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1abe9ab-13b5-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744033127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033127, "uuid": "68e905c7-089f-42d0-804f-3a0f57a9ceea", "comment": "Malware payload", "value": "d2e7c1e1fce77faa047a0563cb71f32a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033127, "uuid": "1f5a35ab-f4da-4419-98c5-b0c09b78bae5", "comment": "Malware payload", "value": "ec20de4f321946aec0d00a3c942ae5cf9210324a40a119b474cbff4579fe7aba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033127, "uuid": "94acef63-75a6-4a4d-a57e-df376b94b077", "comment": "Malware payload", "value": "bd7073a16af5720dec9f508c5a45445de344a70a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744033127, "uuid": "e6cd9bb0-6b95-4187-bd8e-0d4a2fb4e611", "comment": "Malware payload", "value": "d1364ef98819e728f79e8f5a7b6cbeb3727c10209fba1e56c17140423e7c7254303ff0078238bead2217d5ca26b7c046", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033127, "uuid": "434c55bf-9ff8-48d9-82b2-fe81e56f542f", "value": "T1EAB3E7FEDBD1ACD00B2AF0F3D25C3F11215E93629755BABDE4C6083E61C2A54A7B1588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033127, "uuid": "a6ab2338-4398-42a9-ab26-167a749b4b4c", "value": "1536:FmCp7bKpohO30IvZkbmEKUgXEXzICKUnFTGdsVShF/do37kykUpSEPOXVKJXDGem:P76ohO30lHfc+shF/diZSToJzZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744033127, "uuid": "ae651a17-058a-41ef-8147-11aba34466df", "value": 112371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744033127, "uuid": "9bb4e2d6-f5b3-4335-a4cf-e3384540c24d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744033127, "uuid": "69bedd4d-a708-44ab-9501-7c1c4e40d0cf", "value": "1-Pay Slip 00113.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1b6177-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1744034486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034486, "uuid": "73270281-6e18-4255-b1f0-6cfa50d71ee4", "comment": "Malware payload (RemcosRAT)", "value": "39aa230de42e3de0ff4471a16072d223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034486, "uuid": "fbcb4f1e-8509-45c9-8fa6-cceb75d5005d", "comment": "Malware payload (RemcosRAT)", "value": "ec6fefa6665bf0e0235b2c46f865c2a56e555b62a89ace28e123f43f317519c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034486, "uuid": "fb4e2941-4a48-4798-b8fc-41e8f75d7c2f", "comment": "Malware payload (RemcosRAT)", "value": "80c3f602f0cea55b89374c3da29f91703f59ffd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034486, "uuid": "9e8d093e-c7de-4b41-b720-eaae0170c2b1", "comment": "Malware payload (RemcosRAT)", "value": "76a2101cfd4e1dd0fc3f9ab65af9b608386148d90d169622941d2a0c120abdabe7f93263da4f791c66387342bb814a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034486, "uuid": "32be9531-c69b-4538-8175-9d4785f6d36c", "value": "T1D355CF2273DDC360CB669173BF69B7016EBF78214A30F85B2F980D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034486, "uuid": "cd3012c0-e052-4182-917e-cb6120b48a2b", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034486, "uuid": "f382bc6b-e868-4b83-b408-4b3bada2d05a", "value": "24576:nu6J33O0c+JY5UZ+XC0kGso6Faman67PoqD8wBCPsChlbV05kWY:hu0c++OCvkGs9FamayPoqD8wBQX4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034486, "uuid": "34fbf8da-e3c0-4d7c-b305-491035efa694", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034486, "uuid": "2e85fbba-4497-41c3-b606-d8a5f52e7b95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034486, "uuid": "0152f24a-1531-46a2-9fd7-d56af6130c8c", "value": "ec6fefa6665bf0e0235b2c46f865c2a56e555b62a89ace28e123f43f317519c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f86bf7-1389-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744014174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014174, "uuid": "ceef099e-ed6d-46f3-b18d-da0aab1f6e2e", "comment": "Malware payload (Formbook)", "value": "1384f534c4733f6c54f818f9aa6578a8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014174, "uuid": "3a2d8c7c-d547-4150-bcd7-8bfd2f3583c8", "comment": "Malware payload (Formbook)", "value": "ecc2436105097f3ae70bd6b768f81cdd53d6f01ddcee34cbaa5d414caffa25ad", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014174, "uuid": "c05fd4ca-afee-4e89-bed7-d4a4b80e058a", "comment": "Malware payload (Formbook)", "value": "76c40cd6fe497c5f6ecd7a04be90c1d7b8868ee9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014174, "uuid": "a6877af8-1e23-4fcd-8271-ccf19ce0c30c", "comment": "Malware payload (Formbook)", "value": "96a9bb0647a8eb88ad3d45eb33c41262ffe8fc48a0cfcfce40138be03251b0e34c08d5e4928344cde78a3bee9146004d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014174, "uuid": "34b50590-300a-4bce-9dd7-8c8a3ed81b96", "value": "T1E4E42336D3CD88076B300A6347E8B4618E681EA0EC22741878FD33563E945DBDDAF1E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014174, "uuid": "e6aac505-d86a-44c2-960f-d7890810f364", "value": "12288:xzwq81/1D3H7vFKK5b7+r1hHQWFL/L7SUcWK5Y4mAIkqa:xzwq81ND3HRNb7wHPhL7SDv5o9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744014174, "uuid": "f4568e53-961e-4e01-8e13-c8859a03b8e7", "value": 696316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744014174, "uuid": "ab2fa581-467c-477b-95af-7ad18a8bd2d9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014174, "uuid": "9d3dff4f-7f99-48f8-bb84-1526ec61dfb9", "value": "Quote 4933094150.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfbca10-13cd-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744043400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043400, "uuid": "1c29d9c6-0f16-428a-a6dd-6857cd052751", "comment": "Malware payload", "value": "05398ddbb2f264cdb6896f1acad3f468", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043400, "uuid": "61560fab-7a80-42fb-8862-d801d4641286", "comment": "Malware payload", "value": "ee32d2dd794e0702cbf91e46ee347c3dfd910619605d18849dfdf62092678127", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043400, "uuid": "c912ab6e-9f5a-4e5b-9a1a-e2bbac5434a1", "comment": "Malware payload", "value": "5f06a963a147d8bd80f1412fdd876d9abc02373b", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744043400, "uuid": "51fc6507-c6ec-46a5-a6d3-3c5919861c1d", "comment": "Malware payload", "value": "b2a2b3adfb0fe1cf5289c578dfbfc4e80f031bf88152dba7d1eb0c0a04d6b18118a4f5170ffd3df9d3181a272ac2dc7d", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043400, "uuid": "b04723d8-d2d7-47c7-ba1f-02cf1b45873d", "value": "T163C0121497428187D650600551B8B865744E784908D3D49CA342DA9F69814D1C0096A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043400, "uuid": "6d3211b4-194e-42fb-a3d4-0d6e532045a5", "value": "3:HRAbABGQYmtK2IqKxS18PKg2ZpBHKs7V25YdimVVG/VClAWHyn:HRYFVmtK2OxS2yg2Z2s7A54vVG/4xHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744043400, "uuid": "7ca6dead-0b39-422d-9672-d56c2c15ab5c", "value": 167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744043400, "uuid": "c56d2842-286b-4c40-93b0-f8d3d2eb932b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744043400, "uuid": "6065ca25-9a8f-4e9a-80dc-9e2d8b15e366", "value": "1ZTY45367299403388.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1e808c-135c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743994949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994949, "uuid": "2e669e25-17fc-447c-8cde-e026c7e090ee", "comment": "Malware payload (Mirai)", "value": "a541e42cd1d75f22c0795017e4795ac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994949, "uuid": "c7d46bc8-92be-4a40-bed8-5b3f1b27c74c", "comment": "Malware payload (Mirai)", "value": "ee79e86b93c0b3d0e70910a479550252a6727acb1a8e063358d670dc8ec71adc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994949, "uuid": "14351e71-5a92-4851-b455-bb61b55d7bcf", "comment": "Malware payload (Mirai)", "value": "ff3ab63815661c40be8417b1b862b91bc9457933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743994949, "uuid": "8af841f2-c32d-4ce8-9a4e-5edca7d7f1f0", "comment": "Malware payload (Mirai)", "value": "4f15d332c73a04bf51f7d87cf7adcd7b64cf02dd900079f9ee9d9ee98d23d3ff423d31dd406cec93b7b06af88903f0ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994949, "uuid": "0f460fc3-adf3-4778-9608-2abcf846537b", "value": "T1A35319D6F900DEBAF90AD73A445301067230A7E506921B367357786BBDB62E42863ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994949, "uuid": "f25f59be-a897-4d7c-9871-692cf3b1f19c", "value": "1536:mMiOqDQVQb+wb4wm0RR3Z8uo0689hVJ538W2pA+Rjg0of:mbOTQJ5m0RdXhH5Mhfof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743994949, "uuid": "b76c4d4c-3bcf-4193-81d6-c9c769c418dd", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743994949, "uuid": "fd5fcb4f-e56a-4e73-bf08-a71ce6f39df9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743994949, "uuid": "dbdc4fb7-9fe0-4f09-93d9-a317ed28164a", "value": "resgod.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbbc43a-1351-11f0-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1743990142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990142, "uuid": "02e40df2-0552-4b80-8df0-90bf06bb39f4", "comment": "Malware payload (SSHdKit)", "value": "0fda4feb3479733a194002ffa5c33b7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990142, "uuid": "29957c30-4bc1-45b2-9e02-b6c5fb590fb3", "comment": "Malware payload (SSHdKit)", "value": "eece8634b1fe0b3d853396468c4560c660265c66d54781551797027bd950f4fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990142, "uuid": "af2ecf84-3af3-4daf-9763-798bdcb132d5", "comment": "Malware payload (SSHdKit)", "value": "6f2f7e22a918115cf01c5d3a27087c8b9a49c352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743990142, "uuid": "8b169bcc-9f04-44ed-b1ef-14a49e397e32", "comment": "Malware payload (SSHdKit)", "value": "5d27e7b1e56f86507ff2cb7f6608db71daf34fdac895d591c4d21938bba653b54c92fe98d840df4820880efe69b526d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743990142, "uuid": "e8e0e943-acf4-404f-a625-c90c5b7da240", "value": "T1CE356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743990142, "uuid": "55086ce1-bf1a-47bc-a699-f13ec8ca871a", "value": "12288:E8dASOYRlCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbEO38+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743990142, "uuid": "5ccae122-8b67-425f-bb0d-3e1bfacf3708", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743990142, "uuid": "cedd32a8-d83b-4e68-b592-114f3f25469a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743990142, "uuid": "bb60de7f-69b8-4440-b3e9-d986677f14e2", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cca243c-1393-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744018408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018408, "uuid": "8a987609-6463-48a6-aba3-45e0be7b702d", "comment": "Malware payload (Prometei)", "value": "7eb5e8ff6e1351f29d4c8ded91eb7026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018408, "uuid": "b84d8ca9-d012-4260-91a2-246f47f9f000", "comment": "Malware payload (Prometei)", "value": "ef14632ecbdbef1c07f077baf681e614b7a8269d467268286e871ecf8bbbad54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018408, "uuid": "ecdeeb14-4836-4672-9119-5e4129a491a6", "comment": "Malware payload (Prometei)", "value": "6ec1ee55ef97971d96b80707c8eea875dfd39fd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018408, "uuid": "6c219951-d8a2-4b42-a4d3-43f116c3052b", "comment": "Malware payload (Prometei)", "value": "c7aafbf30f7d7af9c12b62143dcca5ec31fd63ff09378e9b6d395fe4742b44d160c0f69012f746c09768c7d118603cb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018408, "uuid": "cc91be39-77e8-49dd-8250-b7d629f94ad5", "value": "T1E39423F8C83D2E3098169B3CBB5A826CF0E15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018408, "uuid": "709b9998-17ae-4235-8c9e-13819b1640db", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg6:25WOSACZSV6eKRH5EPiamb4DsDwwcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744018408, "uuid": "23c18948-eb02-49c2-85af-8ed45e0bec48", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744018408, "uuid": "b65fb8ce-7893-4323-b0b4-06a44bd1b913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018408, "uuid": "2a20dd11-8ab6-448e-bec9-6b038d47a3c5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76753b1-134b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1743987744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987744, "uuid": "bea408ff-7370-4185-aac8-974502c8f7f4", "comment": "Malware payload (Mirai)", "value": "5005eab08a13f540dddc76a99435f546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987744, "uuid": "225b1567-04c2-4cb2-804b-3e1bb941de3b", "comment": "Malware payload (Mirai)", "value": "ef1fbc0fa7da76a058357e8f7dfebf950a272768d1672d7cd382fb9612fd18ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987744, "uuid": "1a33b806-c356-46ed-8cc9-205f7e7959a9", "comment": "Malware payload (Mirai)", "value": "79e06eeda25730ad43697aeb8e7c046ed1d74a17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743987744, "uuid": "f3f215bb-e290-4d97-954a-2759ce3d7e61", "comment": "Malware payload (Mirai)", "value": "38a9a4078434b094ccfe6a9baeac77e95fef8a1f508d9658a607f128a4fe1e7a6aa39cdb86850925c9d7c15477d2840e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987744, "uuid": "36d7c7fd-9149-4408-b7b1-0fe9e89e93c4", "value": "T113A2C0A46106FE30C46408F6EE75D98B234F4AB9C1EB397352A0115CBB97A0A47B935B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987744, "uuid": "83cae8a0-6ca9-4212-889d-ed568ccd312c", "value": "384:Md/jrrIGND/spqf2xmfCexyc9uD3AzN3HhD6qIKIU+hymdGUop5h/F:WzZ28KexyquLqIJhs3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743987744, "uuid": "9329c525-116a-42c9-8483-fc7932bbd9df", "value": 22264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743987744, "uuid": "59898991-5a91-452c-85a3-0d3bac16def3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743987744, "uuid": "5b218fde-c78c-4bda-8f59-1f40362b01fb", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885fe678-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744034373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034373, "uuid": "264bea6f-9090-40e5-9017-6308fe1d26ae", "comment": "Malware payload (AgentTesla)", "value": "6a7b480a44617cd79818ac8345e47d00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034373, "uuid": "847aae9d-3c0f-43ce-b50e-9e36bcbe1fad", "comment": "Malware payload (AgentTesla)", "value": "ef8c8ae59892c2239bf24dfc91f7d0236d64aef3303410657af43cc8e1131041", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034373, "uuid": "4c802083-c1b6-46a6-91b7-626e0cc1814f", "comment": "Malware payload (AgentTesla)", "value": "f1e2963a2cfc31e0e8307abba5ad3a956a4dc65b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034373, "uuid": "a30b6d38-b7cf-48fa-b179-25868d02eb7a", "comment": "Malware payload (AgentTesla)", "value": "9e60d095e432d58314db3ca120867238e359917b5d6bd886f1d035ffc7842797df257249891c057c26d16144771be78b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034373, "uuid": "33208f56-0b58-46a2-bfd8-bc1e308e9a7e", "value": "T1BA543D13A91D81B2EE34573EA15649C557F09C0C61DAF20A23B9BD3DC87E6664C0FA2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034373, "uuid": "3dbee21b-51ed-4525-b11d-868104a21820", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034373, "uuid": "67799813-d832-4654-bd07-f7043453afc4", "value": "6144:GWNu6AJ0+y3sMeuTTTTTTTTTTTTTTt4iCEne:iS35n5CEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034373, "uuid": "3ed66e14-5ba4-4a3f-8198-001cf49ade26", "value": 290136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034373, "uuid": "ec1792ba-0563-4f6a-9bc6-b7f075c35e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034373, "uuid": "84bf6b9a-5cb0-4630-8df8-52e3e8927740", "value": "ef8c8ae59892c2239bf24dfc91f7d0236d64aef3303410657af43cc8e1131041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e1ca75-1371-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744003948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003948, "uuid": "912aaa63-e61a-46c6-bb17-2c07f00dea4f", "comment": "Malware payload (Mirai)", "value": "60d2af76bd0a4007af85a9ed1afb621c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003948, "uuid": "0867dfe0-d315-4023-874e-bb2122d332ce", "comment": "Malware payload (Mirai)", "value": "efc1e5ae9f8d5db5d38404be7575b078a69e4b8c5334e9247052966c37800c58", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003948, "uuid": "0f7c551f-3615-4430-abc4-4fc3e3094b3f", "comment": "Malware payload (Mirai)", "value": "d5c7aa40e0dd0c23e373ae0c384cb506a8cae429", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744003948, "uuid": "216ae662-f17c-4311-a76a-353e5ed48a46", "comment": "Malware payload (Mirai)", "value": "9680fcf4f881f85756daee871ea9efdf859ed0b6fae824e11d69d1c7d33eac92132d51da8d58c9340c6d8527d01c5616", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003948, "uuid": "ebaa2b52-43a6-441f-aac0-fd2e86764588", "value": "T1D2F0C4892C319457594A9F90E0F23B7D7401C6E06B505F88EBDD0939EADC64435E9BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003948, "uuid": "80de340f-8ffb-4907-b1ff-0006183cbd37", "value": "12:YuAa0edhAEUMOe28NItAxMDItY2iAYKDPdwVAf/H+T4AeYXebSDAyS2b0w:yPiNIyVYK7cNBKScySSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744003948, "uuid": "675624cd-ca2f-49ae-8b86-88f99fda18b4", "value": 656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744003948, "uuid": "02f30aa4-e80b-4101-a11d-45e5d6b1d46e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744003948, "uuid": "c4c646a7-ca05-44ce-8bae-9751d5e3c48a", "value": "cams.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84c7698-1358-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1743993275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743993275, "uuid": "6239a5f1-4637-4678-9d2d-079f0d2cf733", "comment": "Malware payload", "value": "591a0153cc7dd276f071889334cdddf8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "IRN", "colour": "#2ACB90", "exportable": true, "hide_tag": false }, { "name": "KalaBarg", "colour": "#820F91", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743993275, "uuid": "52baf8cf-a44a-42e1-b9d9-c224994ca6f1", "comment": "Malware payload", "value": "f042f4222e2117e309121b18da92c7402103e3b3af15cba7745e4b8f96e65d1b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "IRN", "colour": "#2ACB90", "exportable": true, "hide_tag": false }, { "name": "KalaBarg", "colour": "#820F91", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743993275, "uuid": "4c7bd2da-f5f4-4b7b-aac5-ee35a30d17b8", "comment": "Malware payload", "value": "23008a93cefc885a2902ddf531a57daf2b013170", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "IRN", "colour": "#2ACB90", "exportable": true, "hide_tag": false }, { "name": "KalaBarg", "colour": "#820F91", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743993275, "uuid": "9553e405-184a-423d-9e70-3eda6da37794", "comment": "Malware payload", "value": "ec35ae8cb6b7ea53da11de2ddb78fe18a5de3eed1ebe397e1df3a0383c2ace5e8eccc3d25921ea8028a6967504b115ab", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "IRN", "colour": "#2ACB90", "exportable": true, "hide_tag": false }, { "name": "KalaBarg", "colour": "#820F91", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743993275, "uuid": "5f3605a4-93fc-4976-8aa5-628f32862e23", "value": "T1A3951203F379A817C976C1B22144177A615B4D29C643FB8E3A4437EA38BBDEC4B85AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743993275, "uuid": "09034fd3-1b27-49f2-98e0-eb264c9da73e", "value": "49152:EsKkkpeXX1so8N2Pp2vsbaHy3CmmhRym9bELa:kkkIXWpl4CRym92a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743993275, "uuid": "cc3dd9be-e505-4890-be92-ee17312be235", "value": 2056830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743993275, "uuid": "5e3755f8-6b5c-4510-9301-0055f945fdc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743993275, "uuid": "a021c0c6-bda2-4e3b-ba98-13759000ea20", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574785bc-13c6-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744040303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040303, "uuid": "5ea78ae7-a73c-436f-846f-546905fdc78c", "comment": "Malware payload (Prometei)", "value": "8a6ced24db55f33a7266282ab05642e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040303, "uuid": "1e0de3cb-7c67-490c-8f0c-442d293f0cad", "comment": "Malware payload (Prometei)", "value": "f0abdcd4be862fb5f2fbb903c833b47b4610ab3ddf3e14f909747f5155fabde6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040303, "uuid": "d1ee7792-fd6c-454f-af72-faeafe48c06d", "comment": "Malware payload (Prometei)", "value": "128694c27151e8e9ae95de978cfc9c45af756e25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744040303, "uuid": "2690ff1f-827d-4f07-8dfd-5826e35ba196", "comment": "Malware payload (Prometei)", "value": "693ef6d38262c3f3fc6ec51c949eb857fdcaf945a0e187b1e78e39a27b63b5462bebdf9e07aa303f80fbe9a466680689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040303, "uuid": "e4c0b497-ab5f-4f7d-830a-a4bb16c8beef", "value": "T1AD155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040303, "uuid": "e214235c-9fde-4f21-b944-eb85c135c068", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplW:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744040303, "uuid": "289c84b6-f6aa-4b8a-9117-45c2970311c7", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744040303, "uuid": "9acee0cd-ea76-4c5f-8db4-0f2f355b51d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744040303, "uuid": "557ff3c2-c28e-4b09-8773-851960995872", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d9de3c-1392-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1744018207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018207, "uuid": "2fb904d3-b198-4933-b5de-e782b541ecb8", "comment": "Malware payload (MassLogger)", "value": "8bd53eab575d28ec6701498ab4db754d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018207, "uuid": "0727c25f-02e4-418c-94a2-34615aa59825", "comment": "Malware payload (MassLogger)", "value": "f1493867c4033eab78f1b4a8385fe83eac3a803abc4bcada6900fdcaf260f898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018207, "uuid": "f1cd573a-c927-4a0a-8e5e-19087bd0dd19", "comment": "Malware payload (MassLogger)", "value": "ecf0a0f24c1b31483e09ceb7697229c817fb4d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744018207, "uuid": "330df716-3820-48f3-9685-76f27cda9b40", "comment": "Malware payload (MassLogger)", "value": "0fda462409445e78653506d2183137ef78f5bdc7b2083c32e61a73a8f466bf49f777d696d8b7add78a7182cfdb3c7b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018207, "uuid": "0b2f18d4-d21e-4665-bdca-79cf74fc20b8", "value": "T15E15AD2273DDC360CB669173BF2AB7016EBF3C614630B95B2F980D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018207, "uuid": "c6122d2a-6702-430f-97b8-d82fd94c88bf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018207, "uuid": "bd4bcc2e-0b76-4940-878a-3aa1fa7ae7a8", "value": "24576:bu6J33O0c+JY5UZ+XC0kGso6FawHJwItWY:Vu0c++OCvkGs9FaweY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744018207, "uuid": "7aaf58b2-cede-4c64-b4fe-f5dbf1828da6", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744018207, "uuid": "2a8a3ab1-a635-4ead-b2e1-a8196e5e29b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744018207, "uuid": "68a16687-18af-4109-8d8c-2981c4fd0817", "value": "z2PURCHASE-ORDE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4401f0ae-13c1-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744038123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038123, "uuid": "8cbae7a0-2c5e-4f10-ab0b-4e0de25e8a18", "comment": "Malware payload (LummaStealer)", "value": "b2c220a86fd0f3a0f1ea2ce88be78d2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038123, "uuid": "73ee585a-6fa2-4aae-88ae-271448a0a20d", "comment": "Malware payload (LummaStealer)", "value": "f1cebc00d5ad94a02d7e4ec9f4d4a05bde38ee5404e04d181f3bef6723e6ebfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038123, "uuid": "5f19c335-e1e2-495e-b814-5b1224d803cc", "comment": "Malware payload (LummaStealer)", "value": "b5ada9378b89e371e9b210ac86e8fadd1375392c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038123, "uuid": "ab187b84-60e2-466c-bb20-b546a997d8d7", "comment": "Malware payload (LummaStealer)", "value": "3d8bd57467e6d2807d1e3c2b17d5c8d830cc9ca21d7de2204709cc57058114cb75a0ffa2476acbf28cb5e22a4ea67a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038123, "uuid": "92a4212f-6294-4ef6-bcf5-4039227c4481", "value": "T1259633449E545F63E0D2E936C4B48753AB2B3E3249E94FDAF11B7F0C50B28219A09B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038123, "uuid": "35977f02-81d7-4084-9713-0e5df6a97791", "value": "4f1342a4b5f473a33cad1e0fbbb5c40c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038123, "uuid": "90ba8cf1-84b8-4087-9065-b0b62c1cbae5", "value": "196608:+zzNI+M5HHTcZKyS0yrKuKwgzC31RAWUDcSA7c/V7mBXDp:F+OcYjJYZURAWxS5KXDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038123, "uuid": "347f444e-cc9b-4e7c-adce-73e771898a78", "value": 9007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038123, "uuid": "c4aa86ab-d250-40a2-b3ed-0c7a61aa5a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038123, "uuid": "6641d4ad-bb7a-4bbf-aab3-5dc0d7135991", "value": "Setup File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846dc7a0-1389-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744014180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014180, "uuid": "63070f7a-4a21-400a-a979-2e6ec3ad4765", "comment": "Malware payload (Formbook)", "value": "030207f6bf1c04ab07dfbadbac4221c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014180, "uuid": "7f0b1a92-e7c8-489c-85f6-9b5bcfb8a092", "comment": "Malware payload (Formbook)", "value": "f203fc8e548162c0d11c5ea0a88b82b833bb32e3bf819753cd9b7e60d331aef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014180, "uuid": "8e89a788-7f17-4ce7-9cfb-744704267576", "comment": "Malware payload (Formbook)", "value": "d486c13e7cfaae994c2ae943a5ec4ba200b456fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014180, "uuid": "4f85cb7c-21f6-4229-95d5-e5e966fab5af", "comment": "Malware payload (Formbook)", "value": "4783ed7b9cd8bc8f78b039af606e0e3d912414455523fe5a1f688ae80f68e2769617a7fcadd5f0f6a5d49ef77510796f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014180, "uuid": "a46eb188-c198-4626-b294-098218aa7810", "value": "T14F45CE2273DDC360CB669173BF69B7056EBF3C610630B85B2F980D7DA950162162DBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014180, "uuid": "58ab0db6-a32a-4ad7-8ede-aeda158a3268", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014180, "uuid": "07a632d8-7ec4-487a-ae92-27d64613d763", "value": "24576:+u6J33O0c+JY5UZ+XC0kGso6FaX5pHMACp22tZiunbfWY:Qu0c++OCvkGs9FaX5pstltPn6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744014180, "uuid": "5b38e30c-89e5-4493-81a6-f8155bcbbbba", "value": 1190400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744014180, "uuid": "d72f5a1f-87c5-4572-a4d3-0dcba18149cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014180, "uuid": "8ccafeba-1fb1-4024-97ac-6cecacd7fc86", "value": "Quote 4933094150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57424703-13e1-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744051900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051900, "uuid": "a4d425d5-debf-4c14-87e8-5e0190ab92a2", "comment": "Malware payload", "value": "0906079ea36374150e8d617145021147", "object_relation": "md5", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051900, "uuid": "a8060eab-385b-4193-8749-ecbfb1f5a46a", "comment": "Malware payload", "value": "f349010a752484df873c6b00f9949bd986052e28660fb9da4d50a9fe6546a61f", "object_relation": "sha256", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051900, "uuid": "1def85d8-4d6a-4c95-adcf-52aae5953ee6", "comment": "Malware payload", "value": "fffd9d328fbb27285c3e7c1e2c812736985ce482", "object_relation": "sha1", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051900, "uuid": "635bda50-4a65-4e8c-b393-29d1fe6106b0", "comment": "Malware payload", "value": "a7791504ba5f9632ec49aa8885d048e9160755f4a2a969e9f65d9195aa1d43889ec81552911f4a6e5d872ff3358abba5", "object_relation": "sha3-384", "Tag": [ { "name": "almeida-clientepj-com", "colour": "#2D30C1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051900, "uuid": "851edc50-e025-4a5b-b7a9-3fc3cf50c3a5", "value": "T126115413158C031E2F0BCE78D5D2DB5DDA6B23485015418371FEE9143AC127AC31D6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051900, "uuid": "0afdb6a7-eee9-49ff-ad16-83fa282878af", "value": "24:Wj3l9IsMa4dGUM2HKDr2dQDaR3i53nSa7Am:Wj3l9e9EYqKRyhnpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744051900, "uuid": "ec7294f4-2cce-4497-bb4b-5d1306ff8285", "value": 945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744051900, "uuid": "1b286779-78e2-4ad5-8553-df5499c8d06e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051900, "uuid": "cfaf936c-b077-42ac-8f5a-2402adb9f5f2", "value": "NotaFiscal1.25.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26acbd09-1375-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744005432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744005432, "uuid": "6f031342-ddf3-495b-b724-215536ec3db5", "comment": "Malware payload (Prometei)", "value": "3622f03aa24832cd8c391ec756aa9fe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744005432, "uuid": "d4217e34-d1fa-406e-84ce-56da86080802", "comment": "Malware payload (Prometei)", "value": "f3b27e2984eed33c4ac7c3e49a13335ff72ea54cc7282ed2fd3b7d92eac7c03a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744005432, "uuid": "f676183e-029a-4509-9a6f-372e4e7a430a", "comment": "Malware payload (Prometei)", "value": "cefcc38d1347ede3dff0e13048d570e0cfc7fbb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744005432, "uuid": "bb908441-ec50-422b-878d-4278cc86aa9c", "comment": "Malware payload (Prometei)", "value": "91fcafca2d70d343f974a743956a323fe0e9574c4ff77b9ab16de3607a368708a62876a36aec2316f1bafcd88ee689ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744005432, "uuid": "9d70b8db-0c07-4a10-980f-7810d30f3559", "value": "T1A49423F8C83D2E30D8169F3CBB1A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744005432, "uuid": "458ee4f2-5cb1-423f-bba4-3b93344124d1", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg7:25WOSACZSV6eKRH5EPiamb4DsDwwcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744005432, "uuid": "7d5fa2df-bb10-4de8-87c5-23189f6d3b5c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744005432, "uuid": "767ad55f-be57-4fb7-b6d1-d673b539ea11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744005432, "uuid": "3c32a467-a7ea-43b4-b3f2-322f141a163d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99383223-13d2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744045568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045568, "uuid": "bd25fad2-f3fe-4f37-82eb-58b3e29c16ae", "comment": "Malware payload (Formbook)", "value": "29419c56998d60824235fd7a2c3d1ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045568, "uuid": "f8af123d-1662-45bb-8916-1c3fd0399c64", "comment": "Malware payload (Formbook)", "value": "f4fd32b445f317b926617b187d094d41a58eb40f22ef11d03f0a0dc587e1ef0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045568, "uuid": "65931052-492e-462f-ab90-72588284dd9e", "comment": "Malware payload (Formbook)", "value": "2d4ea63fbe0b70f7c3471cb425dfa9955aea602b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744045568, "uuid": "01571eb4-5bb7-48c5-8f59-120e09686fed", "comment": "Malware payload (Formbook)", "value": "15d6ad45db41ae1e3af80803248325b585cfb3c2289d5579f4225906270971746814654efdb1d44f02028b0ad8a42bfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045568, "uuid": "cf3347c4-0732-4bb0-badc-8fd003316ed0", "value": "T1A4F412893355EA02D5D197B95C61E3B8067C9D8EB821E3139EFEFCDBBC35A513840291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045568, "uuid": "a5c9eed6-9dac-4cb4-adbe-f6681890b9cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045568, "uuid": "14ab5f42-bbc4-4d99-b943-468f565c1c26", "value": "12288:eRYqBCCwfr86TxI7iqvQoJgyUAGSb0p/nYS3FT3cBKsK2d9iHNygiC6:eWfo6TQEo6kqp/nYS3FzsKZggiC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744045568, "uuid": "f08c8e3b-bb68-4d65-809a-cefc52f2f318", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744045568, "uuid": "7fcaca7e-9c5b-4f37-8d8b-7a25fcfb8380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744045568, "uuid": "648587bf-11b2-4868-84c0-e543baf49bdd", "value": "SecuriteInfo.com.Trojan.PackedNET.3297.15390.1685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b267962-139d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744022566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022566, "uuid": "d08ebf8d-3d98-4e82-aed2-e77915cd30c6", "comment": "Malware payload (Mirai)", "value": "37bceea5b0a1b4ca38f5ea67145c54eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022566, "uuid": "aa7f6942-a205-4f9e-87af-b8682c42f842", "comment": "Malware payload (Mirai)", "value": "f53b2587bf88c53f18fd5adc1b6b9abb2563e8b8416366071099a76882bcff60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022566, "uuid": "f23b05c9-7568-4e77-9bba-833edd421429", "comment": "Malware payload (Mirai)", "value": "b650f7ae75b17466ab067392878ea3c3b23e97c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744022566, "uuid": "e7bbb187-7c7e-4cf7-975a-80c1daa18f6a", "comment": "Malware payload (Mirai)", "value": "fa54cd72b278e509c3eb8d3d0e16431e5b9d90afd7803f0b7fd055767c7e2b3f3a5103ccaffc998dd5e8619cd465e749", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022566, "uuid": "2794f8cc-f957-4a4f-9b6c-971fb8907772", "value": "T183932ACBF400D9BEF84ED77708574D1ABA70F2E00A430A7273677A6BE9751A5241AEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022566, "uuid": "ef163fba-24ed-4b17-ade4-448b23dfa8d0", "value": "1536:ujUnUn4XYk8kq/ZlQeuacWjcW0JcWcBds+BycbhuYVIVwnmFpvXJhEoPj:ujhyYOqRlQeuacWjcW0JcWcBW+BycZWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744022566, "uuid": "12e4c176-ffb3-4741-b6ed-771eb82bc3ae", "value": 89064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744022566, "uuid": "ca55f3c1-dc0d-404d-8fbc-5192090da45e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744022566, "uuid": "f241130c-810c-4870-a545-25028cf6a628", "value": "hanoi.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27291235-13a5-11f0-ad17-42010a9c0004", "comment": "Malware payload (RustyStealer)", "timestamp": 1744026049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026049, "uuid": "ff23f083-41da-4c3a-9518-963defbdd32e", "comment": "Malware payload (RustyStealer)", "value": "9f4aacbdd21315785d222c0116cb2dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026049, "uuid": "baa496fd-b711-4b34-8a83-8918ad78a10f", "comment": "Malware payload (RustyStealer)", "value": "f5ad6ffd40d248c211eea949ac2a0574188dc552d3ff43ba97466bfaf6ca9fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026049, "uuid": "949018c2-ead0-4416-aed0-bb3b75564619", "comment": "Malware payload (RustyStealer)", "value": "49dd9ff3987d75ff9693ad1e01d07eb157cb89dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744026049, "uuid": "33ec6a1e-0db3-4939-a87f-c6ec4027e573", "comment": "Malware payload (RustyStealer)", "value": "a00bbdaa0c201ce72cacdcbef23d8ac5fb2fe52c56cd7d04549cefb7b57a3f682ed5f45b954dadd3efcb2fd318397363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026049, "uuid": "bd7b43e9-a39f-404d-830b-488d742eddac", "value": "T103C67D11FCA81AF8E5EBDA30406D732537323949E7D6AFA70634E3715D522A2FF19248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026049, "uuid": "a8f15069-9220-4490-8c26-9a685108d5b1", "value": "d5bbe0ab32fe5cd8bfc57bbea724fe95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026049, "uuid": "fb53bed0-4114-47fe-b252-44ed4e4500ae", "value": "98304:quAKuVW+jsP7W+B/U0gCYKvvvvtfSTCqEbsA16M1y2kyiaMy+eD9Slz2pE7:qjWPTW+BM05vvvbiaMuEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744026049, "uuid": "27296a43-85fa-475e-9065-fa360bd3aac9", "value": 11684369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744026049, "uuid": "bfb2d531-190c-434f-b17f-06a8360c40c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744026049, "uuid": "757f9fa6-6821-4f1a-bf67-a61838a9dd56", "value": "f5ad6ffd40d248c211eea949ac2a0574188dc552d3ff43ba97466bfaf6ca9fa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef64c958-1366-11f0-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1743999327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999327, "uuid": "6b93f3aa-0520-4b52-bd6d-ccc4a2cc6d48", "comment": "Malware payload (RedLineStealer)", "value": "a4a8789d062a282ae9a7660361622092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999327, "uuid": "76bcb2fd-2a78-4bf6-bbea-8b60b5b28f70", "comment": "Malware payload (RedLineStealer)", "value": "f5c075966955287c5afd2111620fe6946a9e9f96d0bde954a817a586509b1101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999327, "uuid": "824708e6-abba-4395-9e95-6d4c14a502b3", "comment": "Malware payload (RedLineStealer)", "value": "dab419247188971ab1baf4d4b6c2f1dd0b1755f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999327, "uuid": "b280e98d-9c64-449f-b8d1-bce87b927d8b", "comment": "Malware payload (RedLineStealer)", "value": "347128d25984a00fa27002e1943b35efd450e39e03252e4666fe82ede2abbe09fb13ed63cff0dfb6aae7f69faf4155a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999327, "uuid": "9ed5f7e9-a495-42f0-9450-48f7faf12135", "value": "T1CB45BE2273DEC360CB669173BF69B7056EBF38614630B85B2F880D7DA950171262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999327, "uuid": "c0ae56dd-de39-485a-bb2a-035e3317883b", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999327, "uuid": "3f898df5-64d1-496b-b1f6-c2b2f8a7917b", "value": "24576:Fu6J33O0c+JY5UZ+XC0kGso6FaBYJEyG06i4hDWY:Hu0c++OCvkGs9FaBYOyG0BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743999327, "uuid": "2cc742dc-3eb2-465f-b55b-32ae2b2d6f9e", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743999327, "uuid": "8927ba71-0e45-4f56-91aa-002bcc2c3364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999327, "uuid": "be2a116f-c5d7-4253-80e2-d04aaa01c88f", "value": "Verrazane_Q88 V6 (LPG)_07Apr2025.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b51abe-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1744034366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034366, "uuid": "eb9dcb5d-42de-418a-87fa-1200d27afc3b", "comment": "Malware payload (AgentTesla)", "value": "8d4f1253181fbb88561529b4d79aaf56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034366, "uuid": "2454cb84-0ee3-4abe-8d3b-ab62b50f080c", "comment": "Malware payload (AgentTesla)", "value": "f5e170cd71857b3d6e2bd77f37813a6bc19e97a3252514deda910476e2fe8a31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034366, "uuid": "722ef655-faee-4662-84bd-ee16c94229ce", "comment": "Malware payload (AgentTesla)", "value": "e6ff8085bedd296c6c00835db0a370487751ac09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034366, "uuid": "95924387-de4c-4ac1-9956-54ddaa65d495", "comment": "Malware payload (AgentTesla)", "value": "25d1aa2420147baaaf16f285a1790bfe6e780dc53148f5429ecb41ee9cd81e84f94b1c2f430855900f28effa1a8e1983", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034366, "uuid": "c1311b76-ac90-4573-a9c5-806be26a7f67", "value": "T1E535BE22B3DDC360CB769173BF69B7016EBF38614630B85B2F980D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034366, "uuid": "d8624e56-d9ce-4eec-a9b9-b19d981c5af5", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034366, "uuid": "8e46f2d5-dcd8-45b7-87a2-a78d0e7aa4e3", "value": "24576:9u6J33O0c+JY5UZ+XC0kGso6FanpVenOBHinWY:Pu0c++OCvkGs9FanpJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034366, "uuid": "6c933195-ebb1-46c5-b873-577281490bfa", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034366, "uuid": "96700bcc-1047-45c7-966b-b2d5e777528a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034366, "uuid": "52376045-1691-4321-ba43-e2bdd90529bc", "value": "f5e170cd71857b3d6e2bd77f37813a6bc19e97a3252514deda910476e2fe8a31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132c0a57-13ac-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744029022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029022, "uuid": "61265692-3654-49ac-8642-2703001a8329", "comment": "Malware payload", "value": "ac628be6fe1f1230c60b4b13f47710ee", "object_relation": "md5", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029022, "uuid": "c34def9d-5e3d-4d0f-9e0f-c5029897592b", "comment": "Malware payload", "value": "f5e2242485003b4b611a3e7483731751e2c48752a58c005d0a5afe37bcb73219", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029022, "uuid": "b451508a-e46d-4214-9bf4-9c3e337a7549", "comment": "Malware payload", "value": "805e1efae5657ed4f615a9c58acabb2291e9d8d1", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744029022, "uuid": "ba50fb7d-a4c1-4d57-a1da-6314f39b7cdd", "comment": "Malware payload", "value": "b919e58cba57ffcbe0ca89bc77a76e26afb18586537921e52d51a86f13054e17fae0d08abfe25c9d47732c56c9c0efcc", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-23", "colour": "#9DFE2D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029022, "uuid": "5ca0e37e-50c0-4f1d-8f0b-0f44b35ade53", "value": "T19691FD3D8AD56DBD0365777C2E8DCE0E489CF410F9159A2E7089204097223C53DBD6BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029022, "uuid": "77a622c5-e299-4615-ac16-81b112f24a0f", "value": "96:THMhkm3DYmDrdAf8nuL3LyoKgZbr0OeEKb:TH7FwKf8nGyoK/Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744029022, "uuid": "2d9d24d7-180a-4790-91d2-092ba8e8a959", "value": 4291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744029022, "uuid": "16a41c37-81f1-44a0-9f5c-afea3e3cbcbd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744029022, "uuid": "942fa60f-d164-452f-b8cc-e46c019d6d92", "value": "tos1 (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca91792-139b-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744021978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021978, "uuid": "719a7ee2-e107-43e7-bf04-5993509d97ba", "comment": "Malware payload (Mirai)", "value": "aa4aca415b076b3afcaa24cf977ff5fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021978, "uuid": "806394c8-c773-410e-8905-d71aac995fb3", "comment": "Malware payload (Mirai)", "value": "f67f0a9b5f205dccff6e318f0b60b6f037f4f14cbc8d846e8b1e4d77bb9a63f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021978, "uuid": "2c6c1336-cef1-4440-8c94-b21825649c83", "comment": "Malware payload (Mirai)", "value": "336898014e5d1270a382a8c451efafe004c16263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744021978, "uuid": "b1349805-d4cb-4873-b528-b7f6d6f2cea9", "comment": "Malware payload (Mirai)", "value": "a5bf5076d547bb6af2a4ae063c801ad1a51bed8b2de7c784b7942ef1820e1b31104081a918d742bceae8d374c056a144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021978, "uuid": "e7a49b28-59d8-441e-8799-f780253b4217", "value": "T13AF2F12725CC3222EF749EFAAC99138A952E5ED2C4E935A09010E37D394550AD731DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021978, "uuid": "9949a860-094d-4fce-8f22-0a29bd5f8fb7", "value": "768:ycTGB+iteNDvB8sKwqhq+Z3iiFU0frkziux/eJtFLWqisrYk62G:ycT/i0RapZSi6k6iuxGV6yG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744021978, "uuid": "40f06313-44d5-448c-9b98-d26ad4cbae9b", "value": 36272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744021978, "uuid": "f81219a9-b429-47c9-9440-4b4a10067b68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744021978, "uuid": "a1141e56-bc05-4def-b890-d3a1e49021de", "value": "hanoi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51667e2-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (XRed)", "timestamp": 1744034555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034555, "uuid": "cb8784b8-5909-4fd4-affd-da489742be90", "comment": "Malware payload (XRed)", "value": "ccca5f61a3eb0763bf73915aaebadcf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034555, "uuid": "abb7ffcb-5db3-47c6-b911-8f6c3e2c957a", "comment": "Malware payload (XRed)", "value": "f680bcc5942b77e7655c42e53ba64dd3157a90c27f084510ab62f7423f5b3431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034555, "uuid": "e5f4db49-0c35-48cc-8c00-7ddde0c86363", "comment": "Malware payload (XRed)", "value": "af70a5289ae663320acac01687cb72b09d254d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034555, "uuid": "b8f6100e-42eb-43b4-86b3-d33f194d8c21", "comment": "Malware payload (XRed)", "value": "ca15308a962a8976e17d9956cb59f233d24a10f779eef3ed6097ebdb53419a48e0da3d52ceee15b3a97e0a144d1d31c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034555, "uuid": "4dcc2714-efcf-423a-9340-dfc73b9897ad", "value": "T14985BF22B3D98232C6335636AE6AB3545D3F7D511E34B84B3FE42D6C9E35251292C3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034555, "uuid": "9f7990ab-1866-4d3a-9c24-b93d3f726aed", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034555, "uuid": "17a9dd18-a5bb-4d6d-b919-289e11ac2335", "value": "49152:AnsHyjtk2MYC5GDbu0c++OCvkGs9FaBH+kYh:Ansmtk2avB3vkJ9abU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034555, "uuid": "05b8dabb-c2a7-407a-b8e6-0ddb9e1b5aca", "value": 1725952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034555, "uuid": "57af11a5-8a22-4145-ac67-ff4beff4ba2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034555, "uuid": "38ae0970-0b83-4f13-9c6a-e5d5ed8c861a", "value": "f680bcc5942b77e7655c42e53ba64dd3157a90c27f084510ab62f7423f5b3431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdce2bf-13db-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744049491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049491, "uuid": "606dee51-d7a7-4d44-9961-2a2d6244ebcd", "comment": "Malware payload", "value": "3029aac7e14d526fb2b2b21fdd6644a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049491, "uuid": "29e2f62d-f311-4d44-a986-58f5b2b2cddd", "comment": "Malware payload", "value": "f767ca701bac107141e8b08f62c8abb10e2c994db629086a23ebc5f466493c43", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049491, "uuid": "9831df7b-856a-4444-8496-dc6677c27b89", "comment": "Malware payload", "value": "6d346e42c4dd250a140ecb0d3f278f6cab238d5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744049491, "uuid": "fc2a4e51-dd71-4d72-abce-0fdb091696f0", "comment": "Malware payload", "value": "f93fb36283fc390d114c0abb0d6a09eb5d4d591c7b1c8c4b22281d6c753f6bd0c72b7df33c80057a6ffcccf14a08062b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FrostyNeighbor", "colour": "#5B8E38", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049491, "uuid": "e2253a38-c0d7-4c6b-a926-b235b5d232ba", "value": "T16BF36A51B4D18032D962153209F4CBB5AE7EFC700FB55ADF6B940B7E0F202D19A35A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049491, "uuid": "6c486695-000c-41f2-b06d-27d2854436cf", "value": "3d5d5760afe23c07a7c6be6e570893a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049491, "uuid": "26e06b52-21f0-49e6-951b-3572b57375c1", "value": "3072:uX3/Od2h1GaKtff1R49qGCXaoJIs6+leKHOxDdbT4Zi45hGejE1gWykunm2:ufHby9R4chXaEAhxF5DunT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744049491, "uuid": "f0a001b1-4721-42e7-a990-53c33e1d26ef", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744049491, "uuid": "5c0a51e9-d04f-4a52-ba4c-579473540c24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744049491, "uuid": "2b97dff0-1bf7-4342-be12-2deac46b6f01", "value": "f767ca701bac107141e8b08f62c8abb10e2c994db629086a23ebc5f466493c43.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918fb400-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1744038683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038683, "uuid": "a1bbccbb-9301-4da7-a2ee-19db561f50e6", "comment": "Malware payload (LummaStealer)", "value": "c890a4dc51315c8b4a7c4edb9f4e68a0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-9087", "colour": "#BA137F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038683, "uuid": "e5517dae-93b0-4df4-b1a0-175e56214ba7", "comment": "Malware payload (LummaStealer)", "value": "f848ee4787067ca5119cb7a51a1f0164ab0d5473434244454cd94109403d3029", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-9087", "colour": "#BA137F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038683, "uuid": "f5261d2d-ab9c-4e5c-9831-34dd06048370", "comment": "Malware payload (LummaStealer)", "value": "d3fe8eaf4018e695c7c066d977e858745bce8300", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-9087", "colour": "#BA137F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038683, "uuid": "f4f11b8c-27d2-4776-aad7-ebbba8c08eb9", "comment": "Malware payload (LummaStealer)", "value": "6f7ef17917c9677d177204442afc9a3b6ebedf76c9b8c3621af3e6d5b19c30f1df9f40a39db2c949f29676a99c7e155f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-9087", "colour": "#BA137F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038683, "uuid": "48984a6a-3611-41fa-a862-69adca8eb609", "value": "T1EBB533E49C15555383F483CDE82418B6EB69FA4E39BD4EC29606E60F34A38E8CD96730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038683, "uuid": "6f185c5b-6909-40b4-af5c-645c3d605740", "value": "49152:IifP0djsYMW+SJ0Y5nXWhDWZ3VpWpa3EG11StHLNfVsOHu1C+arh:IifPGAYMWXmhDWZ6gUY1S5LNfXeZAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038683, "uuid": "7d12533e-cbcd-442b-ad94-dd88d9f62f92", "value": 2361475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038683, "uuid": "f6811fd5-4156-4247-acae-9d9a9a41f9df", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038683, "uuid": "0cfc7866-e7cd-4a44-8bf2-ab00749251bb", "value": "set\ud835\udce4p_\ud835\udcd3\ud835\udcf8\ud835\udd00\ud835\udcf7\ud835\udcf5\ud835\udcea\ud835\udcf8\ud835\udced_\ud835\udfde\ud835\udfdc\ud835\udd53\ud835\udd5a!_\ud835\udd43\ud835\udd1e\u0442\ud835\udc86\u015c\ud835\udce3.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f14a2b-1383-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1744011471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011471, "uuid": "3041afe0-5dcd-4f97-bc41-5ad2a3ae412c", "comment": "Malware payload (MassLogger)", "value": "7313fff180d481653316e8d8adc2f6d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011471, "uuid": "6a393b01-d338-4014-8e6b-e2c072dd91c3", "comment": "Malware payload (MassLogger)", "value": "f87239bd174493d2b3d1e570a97c945d50ce01b7e4a2b122822b7ef9fc79acac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011471, "uuid": "96b5a010-49b9-438c-aa26-968248f58d25", "comment": "Malware payload (MassLogger)", "value": "3deb740ab0e4fc48a341cb82609aaee393735da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744011471, "uuid": "c097bba5-edfa-42dc-a472-c2923722808e", "comment": "Malware payload (MassLogger)", "value": "2cb1643233d464e4c3f86d274d9c34f3759be63dd4823784f3d8144818bdbd600bffbb7c4756a5ead3144f8b75d30ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011471, "uuid": "138895bf-c822-4116-878f-a23d36aa0104", "value": "T1E5E4BE983650F58FC857C9729E64DE74A6206DAA9307D30391EB2DAFBD0D887DE041F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011471, "uuid": "c450978e-81db-4e5a-b934-0dc77c9151e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011471, "uuid": "e2da2c99-663c-4f2b-8e82-9c4450fdcc44", "value": "12288:skrogmWP9f1OxydpD9aGlVFn49yuEola/vR2nClNFQDFOkAQGp:VtlsxydlV/uO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744011471, "uuid": "3fbb6837-308c-4e9b-85cd-84d38f400074", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744011471, "uuid": "7ad60550-2499-4800-9294-94e5da8dc105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744011471, "uuid": "92e0d32a-645f-4b9d-be93-31ff0f0700f8", "value": "doc2dQie.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d3315d-13ca-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1744042044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042044, "uuid": "b845be4a-27e6-4e7b-b8b8-b445a0ab2387", "comment": "Malware payload (AsyncRAT)", "value": "a8ae234b5b865e3ec4e1da7d71a07b45", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042044, "uuid": "8aa05944-1d1c-4035-8723-86ba2292f0b6", "comment": "Malware payload (AsyncRAT)", "value": "f8c11b55468cf7e9c62c50d2f38acec90e291d15e73efdae0652b6a9d481b4f5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042044, "uuid": "e13889fa-dd28-4763-aeba-c742275f043f", "comment": "Malware payload (AsyncRAT)", "value": "282b7c820ed485f1a1367986d458aae0243eacd2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744042044, "uuid": "dd049047-75d6-45f9-b520-6959963a8f66", "comment": "Malware payload (AsyncRAT)", "value": "de1371092c5dae0a7fefd3396bf80cf59c2e9743926f1374664964bb18ee51a90d79613847354faa24de531555bf8a52", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042044, "uuid": "04fe7170-aadf-4247-82d5-e579c4e8b243", "value": "T11AD6333251A33037EAF129B3F940D1303E2DF3186B5889AAC6D49C5C79689D56EFB346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042044, "uuid": "2406e51e-28bf-4ad6-8b4a-f5dcb2b28c16", "value": "657e40fb09b2c5e277b865a7cf2b8089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042044, "uuid": "0a39f79b-bb11-4450-b226-6468d1a6d80f", "value": "393216:dadmGgD1jIgHnMdgAruskZGaVlkrMSTmX2O4FImKY9WsUQ:dayD1kS0gQ2fVlk1TmmJ3KY9WzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744042044, "uuid": "ca17b82d-2e37-4c00-b2e0-1c5b715e7d5a", "value": 13418656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744042044, "uuid": "f8cf3f80-3a82-4e62-a3d5-99cee9d4ea25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744042044, "uuid": "f0aaa7d5-c841-4b24-942b-4bbb65cef38e", "value": "a8ae234b5b865e3ec4e1da7d71a07b45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1353d39-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1744034468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034468, "uuid": "b30417fb-6a8d-4db5-85d8-613d0f65fed8", "comment": "Malware payload (RemcosRAT)", "value": "8d92ed1d30c078d35172f80528741e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034468, "uuid": "f94582fc-ff1b-42e4-aa75-ba132226ca86", "comment": "Malware payload (RemcosRAT)", "value": "f8e7d4dd80dbc6310544d53632130b51e48cb2364fc66935a3abd61e2897062c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034468, "uuid": "a2ae9a7b-79f5-4639-ab21-28b86181cc7c", "comment": "Malware payload (RemcosRAT)", "value": "8a991c12aaba80da7a91a65dcb0cb29efe88078c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034468, "uuid": "fca403be-7668-41cf-8efb-c3ebd8f9b2a4", "comment": "Malware payload (RemcosRAT)", "value": "ea75256058a035ab30de13c299974288e3f1bb4c5ce79071126b337b0fdc70a05486a46582007b2155130046688a8689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034468, "uuid": "55d8c19e-bc14-49f0-9307-a2b0d4f94720", "value": "T1C555DF2273DEC361CB769173BF69B7016EBF38214630B95B2F980D7DA950161262C7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034468, "uuid": "96a234c6-ea69-430a-b8e7-e205848b33fb", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034468, "uuid": "36ce9dfb-b1d4-4df6-832e-63186d3e8d44", "value": "24576:ku6J33O0c+JY5UZ+XC0kGso6FaJtCLtY2tYIJzN1dVM2lqWY:eu0c++OCvkGs9FaJmPsSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034468, "uuid": "0d77f899-613e-4935-b26d-7585592fc1ac", "value": 1316864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034468, "uuid": "6437349e-6055-4aac-8193-d86089e7bec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034468, "uuid": "330b2f78-87d4-4596-bcdc-d4529a21609c", "value": "f8e7d4dd80dbc6310544d53632130b51e48cb2364fc66935a3abd61e2897062c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20feb82e-13de-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744050520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050520, "uuid": "6f63171d-0956-42a0-a003-3f9d45a57ed4", "comment": "Malware payload", "value": "73655c58082b00b1f4706096fc7c802a", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050520, "uuid": "0dbcae5f-f1dd-44a8-9ab4-d696d6f0f418", "comment": "Malware payload", "value": "f9016b0fe4b7213e5d7af90c7f3345a266112a5b65817ba75f4f6f4e9370991f", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050520, "uuid": "801169c9-d579-4de2-a2ff-131800279cc0", "comment": "Malware payload", "value": "e210cb6673461df4a4f5bf091c5660f8da1caa85", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744050520, "uuid": "7d8a15e5-e9fa-4d05-aad4-b0e26b9b5921", "comment": "Malware payload", "value": "9dfe27fffd2ed257162f6684ce56f22f0b2ac1e1c85118d058b7f9032e8270883e2fc4f21683586a449cc80baebe46b6", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050520, "uuid": "be144af1-3e6d-4b21-97c9-84c583b31399", "value": "T16F55230D7CE9C556D0AF33B86A8AD1A12320DC453D2851CB7B99B3983C783F52AD79C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050520, "uuid": "860fef9f-136c-4df3-bf60-18fedacd582d", "value": "24576:Sr6mDiqxH4fcPe0YiVDvsZT8Tg8vQttCr770rvv6so0:otDZ4EVYZTcvQtg7c3HH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744050520, "uuid": "4ac483d7-ffb4-4193-a062-6847d046f855", "value": 1303040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744050520, "uuid": "c4ce62b6-d879-4757-8ddb-3e7b5ad56bd2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744050520, "uuid": "33b5e62a-c732-4491-a503-9714ed5c6592", "value": "PURCHASE ORDER -6657-980.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de9bfdb-13c2-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1744038462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038462, "uuid": "aac06120-bfd1-4a95-b023-43b38629df3a", "comment": "Malware payload (Mirai)", "value": "5ec5a41aa4d5a098446854913fcd4f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038462, "uuid": "73d49539-8747-4642-b221-a07e12c8a959", "comment": "Malware payload (Mirai)", "value": "f9a08139464b8bcf6f50188bbed184146a99b9c23546356f3603381f72fa4704", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038462, "uuid": "755a02e4-9efa-432e-9ab4-49129d60f0ba", "comment": "Malware payload (Mirai)", "value": "0a707b1f22a3a3ff38ed7cd298c07cf883cfeecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744038462, "uuid": "80437df0-02fb-49f9-9934-91bec72cc9ef", "comment": "Malware payload (Mirai)", "value": "911c5d1de8101e95c70f9bf3d85e9f39f58c0ad5a3de84422260ecf30690c677cf5da55eb68362b39374c111351f2702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038462, "uuid": "70a35548-21cb-4f03-b190-0b84ecee453f", "value": "T1AF3302F2E62BF8153E7355308D848A27B09D6CBC25E2B670E8A15BF5E5C90AB00761C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038462, "uuid": "5769087c-ceb8-4352-9eab-ef0c11c1ad38", "value": "1536:oM2bpM0I4Ku0D0aZHBD2NhdLmPqF1aBexo46Lz9Slxp:ozbW0IXDRha9LYqFUPJSlxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744038462, "uuid": "6435c783-e298-43b7-ae7a-039b83f2113b", "value": 52500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744038462, "uuid": "1e8a1e9d-51de-4689-b9ae-09435404c829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744038462, "uuid": "005c35c8-0b43-4add-901a-2a504b800181", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804a5ad7-1366-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1743999140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999140, "uuid": "aafde58a-0fd0-469b-ab3d-9c2d01eea5d1", "comment": "Malware payload (Prometei)", "value": "96641c561c91cb828374afea9aa9b79f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999140, "uuid": "d36d7606-a217-49fd-94ae-c0fac640507a", "comment": "Malware payload (Prometei)", "value": "fa36cbde5c056be615b6a39bc8ded4607855d3d44e150c907db2aec3d25ab948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999140, "uuid": "99521d3c-0b0f-4ae5-a485-88668d7b389a", "comment": "Malware payload (Prometei)", "value": "1345e25919c79ff33cf72b92ff2c64edfe60e539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1743999140, "uuid": "1a00af93-d44a-4d5b-a171-660d090c027c", "comment": "Malware payload (Prometei)", "value": "17e544b3a7853bd4d47ed636b2c68aabd31cd347ed67318f05a5e6070d5821c8e7d15eab671d8241f05eab589f8822f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999140, "uuid": "9bf341da-1798-4a3a-a774-2a6ca0efdd12", "value": "T14C155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999140, "uuid": "15d0065a-c10b-4c15-826e-8369d6e83984", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplA:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1743999140, "uuid": "728aab69-8bf6-4953-aec4-c5b950b4b30b", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1743999140, "uuid": "2ef3bbe3-7675-4690-a0e9-49f1406f35b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1743999140, "uuid": "60761c78-c291-40d9-8993-2cf85032ecd7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e8a2ec-137f-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744009666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009666, "uuid": "e856ab67-a242-4a67-8786-6bd34d0d6f19", "comment": "Malware payload (Prometei)", "value": "f3624b44dc0da59ef437e59c0f34c7d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009666, "uuid": "67e70ddb-b37f-47c9-bbd6-612033b7cb31", "comment": "Malware payload (Prometei)", "value": "fc2e042db1210a60bf1e594204bd9e6c857159e29ccd777fd541854d66485a5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009666, "uuid": "e08d47ca-6afa-4064-a14b-dc7c11098b29", "comment": "Malware payload (Prometei)", "value": "3e91138ca3c2adf63aa4f283878463e0c2a144b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744009666, "uuid": "c9c1e7a9-efc0-4afc-8857-8453b57c34f3", "comment": "Malware payload (Prometei)", "value": "803b72448a33347f791c6c1b487aaef6b8f5fe0dcfcd5862cd12926533fd26201b1e91059966531f38ad8467d373c414", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009666, "uuid": "a13bd0b7-0f78-43bb-8f6d-8bd45cbffdac", "value": "T128155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009666, "uuid": "17dd2d27-fb60-4685-bda3-0e3ca4910a7c", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mply:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744009666, "uuid": "503660fc-8812-43b5-9b45-64c995a12daf", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744009666, "uuid": "0f0c4924-0be0-4a1f-a89f-68e0ee03f607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744009666, "uuid": "ff822a14-1fa7-4688-9b0a-c87441a5a944", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c533bfa1-1389-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1744014288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014288, "uuid": "f2dba84b-2f1e-4ae3-9b4c-5f39cb3255a7", "comment": "Malware payload", "value": "dfa605ed5f67ec4d9e67136d462b1adb", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014288, "uuid": "21dc9f9a-abd8-4183-814c-7db9d0741c8f", "comment": "Malware payload", "value": "fcf51490b96d913fdb1293d6d7c3c690d6c9eaafa15228ac8b3025eb560ef208", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014288, "uuid": "9f9be023-e8b4-44f4-a1e7-f0ed7096e7f8", "comment": "Malware payload", "value": "356dad29f42815a09b1ddd41ed117755299dabc5", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744014288, "uuid": "fdf3944b-c8e9-41de-a66e-fe6f510d0a74", "comment": "Malware payload", "value": "589bed375882b097a4315467dc887eaa2bcfcbce52b122c5237cc38d9465840bfabb344778947a984bc8a4153e4b9f9c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014288, "uuid": "8328ca7f-c638-40fe-9c76-007d243a90ab", "value": "T1C0C2B03ED6526E65D73B987D212E01F3828D34D16204E20F1288F56C0F6389B97663EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014288, "uuid": "15f4da41-aec6-4fb5-a00d-068022263bd7", "value": "384:hWFpqCJljjss+Uf5Ijm+/XiLd/b7J0W4uMfWP1hbrdagttJD1HFiYa17vt8B8c1N:hWyif+UCj//XiJHJ0Un5iYI1kT17B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744014288, "uuid": "92dd8bd2-9b53-4600-a565-d3084e56a70c", "value": 26566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744014288, "uuid": "a245b245-2fb1-4e72-aa18-ad1d40cae7a6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744014288, "uuid": "24a96214-e94f-464c-9465-bd7d23b53ff1", "value": "Document0132.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50203c7-1384-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744012087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012087, "uuid": "953350e0-e2cb-400a-9d22-c29dc6d516ed", "comment": "Malware payload (Prometei)", "value": "e7cdcd52a3db6dd1bca1134195c9153c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012087, "uuid": "b2114fcf-87be-45a9-8be2-31292a3ad0c1", "comment": "Malware payload (Prometei)", "value": "fe0e6514afbbe4850d589b4e2f264ed5f7d3442bc2b0d13ecad14534ff5d064c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012087, "uuid": "b8f49023-7b14-4758-8b83-d5237768daa0", "comment": "Malware payload (Prometei)", "value": "fdd450a413dbafd4aaded9d10291623d0554ee50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744012087, "uuid": "74757794-20eb-4c19-983c-c9007676cb35", "comment": "Malware payload (Prometei)", "value": "0951095c60cb8c6a20926bdc86a9a239d0725ea411e3cde3b6c0f2e5f201cde8a820630f4744d8c80b2e5ad01424c7e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012087, "uuid": "5f3fb0f8-109a-4f59-8d4f-8ee63a6a39b6", "value": "T1A99423F8C87D2E3098169B3CBB1A826CF0A15772D9562B7EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012087, "uuid": "700b7f68-bd29-4369-8694-d62ed6ad1655", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg5:25WOSACZSV6eKRH5EPiamb4DsDwwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744012087, "uuid": "d4fd75df-8f89-457e-9339-eea2f1b7f90a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744012087, "uuid": "ab2a942b-6e20-400b-90e6-4e3aab73da27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744012087, "uuid": "d427b9ad-c7c9-4f13-8c59-55d0f3b76d5e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5626c89-13b8-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1744034448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034448, "uuid": "275f181b-0f79-4263-b82a-d133d484db1c", "comment": "Malware payload (SnakeKeylogger)", "value": "5c83cbc028c4f88e6117e75bb2c70719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034448, "uuid": "95321b55-ef1d-4bb7-bab9-9c90497e6df2", "comment": "Malware payload (SnakeKeylogger)", "value": "fe1d14a5a0e513bbac75266ae6dd58832b02c85741f22d67d4282590b43daa0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034448, "uuid": "b3f4dcae-d814-478e-841e-03b18812591c", "comment": "Malware payload (SnakeKeylogger)", "value": "9476c9c44823f3bc2f6dd91a651054c23c12d103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034448, "uuid": "314d6570-b97c-4fa0-a202-9e53a7e56fd2", "comment": "Malware payload (SnakeKeylogger)", "value": "d5ac37deaacdfba680774e18cac38cef5dfe9f3eebd508211302d0a0fb2824d9bd2aaa3c479a460686b12c14d003eeef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034448, "uuid": "ba5a01bb-fa2d-4a2d-bfad-8f36f6424bf6", "value": "T16325AE2273DDC360CB669173BF69B7016EBF7C610630B95B2F880D7DA950162262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034448, "uuid": "99f92093-c35a-4820-88ab-918e5b4579c9", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034448, "uuid": "601e460c-18a9-4a50-8a1d-1b25923b72ec", "value": "24576:ou6J33O0c+JY5UZ+XC0kGso6Fagg2BvVTEFNBVWY:Cu0c++OCvkGs9FagLBvxskY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034448, "uuid": "f7bb8e85-377b-48b3-9024-6d1725bb681a", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034448, "uuid": "d59bd5ee-2d71-4100-84dd-066bb83462e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034448, "uuid": "9d003b4b-c1a8-4da0-be36-6b9d52fe8bed", "value": "fe1d14a5a0e513bbac75266ae6dd58832b02c85741f22d67d4282590b43daa0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860311be-13ff-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744064863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744064863, "uuid": "3aba33e9-d589-46d6-94c3-cdab3e0780ef", "comment": "Malware payload (Prometei)", "value": "7312fc3758154dcdbd75a7514a016791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744064863, "uuid": "5ff5d5be-94bb-420b-bed2-0a7d3c4e2e83", "comment": "Malware payload (Prometei)", "value": "fef822b61f07847888d3de58e384aa3bc3a20a87599c25392241bc104c24933a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744064863, "uuid": "42361af1-80eb-45d6-8fde-422c8876903f", "comment": "Malware payload (Prometei)", "value": "ad97d764c94a43fd8914572efff516e60be21f5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744064863, "uuid": "2eb1ece5-2fad-4864-9745-ce32384512f3", "comment": "Malware payload (Prometei)", "value": "b40ee40965fce333e32d0ceead01dd4f172daea67d20ac365f9b2b5f9f86ba0ab5180c8867ae01e4a8d3c3a812d31046", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744064863, "uuid": "6606070b-e49f-439b-aaa5-87dde693f57e", "value": "T1069423F8C87D2E30D8169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744064863, "uuid": "00267fa2-70bd-4b9d-a0d8-a429e4e89c5b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgu:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744064863, "uuid": "011a4883-65c0-4180-adfc-a0d0473c0280", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744064863, "uuid": "a086f6eb-f0cf-456c-a2c4-1419dd7b6471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744064863, "uuid": "7c8be355-de4e-4882-b8d2-df8a4559c0b7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003cd450-13b9-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1744034574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034574, "uuid": "3913fb40-11b0-4594-9251-cd249377043e", "comment": "Malware payload (Formbook)", "value": "896788202cb9472561affa8aea6cc84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034574, "uuid": "75c3b20b-c8ca-44c2-9e8d-e8241785252d", "comment": "Malware payload (Formbook)", "value": "ff60ffef67945adacbec3f49fb146e1813d552d4477a74714fc6f0d951c9c5dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034574, "uuid": "c4f030b7-cd37-41c2-bd76-217de050efb7", "comment": "Malware payload (Formbook)", "value": "e3c8ca6ed9c8aab22d3c0be162433ab78ad51716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744034574, "uuid": "bd50fe29-2f38-4a4d-8986-9065ba691474", "comment": "Malware payload (Formbook)", "value": "fbc4defd2e38f6d2d2cf2ddda0cb58126af7143cec683d6399245afd7749384db86fc1827e45b430f9542de0e290d628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034574, "uuid": "20710815-b30f-43fd-997e-5fd9f1403288", "value": "T1F7F412156075DD07C48B1FB86C60C2B413F99EEEA212DB836FDDADAB70A73052680757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034574, "uuid": "f8392c6a-bcc1-4314-9648-51d0883a641f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034574, "uuid": "89bc14b3-ed13-474a-a6ee-b9e509d1dba7", "value": "12288:N3pzxlloFe1dMOYES7aaStI34saJk5MbgVEhqfDgxD0zh6P3QMH0zWPVfT33:N1lZddFSd+I34saJHbdhqfA+6P3zLtfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744034574, "uuid": "391460ca-934d-4f09-b7da-4ce7f7e67e0e", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744034574, "uuid": "037b9730-46b9-404b-8be3-46ddeb040b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744034574, "uuid": "ed42c897-0c22-43f6-9c47-c3d782a7d46f", "value": "ff60ffef67945adacbec3f49fb146e1813d552d4477a74714fc6f0d951c9c5dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8e75cf-137a-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744007563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007563, "uuid": "2f35ddd9-45a1-427c-ac37-abc8747b2021", "comment": "Malware payload (Prometei)", "value": "8036ca2d842d03f4ea9ec716fbecbda5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007563, "uuid": "c998dcec-0e54-4706-aae2-0ea8ef61c6da", "comment": "Malware payload (Prometei)", "value": "ff6eaf2324dc8734da05eea9a0fac99baf1ecdb31f3a9240e94bd6bc204943f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007563, "uuid": "66e1d7fe-dc5b-403a-a3f6-ae45c507092e", "comment": "Malware payload (Prometei)", "value": "dd8ac90bb68d2739c9779229a7b8c9eab2896be4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744007563, "uuid": "2bc75a37-0738-42e0-ba67-5b7eccf3bc77", "comment": "Malware payload (Prometei)", "value": "3f9b74a5b7d80fe235bec421b79160d89cc0807145e2962d41092b3c137babecf877aeb75a6e18e75111ee23144bce94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007563, "uuid": "4a680271-c077-4254-8eae-dfb7c83221b9", "value": "T1179423F8C83D2E3098169F3CBB5A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007563, "uuid": "59bc4864-6bd0-496b-aed4-8c99266a640a", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgZ:25WOSACZSV6eKRH5EPiamb4DsDwwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744007563, "uuid": "63b3efe3-e1a2-4b5c-8884-edc445a89271", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744007563, "uuid": "8bd6899c-ba32-4173-8350-7ebc07e76708", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744007563, "uuid": "3cac3090-b9e8-416b-b3a4-0ab9aed5732c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcd3f46-13c8-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744041173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041173, "uuid": "1917d6ca-793c-4ff0-a18a-dea64d51a5ad", "comment": "Malware payload (Prometei)", "value": "d6fbd35d2b42614302fcaca22cfec3ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041173, "uuid": "4dcd49d6-067f-4bb8-a255-ccd33863f434", "comment": "Malware payload (Prometei)", "value": "ff789f03ed77a033dec2309b72ecca41a5c717cd7b83223b98940a44d789e0b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041173, "uuid": "28d6c348-ed4e-4e90-8803-7a18de0e7ddd", "comment": "Malware payload (Prometei)", "value": "c1c3b1eae90cac9771a0699d3e6b8e3fb151a526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744041173, "uuid": "08d5d266-01ac-420b-b5c9-44ec33711808", "comment": "Malware payload (Prometei)", "value": "0d6c231d40c3a21f09935066a65b1af21c4d7aa3a00011d75577c5739c96ddd42f99e3d5a3dabde2763b67ae969f2acf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041173, "uuid": "66433797-e6f7-41ba-a697-0d25bfbd5be1", "value": "T1E29423F8C87D2E3098169B3CBB1A8268F0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041173, "uuid": "f3c7e572-e634-436a-9dc6-13ff323fc272", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgZ:25WOSACZSV6eKRH5EPiamb4DsDwwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744041173, "uuid": "cf2aaa1d-7dd4-4cdc-9cca-9695a009136d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744041173, "uuid": "d190f39a-496b-4d94-96c7-1c8c1837e602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744041173, "uuid": "b23f70fc-e762-434d-884d-88d8eccf2391", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9ea43b-13e0-11f0-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1744051373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051373, "uuid": "c7543ac9-862a-48c7-8580-bdf3f66e0d57", "comment": "Malware payload (Prometei)", "value": "a616e8ff0f2b3a0114c460223fe5923c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051373, "uuid": "0f79fe29-8e9c-4cae-936f-d28427550ffa", "comment": "Malware payload (Prometei)", "value": "ffa95099cb71d58fb2ba5ec3b1e47a6c5a20b292477eba9c65601f1926cad216", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051373, "uuid": "5cac0855-46b0-43f0-8596-cb616de4cee9", "comment": "Malware payload (Prometei)", "value": "374773578f69a9679f82b67184a41721f97fce3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1744051373, "uuid": "5fb33b79-52ef-4808-8aee-6477ffc4a05a", "comment": "Malware payload (Prometei)", "value": "865a142b11da3d4f2f881b2b958f9a0ca27a8f663865853872e41a5fc982612f390733f9ade2cf28eba3e7014a6d1f2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051373, "uuid": "5b434eb2-711b-4551-a868-8100836a4e16", "value": "T1E0155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051373, "uuid": "5778b454-cc58-482a-8d18-46b11f031e57", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplG:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1744051373, "uuid": "5e287d83-5618-4957-850b-a21125150317", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1744051373, "uuid": "44dd671e-b339-44da-bbd5-dc0cf84daaf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1744051373, "uuid": "26032cb0-aae3-4fab-b92b-6d43072eb653", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }