{ "Event": { "published": true, "date": "2025-03-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-03-13", "timestamp": 1741910582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9d0166c9-b95d-4c28-afd5-1f4e267e9b64", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e7309b-ffef-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741859157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741859157, "uuid": "9383fe96-b009-4b2a-8e02-1263226f57cb", "comment": "Malware payload (SnakeKeylogger)", "value": "e1dfe7c36363a3127acdb5ff11c35af9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741859157, "uuid": "77fa3b91-e6a7-4828-a2e1-65bec46a6d1e", "comment": "Malware payload (SnakeKeylogger)", "value": "015c7dcc98fd7bbe4f627b0e2645fae31972aad932db069d22fdfdb793b62ad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741859157, "uuid": "e4c2aed5-55ac-41c3-b244-3a8286294e09", "comment": "Malware payload (SnakeKeylogger)", "value": "8578de3001cc7fcef9ce8a2d0ddba7fd2ce171e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741859157, "uuid": "98a05f6e-9198-4abb-833c-bac68fa2c35b", "comment": "Malware payload (SnakeKeylogger)", "value": "dc5f7503b5cf5c6ccea60e6fba7133c199fcd79ab51d7b638989b4b8d2c402efad0b596b94cfdc930599ffafbac90a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741859157, "uuid": "439d95d6-e114-4094-8abf-86c41ed7d4ed", "value": "T1F7250181F648DB64DA140BFC0A54C1B547B12EF9A532C2523DEDACEBB7C0B23A619743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741859157, "uuid": "e4b0ab73-f8a3-4591-b449-3353c3d5eed6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741859157, "uuid": "eacbe6bb-e5c1-40ca-b826-30565da05b0a", "value": "24576:dnOeiMOiXBVlVlVVVWvwjgJo/vWf+AqaVOwzMwRvSU2FNr2WRVlV7:KMpRPPPwvxJYv++ArVOOMgvShPr22Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741859157, "uuid": "d38e13b9-5081-4478-bd05-5d6e7d1dde62", "value": 979464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741859157, "uuid": "ce348b98-9764-4c75-8a75-cc6fa45a391f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741859157, "uuid": "3ed20794-8615-477c-9992-bab9e2dc00c0", "value": "SecuriteInfo.com.Win32.DropperX-gen.23511.10885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d59167-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883226, "uuid": "c1c3d72d-a978-4076-88d6-6eb69ac9dc56", "comment": "Malware payload", "value": "2ec95194d88fd5d372bf8cdb42fd5bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883226, "uuid": "cdca7da5-1bdd-40b7-b840-6df7f7d4f095", "comment": "Malware payload", "value": "01a630b31812b502cadf63d631b6cc78d2947ef5688e5eb329b735861b55bb8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883226, "uuid": "73bb0af6-fa41-449b-9878-7495fa7a3ceb", "comment": "Malware payload", "value": "57f40d14947e7b76dbbff49a087f791e068712d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883226, "uuid": "77228d91-453c-4feb-b805-d9cdaae724d8", "comment": "Malware payload", "value": "233c93979f75be81fd941ee64f9cfcf11df179d747ca8b7077abc099bdd3bcd2e43065b8e333903343ce530371e67d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883226, "uuid": "9800d9e3-a97e-4d04-8713-20d102247cd2", "value": "T155A5D023F2CBE43EE05D1B3B05B2A25494FB6A616422BE5396ECB4ACCF351501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883226, "uuid": "e63fd8ed-9378-4b0c-bd3f-2cf6495405ea", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883226, "uuid": "6a6b410f-aa5b-4887-8a99-49fbde396a6d", "value": "49152:0wREDDMc4KsFQkoibc1ampk3ftiaOXziJD+QzMm1RBoBVtYHqgS:0wREV4HzczW3FMi9+Q4m1PQKqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883226, "uuid": "e9dabe14-9f73-4ef7-9ea9-d872e7ac144e", "value": 2241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883226, "uuid": "1a4302a3-caee-4884-904a-54a16cbe417f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883226, "uuid": "23576ad6-e590-4d1e-859a-8a206a636b12", "value": "adpsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345c95e0-ffaa-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741829195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829195, "uuid": "dd904cfb-dbfd-46fa-ab28-4d01f39ae3ad", "comment": "Malware payload (Prometei)", "value": "17307b682245bc423b9784087f6adefa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829195, "uuid": "5bbdfb0c-117c-4508-b837-4e47633bb891", "comment": "Malware payload (Prometei)", "value": "027b36422095d5dabdeb5425b26694315e950514af5ca925e6455809bc01c680", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829195, "uuid": "a2f8a2b9-279a-43e9-9c34-3cb92d999d02", "comment": "Malware payload (Prometei)", "value": "b74016ba812f8b33ebd11c2eab3c05c41fa28601", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829195, "uuid": "89d753bd-eba0-4dd3-b1b1-79cb3ceca5b6", "comment": "Malware payload (Prometei)", "value": "4d81e4269d27aa3b5e44565186605c1425c8c12a1f9d44928ab5a605ddd0390025af00b6dd4364c26c87da5534f39ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829195, "uuid": "8d551108-cb53-4d12-9ca2-d70deca662e2", "value": "T1E69423F8C87D2E30D8169B3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829195, "uuid": "8ba7cd53-6136-4251-8b52-c0bf422a2477", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgC:25WOSACZSV6eKRH5EPiamb4DsDwwcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741829195, "uuid": "e26f13d4-bfd8-4c54-aadf-6f18879ab124", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741829195, "uuid": "812baaac-0d9d-4f43-a3d8-2849d0175796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829195, "uuid": "84ba86cb-d1da-4c9b-894d-db799c66ade9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe77065f-ffac-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830394, "uuid": "40033a11-def8-4c00-9022-3b3ec1b66abc", "comment": "Malware payload (Mirai)", "value": "36597371f574e5aa2a1193a6ce7aef5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830394, "uuid": "ea1ebf98-c8be-48b3-ac33-1497adda4143", "comment": "Malware payload (Mirai)", "value": "02c9de5eaf279ffee56892621387a9bda3b2978e544f4160ca9f137a06c7aac5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830394, "uuid": "04b194a5-4d40-4e3d-9cb3-363421e2162e", "comment": "Malware payload (Mirai)", "value": "ead9ba244fdd0ef75f864f0f0a6713065a379a27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830394, "uuid": "dd9f8f87-7ea7-4dac-a11d-7bb14fa7d1ca", "comment": "Malware payload (Mirai)", "value": "3eeb5e4e4bea0773ae67018eabebe814a3d6e4ecc0903b8177f87c7cd168f426d80f846d3b13987736d546b427cb89b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830394, "uuid": "ac23ce04-6ee2-4d11-8077-bc39bf591682", "value": "T189532A25AD792E26C0D4B57A51F78324F1F2230E61B8CA1E7CA21E4EFF14B4069173B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830394, "uuid": "42dc3489-cb62-4a1f-8d99-0c79f26c5baa", "value": "768:JNoidfS8q9jcJYGUZNSO1q2mbPmKfT1XWzo8rGgZ3/oiO+o2pAs:JNvfS8SjcJeZNSAtMPzfTZWzToA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830394, "uuid": "cc209418-e0df-408e-a33e-b61cbe8981ec", "value": 60860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830394, "uuid": "e641ba1b-10fd-430f-9453-a4c6fe98c0b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830394, "uuid": "752facad-d513-44c7-a8b1-384ada5815f7", "value": "3atoNational.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9402666d-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860280, "uuid": "fe60d236-8886-4b1b-ac78-5fd9e9cb9a05", "comment": "Malware payload", "value": "832feae0378a9b36c4958812735b6d81", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860280, "uuid": "e8951ed1-537d-41b3-94ef-2fdcbf384261", "comment": "Malware payload", "value": "036aa36f994c7ef36f79d38692079039afb20b2381fc71ff448b405a24df4ebb", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860280, "uuid": "92214647-6272-493d-a827-8fc863f68d6f", "comment": "Malware payload", "value": "73470da480a65fe768691c43c4756641f515ff7c", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860280, "uuid": "c88025b0-fa5b-4ff3-ae31-86fb33935e56", "comment": "Malware payload", "value": "ab969ca2078ed3c6059b9a6eb72fdd7a3d6b2aa96ed58f49fd6022aa4c243436c2276cac3c408f1cff4e7c50cb6d849c", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860280, "uuid": "b1c0f775-c32f-4aad-b26a-fa1242fd381e", "value": "T1354196868C741460CBA3816AA517D740917B2E5397028134FF4CFA51AF861FFD2B07BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860280, "uuid": "84f709dd-97aa-4956-9535-4a7e5efd03fc", "value": "48:PsOo3ZlVnCIDf8mDRaKLPuUhYuSEqJA7qQE0ti+pY4:PsOolVnCRQG4W6qQEIi+pY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860280, "uuid": "f660391c-9724-4336-b27c-fd0b429eb7b3", "value": 2251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860280, "uuid": "8cd16bd5-ef7a-478b-9e7d-0d97e986d3a4", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860280, "uuid": "e97a51f8-47b1-43dd-a440-394d70f6ce99", "value": "036aa36f994c7ef36f79d38692079039afb20b2381fc71ff448b405a24df4ebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336048fd-0022-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741880733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880733, "uuid": "8aeec3c8-14d7-45cd-a110-fb33bd51a73f", "comment": "Malware payload (Formbook)", "value": "1931ca9d0c95028544dbec3b4fe3268a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880733, "uuid": "33df386d-29e6-4543-8fba-4cea9c5342ef", "comment": "Malware payload (Formbook)", "value": "0455ef24ff2458d29a4290cbb77dc9e4d5f222dee1546edfc2e6053453281384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880733, "uuid": "6bb47bfa-6e57-4013-915c-7133859e08ba", "comment": "Malware payload (Formbook)", "value": "a78f5b319cb7943773bc75e70ddb42b8a44be04e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880733, "uuid": "f30b7ea2-aeb3-44a8-866b-4de17e7e8675", "comment": "Malware payload (Formbook)", "value": "95e8795020eb06cc7c9103df028066c0af2557d97df8a94194f00e3cd95c2eb5a6ebbccb97cf5c50fc3d6425d5cdae46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880733, "uuid": "61e4813f-1f31-4772-ae19-0eb4316aae44", "value": "T1DA35BE2273DDC360CB669173BF6A77016EBF78214630B95B2F880D7DA960172162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880733, "uuid": "333406be-1640-4a37-bd8d-196351dc73de", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880733, "uuid": "cc5c4428-0e97-4d7b-a52b-20e0da3d2928", "value": "24576:fu6J33O0c+JY5UZ+XC0kGso6Fa25M4dGvN+F9TFuWY:pu0c++OCvkGs9Fa25M0ge9TfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741880733, "uuid": "a61ec0eb-99bc-42bd-974f-fc985686ac6a", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741880733, "uuid": "ca6c760e-74ae-4fc7-bd4e-e90a379e2e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880733, "uuid": "3a7a3aad-bc52-46f2-9db2-d5acaa81dc30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3e1e4a-005f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741907031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741907031, "uuid": "06169a27-0369-4ec6-9069-0b1d807a26bc", "comment": "Malware payload", "value": "24c9041d844a586bbb1f9190367285b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741907031, "uuid": "f8c99a9b-36f3-4d98-8381-0b296980ed2f", "comment": "Malware payload", "value": "04c4a194a7236f8d9b52f0eb617fc7deb87069fe8e25ff2785588247633d1ed1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741907031, "uuid": "b6fc8363-8c22-43b8-bc4f-11036d386601", "comment": "Malware payload", "value": "f09df65090e04d2a1c73b4723b3c10f2023bf53a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741907031, "uuid": "463f6b8c-d3e3-47cf-b0bc-9d969b8d3a43", "comment": "Malware payload", "value": "a1f8b95a72a800922224aec28017862ffd41ea5bb32d386cbdaf9ea631daf0759890918b7504c245c069a2b9adb8c2d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741907031, "uuid": "95b92a7f-e1cb-42fd-87db-663fba466c02", "value": "T18EF4D046BC92D1B7EA1668B24D28E7C50C5B6A204F3084F77EDC9D646FB36E18932353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741907031, "uuid": "c66e7e17-6127-4f90-b423-7bb6615357e1", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741907031, "uuid": "0bb4290a-16b6-4795-8f88-ccdfaa1d7b7c", "value": "12288:gIJQ/s2kiatVPnIpbWiJ621POPAANU//trPt18bzA/6+MkbUGzQbZyrMF+Tyd7Oc:JBnIpnJhdQAANeFzQb77k9yIMQ47OGdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741907031, "uuid": "f47e806f-5385-4e7d-ba07-36de1e1832e9", "value": 769856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741907031, "uuid": "023bf38d-aacc-40e5-922d-bbc6cb5abdf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741907031, "uuid": "6395c3e5-2fbf-429b-aa2c-109efbf92b15", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442bc78c-0057-11f0-ad17-42010a9c0004", "comment": "Malware payload (RustyStealer)", "timestamp": 1741903525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903525, "uuid": "8497523a-aaf1-451b-8926-e95878f20b4c", "comment": "Malware payload (RustyStealer)", "value": "249de42f434229976e00cd806f22675e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903525, "uuid": "d9b4f885-a181-4e5d-9a0d-85d7f0e2b8ee", "comment": "Malware payload (RustyStealer)", "value": "04dddda642639583683469831a0ede2d24ba50c7104fa68fd256e7d03760f48b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903525, "uuid": "61e655ab-c865-4414-ad59-829c86442a55", "comment": "Malware payload (RustyStealer)", "value": "f753b175ac812622d68d59c8a4880c59c18149f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903525, "uuid": "53aa4212-2efb-47be-a460-bed3a518c5d2", "comment": "Malware payload (RustyStealer)", "value": "af7a6fe3d98c2c1d2593b3f82fa392c782a3dcc141bd9ffbd8dc01be51c7580ad717fcc73176b3fbb286175eb0a9dbcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903525, "uuid": "bd9d00dd-369e-4402-9cc2-2d1951f6c386", "value": "T147966B12B65BF5ADD01AC4B08346C62B5A61748B0B35A9FB42F4853D3E6BBF81E3C705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903525, "uuid": "64f39ca7-3a57-4a3f-9124-20ec99e57efe", "value": "4b1fce7f840e97ea948f4e91468243fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903525, "uuid": "3d8cd9e9-3add-4abe-9489-c3d76fd6ea4a", "value": "98304:0NSJ364Vfev6nBUaPinth7JBBulA7ubrOb6565:Q4VfroBBulA7WOb6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741903525, "uuid": "404cb66c-6a1d-4d94-980a-4cb327bee52e", "value": 9027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741903525, "uuid": "fa75c2d6-0013-4dbe-a44b-c42d5ef3ce4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903525, "uuid": "a0f5ac12-f93d-44a9-b784-21cb4fd76f1d", "value": "repak-gui.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6bef6f-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (CoinMiner)", "timestamp": 1741873211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873211, "uuid": "89840403-bff9-43a0-aa1f-0e012bb900fc", "comment": "Malware payload (CoinMiner)", "value": "bcbec491d2bfb6d8d4535db70c1337e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873211, "uuid": "fdd11871-cdd1-4968-b047-03bee5d61889", "comment": "Malware payload (CoinMiner)", "value": "05202da1437f2aca2b896a17ad50182877480e7a3f191141edf138c2d6071c82", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873211, "uuid": "672aa509-5bb2-4651-9007-9c152453a9ae", "comment": "Malware payload (CoinMiner)", "value": "4b3515901dbe15420ed21af4a2fab65e01db177b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873211, "uuid": "37d563f8-4041-406b-ae6d-b775f1cd43dc", "comment": "Malware payload (CoinMiner)", "value": "0b277da10a5c3cf8ac85f6fe30effc82e35b20cee5c61479bf6779791019d697aaa2f39c585bed3fda02e64cb3a25712", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873211, "uuid": "3d56bb5e-01ab-4f80-8fc2-7977f0e62703", "value": "T16E66F19485237AE48E59E668BE06DB1E050A063375BB21CD0ACE1B9D1B5F3DFF35204E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873211, "uuid": "4c218b1b-d164-4703-9226-c5a683d805e1", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873211, "uuid": "55a0c750-60a9-42a5-a8ec-cb8f9832132c", "value": "98304:1u7BnKyW7DacgxdWTfryr6pcwZMoKNgoA2oXECx3KZaxoJbcfgVf32kOmPgV7VQd:2AgW/yr2vQghita8f32/zD/RfbO2zQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741873211, "uuid": "e9a98e8e-8fb1-4fa7-8eef-7ee00022fc51", "value": 7114240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741873211, "uuid": "da8b9eb5-5901-46dc-bee3-3792556399b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873211, "uuid": "106e6e9e-3835-45d8-9508-34b7fa45fcce", "value": "nngg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ef59c2-ffba-11ef-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741836317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836317, "uuid": "bee1a0aa-cb84-40c7-9430-845ede457786", "comment": "Malware payload (DCRat)", "value": "18a522badcf9e8402fb0415b348249c4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836317, "uuid": "81798628-71f5-4047-b43e-c0f02287277f", "comment": "Malware payload (DCRat)", "value": "059d3adbb214ffefa1949a22bf008dc51caf6b5b7042f3e5e5f9ac3b4d22e16a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836317, "uuid": "cd10dbde-8248-4ea5-b7ad-354d34bafe6e", "comment": "Malware payload (DCRat)", "value": "f670b20e1fcfcd0d0f1657469b9449f3ef2dc7a3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836317, "uuid": "c6ce1c4a-f356-42bc-90df-185e3ad28e3d", "comment": "Malware payload (DCRat)", "value": "8fbc7cee1ada255be18a6e486907d1fe79bf57a612aff3194f6052616e52422e5979e404fd05f3ad3e32705dcf3d943e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836317, "uuid": "1c2d4f71-3b6c-45a7-9de0-c6acb301c78a", "value": "T12406F10A56924E37D2A0573180A7043EA2E5C77A3A72FF1B351F24D678137B5CA732A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836317, "uuid": "ff2f43c0-e0dd-4240-871c-f160185d7e6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836317, "uuid": "bbcea6f0-3773-4685-9ca1-9982805dacb9", "value": "49152:1az3ZdkrfuLPLz5m0Gt4uYcpKkxnMZ2Yd4yrUKPKYnSCPJKglNwgN+kNF/90u:0z3UjulfbCxM0Ymyr0bAlmm7DH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741836317, "uuid": "e06dfdb2-ce2e-4f1a-852d-b0d9c3ef43c9", "value": 3699200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741836317, "uuid": "93f4a6ff-c57d-4f0d-9bf7-0a10f5ffe479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836317, "uuid": "6c7933f8-4a6a-415f-9c4f-b701501fbb49", "value": "18a522badcf9e8402fb0415b348249c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6924adb-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Metasploit)", "timestamp": 1741855667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855667, "uuid": "d98772fd-86ff-45c9-a71a-1ff4fb2b8e57", "comment": "Malware payload (Metasploit)", "value": "c60bd744fca53992b9b1085750e96767", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855667, "uuid": "9a237e0d-5a89-4426-9822-a9e1dffffbba", "comment": "Malware payload (Metasploit)", "value": "0636c501c89341ec7f893d7e221ff932db330d7f90e9b0bd53b47012f446a31a", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855667, "uuid": "e98ddc4a-5103-4f70-bfc6-55bf08f323fe", "comment": "Malware payload (Metasploit)", "value": "00461eb8f5b03361c2efd25d3212d91e834251bf", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855667, "uuid": "46096bcc-2c71-4bdd-80c3-d15dc038e61f", "comment": "Malware payload (Metasploit)", "value": "b9e2f17742ecb857aab5cbbf56a8dd145d5445632cdb1ee162defaea98e8f7039607c3dfc8a0b85d8aa595fddf1998d1", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855667, "uuid": "62eac8ec-0a96-4406-bfa5-a9e0e5abfb27", "value": "T188B1C3933087F59F008583BA394867E6907AC615E6CE6045F38C9FAEB9DDE533A4C2C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855667, "uuid": "7d201241-46f8-4a35-841a-fcdc4afc6895", "value": "96:I2CHuSChFNgQfBZL0W6qd5YDD/rfwZHHNlrEpNaxGHH6v0l4Ul:I2ZFwW6qd2DD/EZHHNYUs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855667, "uuid": "3af94db8-b2d4-4d30-8db3-3634da07bf9a", "value": 5206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855667, "uuid": "6ae520eb-9afe-43c0-9204-cd188b685736", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855667, "uuid": "905178cf-2391-4318-971a-7b9bd1c7aa59", "value": "443_2003_payload_local.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fb1b7a-0050-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741900793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900793, "uuid": "66382d9e-0aad-459e-a3e5-d8f2dda023b1", "comment": "Malware payload", "value": "14eac5d4385edf42ee4b30a738348c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900793, "uuid": "9e09f823-ae2a-4332-bf50-4d4ffde0cf67", "comment": "Malware payload", "value": "0638ab8a2a8a1c7d8e7f5b5fd0b267d875a8298a166e929cc85bd69122657800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900793, "uuid": "7c2cddfd-31b7-4173-b0c1-0138fdc49183", "comment": "Malware payload", "value": "ebdd198f3cc8250d279773cbbd85422c5a2ffdb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900793, "uuid": "7ca14f13-2768-4ee4-baeb-c1f039cadb12", "comment": "Malware payload", "value": "97b06adc863ea53ec1e926850a5552414edd60ed5b7d6ba9b8f416523069f19114deb6d055d29105918cce3c4f878fed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900793, "uuid": "fcc90785-ab2a-472a-ba36-cc2498dc032d", "value": "T1FD351221DB9ECE61CB6FC7B609D90F049B71F90297D387BB2DD891B5B6872442D08398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900793, "uuid": "5926fd39-f0bc-46d0-8a20-dde62560b4ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900793, "uuid": "ede80f63-4c2f-45d2-bab7-85218eb0c84f", "value": "24576:HugHDkJgxyAFQBsGNGHICvMh8RSEAbLvK9EkPHrh1YA00:/HDl13G7CvMh8RSBQHrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741900793, "uuid": "67d0b1ad-81e0-4de8-a29c-73ba88ebb798", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741900793, "uuid": "f8a936be-4d79-44c7-8732-6460afb8e4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900793, "uuid": "297f0dae-fec0-4d9b-aa91-5ea15b2a63ca", "value": "SecuriteInfo.com.Win32.CrypterX-gen.1798.12497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf04025f-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860352, "uuid": "219ba2aa-23a5-42b6-a803-2d973061bce1", "comment": "Malware payload", "value": "3cf605b4d4423fb6d067b08b293e6861", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860352, "uuid": "e96dceda-7cb6-4267-b0df-3ca7fdf52e7e", "comment": "Malware payload", "value": "073f19d6d2b2e9ff75d3b728c71876ccf389b4bdd90510ca5603d0cf075b8b53", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860352, "uuid": "fc570a72-49bc-4a73-bea0-dfe881d30f0d", "comment": "Malware payload", "value": "0a17e4a602b6904fe0995052af37d76467c4507a", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860352, "uuid": "8cffa9fa-8ba9-4cc7-a9a2-add4b585a713", "comment": "Malware payload", "value": "060e4e4cdca7d3a327afa6e134289111672ba91ae5f5cb0b5b4a8c1dd39c06cefb1b2ba438f8decf773674eb64aa940d", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860352, "uuid": "99be4fd4-339f-460c-b549-b303620694a2", "value": "T1BFE020119C88D5A444B5576B0375D448FED7C0571150EE993ECC97179F720E10E4396D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860352, "uuid": "489df496-e6d0-4040-a064-479464897398", "value": "6:TMVBd/61YOXXCFiEqr1J8GUHnBkJ2IuPJ25KWZ4wH8aemNdMeq:TMHdC1tSoEqr1onGUI8J25KWjH8NCdMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860352, "uuid": "a2c23554-7e4f-45cb-a58c-201f36b4f33f", "value": 383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860352, "uuid": "289112fc-e1c4-4574-a161-1d60356c42d8", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860352, "uuid": "1428989b-64fa-4123-a3c6-ecf8733c241b", "value": "coi.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2fc8d3-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883161, "uuid": "a458390f-16f0-47f0-82bd-76f5077a1ef4", "comment": "Malware payload", "value": "aa2835ff9b90e17b4362705e3985cc0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883161, "uuid": "6f6c27e0-b716-4872-aac6-8634326d58db", "comment": "Malware payload", "value": "07ed5f11b4320fbb24125495f3d43bd6c4cd739ef19ce0219008724252247443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883161, "uuid": "fbe017e8-a0cf-48d8-add1-aa62efbcfe01", "comment": "Malware payload", "value": "317c681a1f31f183de1fd50e3ea1b9fbe88bd7a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883161, "uuid": "b24c5935-d1d6-4f39-9061-f81c99b6080b", "comment": "Malware payload", "value": "ffb673a169e88f0219f2f7fcf83882f498536ce89ab52685360ee0f23a9b8038a647bc69397de9c9b96e69c1d3ae1086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883161, "uuid": "844832dd-b0bb-4ac0-b027-da4f4d2f3131", "value": "T18656BF31724AC42BD66305B12A2D9ADF5528BF350BB164CBB3CC2E6E5BB45C21336E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883161, "uuid": "f026ad91-3c2b-49a9-921e-ffc4b645660b", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883161, "uuid": "0d58abf6-b8d6-465f-bc30-fa856630d9b2", "value": "98304:xtfl0kYax0dMiNsqWGXwtyUwuznk714XTmhsTWuODmt2e7R:bfl0kYa0Rubk4Dm2iDq2e9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883161, "uuid": "513047a0-2d6b-4bf3-8cc6-9b3f13ea7148", "value": 5926464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883161, "uuid": "d51eabde-bb15-4d88-a259-178a5e1a2a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883161, "uuid": "498038f3-7611-49e5-a4ec-3e12c2251d18", "value": "PDFizer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4df6e43-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848712, "uuid": "4ecad51a-ac5e-4447-9020-f85543741433", "comment": "Malware payload (Mirai)", "value": "86ea9c179b4bd9bfc916b8a89706c693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848712, "uuid": "5f611c15-5fb9-462e-aab5-5462580f7cd5", "comment": "Malware payload (Mirai)", "value": "082f8c2f7254acea639fe7d3b99afed284cfd6ad009bb812e4851ebe9a5cbcbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848712, "uuid": "b400c6e8-17de-45ab-b511-240736e8d108", "comment": "Malware payload (Mirai)", "value": "5f859703a5f749447ceaec62ad1d424387799afb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848712, "uuid": "48e5363b-d6df-4af2-b30e-3ea3d0177879", "comment": "Malware payload (Mirai)", "value": "579fa74a4a5c6acafe3e283f3ab4cef6cf6122cd28ed0d1b30e4081c0924dae857b6c63e7533166b2979ab664e4d6fd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848712, "uuid": "cc528a63-6c6d-43d5-a29b-5e19d27173dc", "value": "T19E830952BC829A2BC6D0237AF66F659D332073E5E2CA7217CD140F247AC561F0E66F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848712, "uuid": "31c17270-0f73-4a1e-ad35-24a5c6aad633", "value": "1536:OnzJkJ80LMEvYikhOCEKKQ6ay1eJ2lBJssqYiUaffwTOinA+6PE:wJF0LMMS144GiQTOUp6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848712, "uuid": "000c6e5e-a014-4577-9f83-d6e538c929e5", "value": 85788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848712, "uuid": "97fcd762-e4fc-4e03-a782-a7c1d3323a60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848712, "uuid": "e56260ab-2bea-4f52-bda5-c3cd2b12c39d", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0204d76e-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883228, "uuid": "e96632e1-1bea-4fa3-a49d-f26ed9d67f93", "comment": "Malware payload", "value": "c5060035d6651f1e7727736db27237f3", "object_relation": "md5", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883228, "uuid": "b120ea69-354f-4cfe-8c1e-3bf2b3610dd2", "comment": "Malware payload", "value": "08ae6a83a8577ef69b05e8331d7e3cd6377f39a1a71f3dc45e2de4f990a032d5", "object_relation": "sha256", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883228, "uuid": "44f944e8-91fc-4c0a-8564-d83d44b89ec4", "comment": "Malware payload", "value": "89aa7f83ee5863abbcfd001ad6411e2d9d38e4de", "object_relation": "sha1", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883228, "uuid": "797fe239-f1fa-48fc-9352-aa6f4d38ea9f", "comment": "Malware payload", "value": "6794e959927ddf792509b96a367b5c68625be10caefb599f8750586039f0ae54bd993f0b919a861b1a6932b626594ee2", "object_relation": "sha3-384", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883228, "uuid": "90208d75-07e6-4e68-a533-877a805db4ae", "value": "T12F1633BDFCBA614F4E00D331263731DD9F81A960B9D493D8BAAB5FEC5D0720AD640169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883228, "uuid": "8b269299-8bc5-47d4-b257-3f1c3a830230", "value": "98304:YgCOHAp+TqifPP0lJ44UFq8318UitPlB3bw2GWCDfG0CPZrdU5qC2E/:YgCOHE+TqEPO4Q83mbT3bRHCL0ZrdiqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883228, "uuid": "5ea836c9-8eab-4321-aae0-70bd2d72d410", "value": 4154634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883228, "uuid": "6fe30cd3-c206-48ab-a174-db9210939fb4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883228, "uuid": "11fa8735-30fe-41af-b452-fdef1e9335a2", "value": "server.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67899dd-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849627, "uuid": "4b96c71b-ba09-4cc1-b50c-2b68522f820c", "comment": "Malware payload (Mirai)", "value": "169e56ea35989ca35871ab118ba8830b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849627, "uuid": "f21e925f-1f21-4b5d-a8b9-5c1d428cfed7", "comment": "Malware payload (Mirai)", "value": "08b775d53d69952ee6aa20e9687bf33ad0895d4c85b329d3d61ee1238834ec2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849627, "uuid": "4ac4c8c0-6746-4b35-88af-5d031e444671", "comment": "Malware payload (Mirai)", "value": "eb3870897e41cfc39e3c45738a4d088ae4b50930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849627, "uuid": "49c72be1-8ebe-41fb-add8-7cc9e85e0b3f", "comment": "Malware payload (Mirai)", "value": "a82b37b43f5b52f6a1649057371cf85e0f722eeb26d5aa77893bfd51233dbd1146af3e6de2c38a59e47b3291f13f3839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849627, "uuid": "82d59a52-27c9-4a92-adf4-9f2a9351e346", "value": "T10F431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849627, "uuid": "e6026ee2-6386-4a54-81c5-02c12405ea95", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwg:RqtmZPuutfbltZFBSJsBcfDSTFI+BEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849627, "uuid": "f50bc207-d599-462c-9252-bde851712966", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849627, "uuid": "66077adf-e4de-4049-b9d1-a3ad22e95d42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849627, "uuid": "2887ae55-1052-44fe-a038-8e6559ac2dfe", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b508c3-0033-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741888223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888223, "uuid": "9fb99ed4-49df-4edc-bf61-a67e29fff381", "comment": "Malware payload", "value": "c01657eadbdc9aee511a12fa4ae81a68", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888223, "uuid": "98335e2c-b076-4bc5-a291-bba45dbb8475", "comment": "Malware payload", "value": "09127759c0f2cccd8485850e83f3d4ac030f83f89c7ca5443075017a900ab7a9", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888223, "uuid": "eb764a65-07bc-4365-bd82-b8bc105ba4fc", "comment": "Malware payload", "value": "6aae123d0d7a9ab50eeb7b2bbb54902caa96b392", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888223, "uuid": "7efbe230-b603-4f6c-bbb4-2fb1d65e4eb9", "comment": "Malware payload", "value": "cd0b6093b0d97a5edda68743c7a54ef33b9dd5a7458795dce83fd4298d68e3040ad82600d1c75f3d645bdcf10d4fdae1", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888223, "uuid": "9b13c67a-eb6a-4071-8d36-c502b7b998f6", "value": "T118D30223B5D9B896D1755C70197DB326DE3F70F10F34909BD7C7A226853988A483AB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888223, "uuid": "f999b9d8-a213-4a74-858d-31d6249fcc13", "value": "8db850cafca1b93b3992b1a0396fd63f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888223, "uuid": "8b7b6997-fa3d-4e56-828b-1892ae43e3ee", "value": "1536:D34T6oDvcFKoueHT8PjdxDA3DC+WlEQhvoOskxZHqAskDxFxodeR2x3CK2WnM/fH:DIAeacjdxkDCNlJRmk3HlFlblOQcXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741888223, "uuid": "2f7ef0f5-ceb9-484a-ad88-213bad7320ad", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741888223, "uuid": "430cde0f-b44d-4d8a-98a3-218c9456ebf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888223, "uuid": "f1c30e1f-1d6a-42d0-9502-0753985045af", "value": "us3194vbx0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841b4888-ffb7-11ef-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1741834913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834913, "uuid": "8d9b052f-bd0f-4fef-b1db-2450972aa199", "comment": "Malware payload (SSHdKit)", "value": "c08a5a0b5e8284dcbd3b474ee322cc5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834913, "uuid": "fc6e15a5-3424-4331-a86b-566a1a5bb111", "comment": "Malware payload (SSHdKit)", "value": "09da574532ec155408516fcd6f4ba76efc6aab88dfa2dfeab10089cf991e5128", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834913, "uuid": "de3a66f2-5708-4eb4-a159-4602d988bdc3", "comment": "Malware payload (SSHdKit)", "value": "2e6d0f86e06435dc027a6fa5adbcfc0f9f998288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834913, "uuid": "53db7b2e-9531-4815-bcea-bc49eb8ab7f4", "comment": "Malware payload (SSHdKit)", "value": "caee6a4f8ad9b1fe7e673c555a7a4d0dbf7147e52033ae3a194b104265cfd495743cf47d29c685a2bfbbf2cf043d24de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834913, "uuid": "8dbdaa4b-dd1a-4213-8189-2f87ca2ec709", "value": "T1AF356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834913, "uuid": "f9208103-0388-4765-bb7b-5e86e2222cdc", "value": "12288:E8dASOYRNCAJump208iJftl7zenSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO/8+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741834913, "uuid": "5accdf03-6922-472b-8eba-a7596ef41057", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741834913, "uuid": "ca9c539d-fdac-470a-8d64-6dcdbac6f8cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834913, "uuid": "25fa940a-0e8c-4f31-867c-cfcdc7b96c5a", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc768f4-0059-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904638, "uuid": "6fdc5e7b-d16a-47c5-ad81-fab92fc51d74", "comment": "Malware payload", "value": "a0b2da56f51651f825edc48016a06ce3", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904638, "uuid": "ebacca42-ccb5-4678-b42c-acc65004aa0f", "comment": "Malware payload", "value": "0a263703a49b6220a5b05b83ce9a89528e16cd09efb3c6e7671344c8ddb5c224", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904638, "uuid": "c0b9e461-a454-4765-a7f8-31fd4f418829", "comment": "Malware payload", "value": "9b8c5da97230b768f70f4afd1da94ac93accab70", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904638, "uuid": "23ebfecb-a376-4232-878e-3bfcda94a919", "comment": "Malware payload", "value": "d078085e2f9d5a45da9c096d52bff6a5e0196a9102c9564f03045a1c741d6f5e52d1e72599b9fec13c827b1e1818232e", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904638, "uuid": "301e9bfb-3952-4c88-9457-e3f8426a369f", "value": "T165E59F15B9EAC236E5BE41305A6DDB3BA1F83EE7077144EB67D855AE0E718C10231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904638, "uuid": "06f4c46a-a1a4-4c0a-876d-d80a731d1a7f", "value": "49152:OWmFaYb7oC8YuJdvh2qVAnqpdoVG/AYQJcQTqFQaKn6j2yBEeI+ji8NvuqmSJhN1:DYHX8YuJdvh2id1AdWQTAj2y9e0gWg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904638, "uuid": "06e360d6-cf1a-42b9-801c-94a531d97157", "value": 3177472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904638, "uuid": "9a8a0ecb-3cc9-463e-902c-06921fd4e9bf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904638, "uuid": "c526a5a9-8352-4d81-916c-ae632784b646", "value": "AIE7578.tmp (copy)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca7f5f0-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741855704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855704, "uuid": "d35a35e9-a326-45de-b2bf-dab1347f4eed", "comment": "Malware payload", "value": "867b04e4c196d9adfa5c254d6bce02b5", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855704, "uuid": "df521c02-1b91-40a6-baf6-de26157e373c", "comment": "Malware payload", "value": "0a50a04f594a4ddccc8871e75728f5f9ba990b714a4be594baedd72b895f0a20", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855704, "uuid": "ca7c987e-7c3e-44c8-9cdf-0b9aeb79bdf4", "comment": "Malware payload", "value": "70c06afb9a059a572b979dd181c85b006a47b1f6", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855704, "uuid": "711fa74a-69fb-4a02-ba5f-d37c35d0ab88", "comment": "Malware payload", "value": "510cb03c28faa0debbb0b27c291373e8cc5f1418488dbb5dd8a2d341033ac84f9dd411a69cffb5e09a18e00d23cd3bb9", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855704, "uuid": "425294cb-4e48-42b6-aa3c-50fe78c29855", "value": "T1D9E02DB20122ACE0216EBE08A8085C8AA7F80578C3BF8CB8730791D10911F80229E054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855704, "uuid": "a3452568-a79b-4340-bda6-ed4e9fa24aa7", "value": "6:tgp4KHC01um4FkJ3fA/TnajUXsQQl2aoEurY6nlgej7tg2DMAPstKdSn:tgw01um4eZfA/Tn/ehurEyMAqKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855704, "uuid": "90b6b3f9-f091-4020-a233-b366f3eeec93", "value": 324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855704, "uuid": "f0dd81af-0c98-4788-8a5e-173798e9c350", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855704, "uuid": "0d9b6b2c-fe9b-4e76-9f89-834dd16b517a", "value": "shell_tcp_2003_x64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d58eb9d-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883381, "uuid": "ad48b562-7dc4-43c1-acbf-101b1b9fd197", "comment": "Malware payload", "value": "8be7c3055fad9565e8f30c538cc74952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883381, "uuid": "1ca0485c-9d04-48b7-af9c-eb106bd07eea", "comment": "Malware payload", "value": "0b03c9dc6a41e123533a3acc9d2881f2dbe01224d374402d81ac6d784d6ff0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883381, "uuid": "29c982ff-23b7-4e1a-aad3-94a929010e31", "comment": "Malware payload", "value": "9dfb6cd153db36ff40d85675e000d5d0d542a319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883381, "uuid": "5416c5df-200b-4b08-8850-acd2faae7fdf", "comment": "Malware payload", "value": "eea151e531d30a225fe7147c4a3e35f24bf45e8c3c6d6e3f5156f87fed65dbda165bd31fb5af6b4f2ee69aa03269af9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883381, "uuid": "3670c1c2-a8ff-45c0-8928-9f57df0b7b10", "value": "T1FFA5D023F2CBE03EE05D0B3B05B2A15494FB6A616822BD5796ECB4ACCF751601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883381, "uuid": "e53d65b7-4dd9-44e4-90c8-011efdfa6358", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883381, "uuid": "261642f2-5978-404c-a306-af0dba6e5b51", "value": "49152:9wREDDMTZHIu89rn8bf3ftiaOXziJD+QzMm1RBoBVtYHqgw:9wREKG/rcf3FMi9+Q4m1PQKq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883381, "uuid": "90f4e322-c854-4bfe-994d-5f6e51077b05", "value": 2241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883381, "uuid": "f1ac9af8-a7bc-456e-af00-fce59dedfe2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883381, "uuid": "333ada67-b8dc-47e1-834a-3fef42f79a5b", "value": "adpsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8036c2d-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848717, "uuid": "0a2d133d-99ff-4b64-8160-c4a5b210a17b", "comment": "Malware payload (Mirai)", "value": "80d6626a0f6f960cad33618f2bdeb6d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848717, "uuid": "34e0ea11-0f09-42aa-8475-d6f470d275ba", "comment": "Malware payload (Mirai)", "value": "0b0bd9f5fc6aa2e7f33aaf8d5eb2b7811e932103af1e33b676a6459a42b3860b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848717, "uuid": "c24d4e42-73b1-4c50-b6b7-14eabf8c7162", "comment": "Malware payload (Mirai)", "value": "6c879e9a9ad895fd804a35ac8ac9ba216b2ea054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848717, "uuid": "ff8a657a-24a6-41c7-acda-911d861bbacb", "comment": "Malware payload (Mirai)", "value": "4b7de4c283eafa22e4bcffca40a85efca16109210bdda21d31aa0e1627e77c4230111c3a1faac03e82c7c48c620965bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848717, "uuid": "18d75370-ee77-464b-a9fe-e7b9a54108dd", "value": "T1F3733999B4029E7CF90BDABD54254E0EEC21638152930F2B66BBFD933C731A5AD03C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848717, "uuid": "4ece4813-4643-4b04-8021-28ba43ca25f4", "value": "1536:mwUvSHdufBYf3s30/lSk+FJItH2Qao1w68VwieZYbnOJ8ZCQMvfL78vdxo8q6Mvr:MSS0/lSk+FJItH2Qaf68VneZynOJ8ZCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848717, "uuid": "2cf4027d-3aa0-4675-97cf-ff3752d956bc", "value": 80028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848717, "uuid": "4eeb2f07-0485-4b84-b078-f931996ca25d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848717, "uuid": "c306ae4c-720c-4752-bf83-5011d4e463e4", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e3176f-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741833579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833579, "uuid": "89f8fa89-9de1-483b-9aca-30d63f8a57e4", "comment": "Malware payload", "value": "eea9b7d9445c7f24a101c7f6c29a71e2", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833579, "uuid": "1ec489de-c1d3-4127-841a-d6985861d920", "comment": "Malware payload", "value": "0b1a3164701058728ae56e4cdacb8370bf9cb97ba3b12631edd728cbb97049d8", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833579, "uuid": "e7eeda28-77eb-45b5-a3f1-5ce7f24dbe34", "comment": "Malware payload", "value": "b73a2447dd00203d0129656be52c0eb2607f6180", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833579, "uuid": "13a27a2c-d3ff-4af8-91ba-340f8cf931c7", "comment": "Malware payload", "value": "f59ab4c84d79f12ec9f283398cf4cec13b50bca7f2ed1625f1548fbc320f3a4ff6318fd6c6e5eee63a9341870f62e2a0", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833579, "uuid": "b40a2b0a-9f62-4695-9a75-c6e3de65fa05", "value": "T1E024B3127300EE0AC82357392460F7F0122A5F947799E2A6A5F6FD73B477A865DF82C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833579, "uuid": "4ee6bcd2-fe67-4786-98d2-7d1a60c7be54", "value": "42d6b77061a425117bd9c13cd36d957d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833579, "uuid": "2879ec2f-0e99-4cc6-8c8f-5061c4515e99", "value": "1536:QNdi+Cl+1nStNa55DZebHBsWBAKPWCkk63rziTLIZ7ODfzmfrbPm7x3pcZKnUKAp:UdStNa5nGswA3UyM3o9J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833579, "uuid": "91203b65-db58-4b51-a55c-f16b2a7b4204", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833579, "uuid": "6554d29d-aba0-4c3f-a457-405f7b60aeae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833579, "uuid": "54d504e3-e72f-446e-9cc4-3d83c30100e1", "value": "vwrfktzdxlp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e2ff37-0002-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741867126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867126, "uuid": "c1b8b6c7-f369-4976-9847-9c53e4f2377f", "comment": "Malware payload (Formbook)", "value": "0878a443fae6afff3945b2849d9a805f", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867126, "uuid": "4ae7ed06-3a8f-4a76-b6e1-df5d2df35fae", "comment": "Malware payload (Formbook)", "value": "0bd8ecd59bcde1344767296b5c9760da3eef144570382cbbde20539dcdf1e1ae", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867126, "uuid": "31d5a4ba-9fe3-412f-804d-dacdaee6debd", "comment": "Malware payload (Formbook)", "value": "4e84872d3f1c263d9ec1712539a562fdce617d63", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867126, "uuid": "1006b4d0-dbf6-4f9f-a992-f76317c36ed4", "comment": "Malware payload (Formbook)", "value": "ec46755a3355a551908813bd34cc8ef0c96ed77aa580a8c55a4e3b6522018ae1539e52a8dcf02e5762afd18206114fcf", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867126, "uuid": "cd0efc0c-ea00-4fa2-9d04-01047e62575d", "value": "T1B3E423523A742BD1EC841F760560EB2299D33D5E30EACC695FE04F4990A8E731E527BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867126, "uuid": "311d74fe-5055-4753-8c17-bebd86baed4f", "value": "12288:q4t2J0Z9yi+lif898lA5hL74auYGEHbZjkAlc2U0l48BtbXI08wDT3kOc7:Bt2J0Z9yiAiW8+ft5p1jkAlc2UIxtpkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741867126, "uuid": "a77e3d35-01bc-466c-a6f4-7e1780e950ce", "value": 719947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741867126, "uuid": "8ccde155-136c-407b-ab45-075ca726236b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867126, "uuid": "edf96196-f308-4174-8e5c-91c90f5aedbe", "value": "DN#20250313.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc4efc7-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860375, "uuid": "785f4ee4-94e7-4c02-9ff2-fd5a60f6d516", "comment": "Malware payload", "value": "994a0c3e3e1390d972b1bdd8e8f2a449", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860375, "uuid": "a24e53f2-f632-4b8d-bf4e-d5cc271b2259", "comment": "Malware payload", "value": "0bfc2b5594e9563b60bdce2deb8d1bd3766a8a574bbc5dc604f4eaad5723fcf4", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860375, "uuid": "dd4f2ff0-4182-40d5-81c9-a42666288a6f", "comment": "Malware payload", "value": "9fed1f0aab3fa121a73a6a35be5c4e3af4b9cd6f", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860375, "uuid": "a4ef0cf0-9b36-41dd-8570-46c8d2d67456", "comment": "Malware payload", "value": "a7952853c0375b7b3153bd49185a06ea4b7943b44fc3f14cc0952c452c5655d4a8e8f66d789a44569a8614cadf09b56a", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860375, "uuid": "e6cd9e4a-0630-4de1-8793-be348432892f", "value": "T113419A86B9FD6066C25BD02D1152E503A0693E43270D193E77BCB6A46F34270E1E6AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860375, "uuid": "2945850c-84a0-4646-acd6-bd44730e19ba", "value": "48:2hpKMtHoYD8iQE+hB1YNoRmQfOb96/UP1H6Yib+V:2hpdFB4/2R6/e1Yb+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860375, "uuid": "a3c1ea36-5353-4750-8ede-bb8a5a7abb88", "value": 2324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860375, "uuid": "12b0af0e-9466-4a14-b443-9613310c5d2b", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860375, "uuid": "a461e83c-3252-431c-9df6-d02ab1433afc", "value": "0bfc2b5594e9563b60bdce2deb8d1bd3766a8a574bbc5dc604f4eaad5723fcf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bec6535-ffa7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741828000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828000, "uuid": "1a539e16-6927-40b6-916e-927f4ee45c19", "comment": "Malware payload (Mirai)", "value": "849e073a6c586fce49049a832dfc750a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828000, "uuid": "57700ab1-dfb6-4e91-bf7b-81cc6188807c", "comment": "Malware payload (Mirai)", "value": "0c4bd74faed588c5ec90b6ae717c439248577917de0808621a528033f044fa9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828000, "uuid": "02455af7-5983-429e-ba60-e7670ca81a97", "comment": "Malware payload (Mirai)", "value": "7d757bfb3b1e8ff0e1dbb189c0737b6030615ab5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828000, "uuid": "f3dd4c5c-4393-4bbf-bf2d-0375746d439a", "comment": "Malware payload (Mirai)", "value": "ab365dce65ed26686df28b67aa7c33a5ebfeac0356cf07f2c823e54ee543f8089f8b38e789a0430ff84d024b9bea8b6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828000, "uuid": "0e59cf44-d8af-4422-8495-984a410f60cb", "value": "T1D733280BA58180FCC559C17443FBB53AC876787E0239B1DA7BC8FF176D85E611E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828000, "uuid": "bafaca25-4aa5-4886-9aab-af440f41341a", "value": "768:j7s093tGOHn2PAe6nCAQiGWexrecbwXg4ubt7rnME1rjWb57Vn7Kungg:M0937QAe6CAQ/WexKq1nnh1rs7Vn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741828000, "uuid": "47aa2f4a-91ce-4e07-99b6-68c282401c83", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741828000, "uuid": "cf52898b-27e4-40c1-8115-9c8d35a57624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828000, "uuid": "849c9c50-0874-4402-931f-add68b173f15", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59530f20-000d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741871778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871778, "uuid": "ffcf8950-4f4a-42fd-971e-342a0a33508c", "comment": "Malware payload (Formbook)", "value": "0feac77db08bbe86881e7c337f5d4f7b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871778, "uuid": "402e7297-a38a-40fe-ba70-af0f0de782db", "comment": "Malware payload (Formbook)", "value": "0cbf8c8d0ead628a5b35a760c6261150766a57da3b2f2bb5f4cb3cc5ce5b43a9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871778, "uuid": "c9a80e51-d465-4a2c-96cf-4686d3a9b64f", "comment": "Malware payload (Formbook)", "value": "d34f7196248b1a73ded1e7a83994c351dcaa84df", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871778, "uuid": "180be2a6-b80a-4b1c-b784-270e5434df6f", "comment": "Malware payload (Formbook)", "value": "6c3b57303bce57c2fe15e6ac5cb9fd20bc3593818852811ca193b2a27293f1e0e8562308017c2f145728262c57b820de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871778, "uuid": "37aa296d-3e6d-4f41-bca6-059247eacc01", "value": "T1E9D423296087FDC7D48157BD4EEE37104980FEB48164EFF52684825CB6AEEC26EB5470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871778, "uuid": "d4ebb406-3ea4-4c16-96c9-0ddd3ff9a634", "value": "12288:ztG96hBb4BbF11lwnx3l3nVqNb2P368zss1mvD4B6EE0RcgCwpS:oEP8bv1enJuNSP3Fzx1mvcRcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741871778, "uuid": "97eed44b-5754-4883-bc73-88c429c0c16a", "value": 602573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741871778, "uuid": "cbcec7e1-16eb-41b6-bac6-f7edae4b9870", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871778, "uuid": "b9d07778-5166-4ded-bf0b-359fd05fdddc", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3562a6e0-ffeb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741857114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857114, "uuid": "06fbf146-6e3d-46b7-9fa9-4c9feabacef2", "comment": "Malware payload (Prometei)", "value": "1b2bf6ab69f791c0cdf234cb9f808dba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857114, "uuid": "988f5d5c-c559-48e5-ad0e-d8772c191667", "comment": "Malware payload (Prometei)", "value": "0d0122f1cbeeddd8a8fb2197aca5b0341c7fefa3f7d1b283d987eca2f1ea8c1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857114, "uuid": "ae5f014d-f225-4114-a43b-de6f82e7ed75", "comment": "Malware payload (Prometei)", "value": "92319ebf0f4be72d08c0ddaaa2699bd247fa5ecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857114, "uuid": "167ebf68-5538-4cb0-8833-02b018e69060", "comment": "Malware payload (Prometei)", "value": "92d9853d163c14f36e04ca70f19d97f3a2ae97be24452594429cfc50283bc7e393e118bd6fc337bb96176e7e35ffd8e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857114, "uuid": "b98065ca-5ce2-4b41-8a1e-4abcacf9e69d", "value": "T14E9423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857114, "uuid": "ab4695c1-f460-42cc-8948-19f0dd106766", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgM:25WOSACZSV6eKRH5EPiamb4DsDwwcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741857114, "uuid": "59dd35a3-895f-4fc3-a76c-f40249068c94", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741857114, "uuid": "e22d21e9-dfd6-45ab-92a8-543aeb21d729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857114, "uuid": "00e47dc1-1318-49ee-b4cf-6b83340a5c59", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a38fa6-0018-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741876434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876434, "uuid": "d750cc08-32ca-4ce3-b036-843943f43881", "comment": "Malware payload (AsyncRAT)", "value": "39ab5a4da312d35be8b9d017ffd5075f", "object_relation": "md5", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876434, "uuid": "bc1420a7-40f8-4d06-b9c4-8293c9053cf4", "comment": "Malware payload (AsyncRAT)", "value": "0d0da6dc9386f17c30a6d7fcc9ff7458cce2a7b1feef7b2329d49e61ddfda639", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876434, "uuid": "5e4e35a8-02e3-4d12-9d9c-76d3c51ee1d1", "comment": "Malware payload (AsyncRAT)", "value": "547c10b07b94f4d9c74600eaf5038c5bbf621a73", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876434, "uuid": "00b04f38-5061-4115-b652-50db4ff50663", "comment": "Malware payload (AsyncRAT)", "value": "ac800538213ef4b87178ca412c70688d4f0778a2993384bbedfce32301ccae821372944a2a55a0282dcc9d905f609412", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876434, "uuid": "ce5a81c3-8d95-4d03-97b3-36463835c135", "value": "T150E23A4877944712DAEEAFB12DF362061270D517E913EF6E0CE485EA2B67AC047407EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876434, "uuid": "544d8ed0-d6ab-46c8-a170-b21c4e5c8148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876434, "uuid": "06261afe-e226-4225-bc70-c828efea3078", "value": "768:3Va+vNtg+PB93Tw4xqdVFE9jJ6OjhGbO:fvNtgw93U4x8FE9jEOj0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741876434, "uuid": "d6182026-ee69-4de4-8e20-5b7cb73ad73a", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741876434, "uuid": "065f2034-2816-4315-b3a3-a1fdf9f45f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876434, "uuid": "19ab1e13-73b5-4a1e-a9a7-06104c260ffc", "value": "92.255.85.66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f614fa-0035-11f0-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741889115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889115, "uuid": "a4061c8d-f852-4940-a887-3adfec24dca7", "comment": "Malware payload (DCRat)", "value": "5b6fa0ab927a38973d2d507d3d2e5918", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889115, "uuid": "45832aa8-7317-4e62-ba70-abc740b0808e", "comment": "Malware payload (DCRat)", "value": "0d119f7d7877692b4418ea6244c9b61c717a48e915b258013c70a42f3230889d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889115, "uuid": "244d144a-b25a-4bb6-be8d-945a503d4293", "comment": "Malware payload (DCRat)", "value": "416871bd82632a20260fb71c7f6144bc274b0cb8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889115, "uuid": "b6ad4667-22a6-472f-83b6-cae8ced72eef", "comment": "Malware payload (DCRat)", "value": "1350b3522514ad02b58945fad80f8da047b5ea64d9c528a80f1310f42eb4ce790d86b6fbc81a212d2ec9366ec8f06ab5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889115, "uuid": "11d233ce-68ba-49d5-bb69-4497aeb3f969", "value": "T1757523427EE14972E46118379A347B21693DBD202F26CEEF63C02A9DDE315D0E6317B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889115, "uuid": "b42b6496-3b5a-4cfc-a89c-01a1ea5edb5b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889115, "uuid": "a462c6fe-b8e1-4dab-bc03-f63de3719a96", "value": "49152:IBJ0CS1IO3Mm7yeio2h4RSsEKE6Jor9HK8ExxE/q:yiCIIO3hMo26MsET6GK8ixEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741889115, "uuid": "b281cc78-816b-425d-b065-cd4a40c83c61", "value": 1684842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741889115, "uuid": "3f0cde43-f212-4526-89ae-cc993bf885e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889115, "uuid": "180664bb-6409-4fa8-8154-8f3bca7d95d5", "value": "5B6FA0AB927A38973D2D507D3D2E5918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890e3ce9-0002-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741867133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867133, "uuid": "97efc7ea-c038-4011-95a4-d63b8572d43d", "comment": "Malware payload (Formbook)", "value": "3e6924743e1faa6c6113af873fd2382f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867133, "uuid": "9ae03d24-5513-478e-be7a-1094e15133dc", "comment": "Malware payload (Formbook)", "value": "0d173d647ff21c983845365edb6cfaab515479dd8eb6cb47f3c2295afffe1004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867133, "uuid": "ba8e7d62-0c35-4255-aa7b-be8eda24fb01", "comment": "Malware payload (Formbook)", "value": "467f84d3f04650341971c35db224ff5f780392ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867133, "uuid": "f556a54d-4edd-4eba-9906-7cb4ef49b6ad", "comment": "Malware payload (Formbook)", "value": "811ecdf19897c380e8f261418a39e0e0c05fe5f18b156a526bbc0fdc35022baf5070b41e45e41edd38295e9eef5a02f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867133, "uuid": "f3696d09-eed3-481b-acce-01a38bcd3291", "value": "T1D0250194F648D761DA1907FC0D68D5B503B11DF8E132C3522EDEACEBBAD0B239618693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867133, "uuid": "04bf865f-ab87-490a-8af9-a27a4f6dbfb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867133, "uuid": "1c22674e-479a-429e-8a8d-86ede0c88033", "value": "24576:8nOeiMOiXBVlVlVVVVylXtQWIHqh4BuDjg/e8vVlVu:9MpRPPP+XtQVHk4BucP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741867133, "uuid": "2f5cbc33-ed8d-4202-854b-83583d7c43f8", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741867133, "uuid": "b9b0567f-e4a5-4f6a-bea0-6d96407c8614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867133, "uuid": "3acdf1f6-1bb4-4c7b-ac09-fc8f1be1f54b", "value": "AAHiVVNIKQESryT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5d780a-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825046, "uuid": "58bde997-6ba2-4211-848f-7fc208c2fee2", "comment": "Malware payload (Prometei)", "value": "dbb3654f1529f732da365a443893cf88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825046, "uuid": "903771f2-672b-42c4-bda8-5852ade5f04e", "comment": "Malware payload (Prometei)", "value": "0d4a592775211f9f40752a51c1566587b9aec6677977005ac21ff80bfdf0d6f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825046, "uuid": "104d7986-5e1e-403e-a64a-978e501b233f", "comment": "Malware payload (Prometei)", "value": "1d45eccd3a4d94a4a711171d1c17095a00047f19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825046, "uuid": "40533db3-4148-4069-913d-cfd93fe4c195", "comment": "Malware payload (Prometei)", "value": "64fa0660f970275cd0e011145985c63d31546680d7805c08059f39de288ceb02425e9e4e5cae56b07797815d6cd36b99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825046, "uuid": "ac512563-7dae-4c43-bcef-595ea181870c", "value": "T1C99423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825046, "uuid": "da36cc41-a72f-416d-b96c-22e206b5bbea", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgD:25WOSACZSV6eKRH5EPiamb4DsDwwcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825046, "uuid": "19f0dd52-83cb-46d7-92cb-37762f67c0e9", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825046, "uuid": "0e720a25-259d-478b-a8eb-95c9241dfef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825046, "uuid": "c5c5c036-e513-400e-adb0-f8da99e5b6f1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01beaa3a-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741833406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833406, "uuid": "b56a73bf-8105-4b57-98ee-375b49e01799", "comment": "Malware payload (Mirai)", "value": "2907d7bdbde4435124e36c3ce17447ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833406, "uuid": "85a68f6d-0711-40ca-a647-812ccfedcff7", "comment": "Malware payload (Mirai)", "value": "0e3b5b3ee21f53e975a8b4d345c64da3758e8d2299ee9e6e70fd576c5521ea8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833406, "uuid": "093e7801-e361-48b6-90f8-7045a22fbcae", "comment": "Malware payload (Mirai)", "value": "e99eb049861d3cb54d7d521e8e876f2cacfd0ae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833406, "uuid": "ceb838e4-de56-4a69-9f64-ecfbf8f11ca3", "comment": "Malware payload (Mirai)", "value": "a27359df271c30c1d49fd45ff6dc20b96ed88ffd76056c2035006a55c3e9195817ff17ede74b7e72cd20d170d6e4be49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833406, "uuid": "f7f55954-7700-402b-b1f2-5f17b6e16fa1", "value": "T1A843086AFD81AB11C5C1117AFE0E124E7313076CE3DE73129E28AF247B8B56B0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833406, "uuid": "f2b7b0d6-5d46-489f-a51a-45a7cbba3302", "value": "1536:IunSJH4B+vSaqalKGIriujE5ijYwIvA5DYv:MJHsPaKE5ijYwIvAxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833406, "uuid": "7a9411b5-77a4-494a-9814-356eed49cdea", "value": 58988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833406, "uuid": "ce76bdea-aee8-4be6-ac52-21a0f44226eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833406, "uuid": "8f8dae17-d071-4179-8358-04cef7ad66cc", "value": "miori.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d129ad-ffdc-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741850726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850726, "uuid": "7174ff64-9af8-42b1-a875-711421d00243", "comment": "Malware payload", "value": "1393dab192ea2e2427889839a2d8fcf7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850726, "uuid": "5c96124c-1f47-4c7d-9f8a-2e07bf5a5247", "comment": "Malware payload", "value": "0e626e01d3ae7840aa486468f40138284ccbd70dfe336a6b5d4008d01eb79988", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850726, "uuid": "ee2b7529-b612-4813-a90d-bda6ff0f41fa", "comment": "Malware payload", "value": "373609c0f30ee313fd0cc6c4e572452483d87244", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850726, "uuid": "a8401387-b472-4a42-a07b-3d1156be42d1", "comment": "Malware payload", "value": "044d9f8e2febb0419da56096d40945c459560b10d8f2e3dd288c8c8456b480073a3ea36f39ad1a421afc95cca502a7ae", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850726, "uuid": "e9690ae2-63e5-46af-9103-12061b9ed25f", "value": "T1BB817920B6BBA467D777E210F50F6E533A2B5283A454875132AB207F58E3407D43E6EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850726, "uuid": "43823cd2-7c1e-46ea-96af-e1c98c18f4fa", "value": "96:/drsnKYb6Xn9RSRMclBz/wwhxV6AHNrni7U7FfCeYFyd8f:pN4Li7UxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741850726, "uuid": "c63721b0-8d64-47d3-ac03-0695159d7842", "value": 4116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741850726, "uuid": "00a013d7-b645-46f3-bfe1-ad3365834c5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850726, "uuid": "0fbeb0ee-cd90-4b6b-b113-2f156f355984", "value": "def1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe26c24-000c-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741871540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871540, "uuid": "fbfc33fc-54cd-45c1-8260-cc93b6b55ca8", "comment": "Malware payload (Formbook)", "value": "faf617338b922358fb44c6f238f8d167", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871540, "uuid": "2a859525-798b-4895-83bb-ac29d2e61d45", "comment": "Malware payload (Formbook)", "value": "0ec55f7abd7ebe7dee1e9267619f13e015cd6a27f52e62f4638eb4c0906d8d4e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871540, "uuid": "47758ed9-6af6-4566-8cae-bc5a05029b03", "comment": "Malware payload (Formbook)", "value": "90050248a8e11b446e907a829d2e748d4f35b1ec", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871540, "uuid": "7fc01044-ddd8-45d7-baea-5d530a0fbe3f", "comment": "Malware payload (Formbook)", "value": "b847a2599aad49433cf03bc7b4ac42973eb73934b65ee7b360a1e46bcc3cbfb7f4564940d87430dbd85ae8f8930ad1d8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871540, "uuid": "63548c44-5970-464f-a186-b826015eb4fa", "value": "T16E4685D719ED774B1706239BFB4BA468863FDC7126835EC074CB278800AE15B2A94F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871540, "uuid": "326e4c74-717f-4cf5-b0d9-ed3863124167", "value": "49152:M2yyenxfnEeTX5qZrn86Wp7Vldl91TnbWhcuIdugnKHvfpB5ehZ9enKsl+dt:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741871540, "uuid": "060a0183-d9b9-40a5-92c7-d9979750a2e3", "value": 5376924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741871540, "uuid": "3295f24f-590d-45e3-8148-d93a29e16d91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871540, "uuid": "bf78d2f1-713e-4a05-9598-de7f62d62307", "value": "345623.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ce5650-005a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904783, "uuid": "89b1394e-e0b0-468c-9d7f-f90de8266f90", "comment": "Malware payload", "value": "47e0548437b1a09eded989f81d2b36e5", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904783, "uuid": "9ee3dbc9-377b-4a52-b581-74d0d3a0cd8d", "comment": "Malware payload", "value": "0f2eb2cf949bdb338e1255c5f04fb30ece0562b48f58486e386a76ca60b4cc28", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904783, "uuid": "d8c13ff6-8f36-40a3-b8a8-f025e681942b", "comment": "Malware payload", "value": "bebe590781585e2484bffa4b949dfbfec5ea0bae", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904783, "uuid": "f0b2eee2-ff07-480e-a670-a65dfb8cae96", "comment": "Malware payload", "value": "32d5cba84d16fc84a0aa551f13e67a428804a9ff0e67a02903a9cf19a41454236e6594674686f9477c762ed5a990a116", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904783, "uuid": "810c24ec-6343-402b-afa3-0658aec5f559", "value": "T135A54B313BAAC52BD5A215B06A2CCB9F51A97B7B0F7250C753DC1DAE04B48C28731E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904783, "uuid": "277b41b6-534b-4f7f-8e60-06fcec3e5eb3", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904783, "uuid": "240c9383-c33b-41fb-b0f9-5fefa49af0f1", "value": "49152:2T5AhUC7ilxeAi0D4QSq8Amr5N5ch1VB/atZMDJf5Hhqm99zkO:mAhUCyxeAi0D4QZmrT5cj/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904783, "uuid": "858959a5-a0a5-4f5c-a38b-f723697b3088", "value": 2167680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904783, "uuid": "ba4ffc87-1ac4-4f12-bef2-14c84b43341e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904783, "uuid": "483ba4eb-6ce9-4989-96c4-27ec0c1bf28b", "value": "visionwallet-2.76.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed56167-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741872995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872995, "uuid": "acb49f65-2c10-4e6f-a351-8615992d5c07", "comment": "Malware payload", "value": "83bac69d723b466ed3f8c02a1930bcc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872995, "uuid": "f48a25f9-1380-4816-b5b2-80a6341daa15", "comment": "Malware payload", "value": "0f6906b9eb39f30b6ecbc4a9b564636d167357af637ca3c7f7d80d161d396c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872995, "uuid": "7a925309-8b6f-4a75-a035-913f5bd0b699", "comment": "Malware payload", "value": "5be34ade4058b15af251f9c9175f8a826928cab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872995, "uuid": "885cafea-c533-4f1a-ac74-e2fea820eb4e", "comment": "Malware payload", "value": "11f14d64e3d142217f35f33a3f2c5917759ab023266caede95d60291011f4d60e086501e1c8417ae3876686ac8670313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872995, "uuid": "e51a24bf-5081-447d-9758-982b0490df8e", "value": "T1A5F4AE2279C1C03AC67324324A69F26519BFF8710D355AAF67DC0A3E5FB44826E1673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872995, "uuid": "afc4bfc6-6391-4830-b753-17050c188899", "value": "b8e3efd9ce4dbdcfda0ffa2c21a2daa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872995, "uuid": "86d5aa07-e018-4013-be40-384aa5d4a33c", "value": "12288:/OBxP031RhqMbZ130zVVj7v350cyzVjVmh2UyKQyVbjYGYVy5bHsbDK9Oy4W68Ey:/c031RhqMbOyzVjVmh2UyKQyVbjN5bGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872995, "uuid": "5cdf4e7a-3194-44ae-adeb-fbdff7391df3", "value": 783783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872995, "uuid": "d2ff71a0-d3d2-4ed2-842a-6dee61b12a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872995, "uuid": "ce6dc264-574a-4547-8b50-0833001677d0", "value": "______________ ______ ________.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb4fbe8-ffd2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741846659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846659, "uuid": "871d1bdf-6309-4a34-82f4-fc187cf04e5f", "comment": "Malware payload", "value": "b64cb67d80fcb965cbad8764cf64b096", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Magis", "colour": "#87EFCF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846659, "uuid": "f7e06a0b-7c02-47bf-a56c-dda8aa2a8178", "comment": "Malware payload", "value": "104debd4af92c52a2a91ee283ffd2b9157fffd8e0f3c1402f42ac5598387e4ae", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Magis", "colour": "#87EFCF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846659, "uuid": "cd2a3d0f-8dfb-4443-93ec-d2279f899be6", "comment": "Malware payload", "value": "70c8805f2111334a14b1365106e0c264cdfbe449", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Magis", "colour": "#87EFCF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846659, "uuid": "ba491836-f783-44ea-bd7c-a7e14e5d77a7", "comment": "Malware payload", "value": "c07ccfd4e18313deb27666e55c86dc6d78043ef5a32049a34967aa33288a9fa0a46bc0eb91fe47acd84c7fb08cde1cc7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Magis", "colour": "#87EFCF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846659, "uuid": "1f175a19-7ff7-42cb-a9e1-ad236d67d90f", "value": "T160773393F768982FD0771531CAAE6621A36B0E008F41630F755C7A0E2A736D85F9E7C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846659, "uuid": "4271b6af-e0ba-4601-8756-b78a2c86024b", "value": "786432:oOPtuieA2Q3a+oEGLc4W0Eh4Ggd0BRuVe3ZWnw+JXVxE4v:Z4yS/EAhPGhMkZ8w+1Vxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741846659, "uuid": "6ebe0662-bca1-4cba-aa6e-c5dd425f36a9", "value": 35831957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741846659, "uuid": "3ff5cc0b-c960-4583-bc24-bde4a2bed094", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846659, "uuid": "612c0fe1-9842-4ad4-82e1-2d04f67f25cb", "value": "signMagisTV_sbs.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99719a30-0057-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741903668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903668, "uuid": "780b0b22-a520-4ee1-a849-054af2867539", "comment": "Malware payload", "value": "bcf10e3c07383d9400f0fa98f3f999d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903668, "uuid": "ff75e295-eb9f-4aa4-aee8-0bc1fccc8a9a", "comment": "Malware payload", "value": "10d53d067e7e0d5f80d74f386981916aa1af108a8e40112db73c6381f2c11d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903668, "uuid": "dbb212ee-bac2-4cdd-8417-e57a2f03d105", "comment": "Malware payload", "value": "e4805106924f05cf3df4de8404f669fe873439b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903668, "uuid": "f27907a5-558f-4cc4-996a-8969c6bf23db", "comment": "Malware payload", "value": "02b45cf8058a62331b4f34885d9a3640111b3847ccf365a00cb63701109e845ef3c651cf22f17a59a8afeb52226f4b29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903668, "uuid": "6c7d4255-be97-4a6d-8363-cc1181d2598c", "value": "T17E963357FB40B4B5E5B584724E2E9B42437BEBBA3372483786A81F031CD709A53276C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903668, "uuid": "a82ea953-ef42-4389-89cb-cd839c74feab", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903668, "uuid": "24830b8d-31e9-4546-9cf1-62d2644318b3", "value": "196608:+pOvkJBFFPxqFyPRg4ojN4UwR/u/3k+d5FreArRpIOVDGris:+pOvaF6Fy5gT3Xc+dTZV8ris", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741903668, "uuid": "4bbd0e85-3ddc-4a2a-9653-8a47613a1276", "value": 8840772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741903668, "uuid": "684cddf6-c8e9-4927-a34e-1a8c5ef9c9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903668, "uuid": "36aff927-7515-4840-b302-e4eb2cbc25ad", "value": "7ZSfxMod_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d11cce8-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741849531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849531, "uuid": "b0577864-eed2-4074-86c1-a061f8d64995", "comment": "Malware payload (LummaStealer)", "value": "f48ff9bc196aad68da3d4376c9649d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849531, "uuid": "e373991b-992e-4a37-afe8-b80c89f4d0e3", "comment": "Malware payload (LummaStealer)", "value": "11195c6b0d9981a94bdab08b52d714a2298e4e0bf98a613d62179bef8a701d00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849531, "uuid": "86ccd462-860e-47ae-832a-b11447a2d9b2", "comment": "Malware payload (LummaStealer)", "value": "6e322f4efcc330514595db2b0d4b9c46f0947fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849531, "uuid": "9996e438-3053-4fd4-bff1-67ee9833f249", "comment": "Malware payload (LummaStealer)", "value": "b874f61545547504237aa3da31e99d2471048ba9bc496c11bc72d58fc12d33bb0ef0b377add7e53c08de31eda0755ad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849531, "uuid": "2e8a769e-d758-4766-86a3-6d47991fc181", "value": "T124A5229A13AB0469EC2A60FF79A210DFC2644DBD299D563E7D31839CBD4E4AD1D13F20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849531, "uuid": "87186ae6-5990-4cd8-b1df-32f135f40a0e", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849531, "uuid": "8746ba57-9024-4925-84bb-dc85f71741ec", "value": "24576:WxD0p+DGIp2aj46j8vwkKWzQO3UAjN9O249LYRE2ABbu6w+7s5SnPtEJW/0shuC3:SDNd4veApb5A7CWu6JvnPtEvaREkMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849531, "uuid": "f07da42c-e28d-44c8-8418-124df2cf8021", "value": 2165760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849531, "uuid": "557b8e45-15ad-467c-9b8d-b4777c953379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849531, "uuid": "61696df5-7f65-4f21-a0c1-c9a4d19ce19e", "value": "f48ff9bc196aad68da3d4376c9649d9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e89a637-fffa-11ef-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1741863626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741863626, "uuid": "8c4b14ae-77a1-4852-9759-1132c7783517", "comment": "Malware payload (RedLineStealer)", "value": "5bb99ac790aeeea6267bb29fb67ff860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741863626, "uuid": "9bc99502-deef-4392-9c66-1800b35021bc", "comment": "Malware payload (RedLineStealer)", "value": "113ba1be00a45820019ab0e10097ffdaabaee668013820364c9dbe7365838c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741863626, "uuid": "fa83acb6-345c-4f9b-8d50-8f8c625c26f2", "comment": "Malware payload (RedLineStealer)", "value": "cf1a7f18df560dd886b71d3c036da6b66be24d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741863626, "uuid": "79274f80-5514-4ae6-a7d3-25aab4b22e6d", "comment": "Malware payload (RedLineStealer)", "value": "006e076d5c81f7d23a4a5d19fd7ca96983f0b041aef6782690dacd26758b81b1307db2cdefa49e515a381c59b753bf0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741863626, "uuid": "f73b3290-e1ec-46df-8af7-2cae59b95b96", "value": "T19FA35D2067AC9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC154E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741863626, "uuid": "fd8a24c3-1cf0-43a1-a3b4-1d0452fb7690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741863626, "uuid": "47fc177f-0e41-445c-9560-84364583d51d", "value": "1536:FqsIhaqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2btmulgS6pQl:DGaKaYP+zi0ZbYe1g0ujyzdbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741863626, "uuid": "03e85f2a-156e-4cba-ac2c-037cf8e342c0", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741863626, "uuid": "6bde8e7a-e29b-4097-b212-138c7e629012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741863626, "uuid": "17166538-211d-462f-b7af-3119634188c7", "value": "Order 20201103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4009c14f-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879466, "uuid": "b70a38fd-83b2-45d8-9662-9558742ff780", "comment": "Malware payload (LummaStealer)", "value": "2903fdf791b5c089eba36c8cab5079bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879466, "uuid": "0051b9c2-9764-493f-acd8-2ca23f1433cf", "comment": "Malware payload (LummaStealer)", "value": "11577483217ab72ade0d8355c165fa033e3c0f3455b0380c3f763b82b042b88f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879466, "uuid": "9aa3e903-8516-4b95-96ea-9ed165c0abad", "comment": "Malware payload (LummaStealer)", "value": "8c05763c998704678ccd22bb1026d8e98a64fc9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879466, "uuid": "4c046862-c0e9-4849-8de5-dc3b34e02198", "comment": "Malware payload (LummaStealer)", "value": "c769e8db41ba04517f48d6dcbd0a452bdbdb7feedae93f3529ef604ed1d532703cafb9fc04d92208de489ccad53be5d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879466, "uuid": "674b5ab5-681a-4b46-a6fb-9443c7cb96f2", "value": "T187F4D046BC92D0A3EE1628B15D29E7C51C6B6B244F3084F77ED89D646FB36E18932313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879466, "uuid": "9260f21a-9f4d-495d-8c5e-908890f6fa38", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879466, "uuid": "dc0b3059-1c54-48b5-a5d9-8c0a8447b20a", "value": "12288:XIJQ/s2kiatVPnIpbWiJ621POPAANU/o8e7UyZySMHe2LmGcwN7T/Jt00pV7Xt5B:YBnIpnJhdQAANevejW/Jx7795vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879466, "uuid": "a7735194-004e-4f9e-81c0-c0361a3fda8e", "value": 785216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879466, "uuid": "b6af5a36-aac9-4ba1-bad8-d51b047c140f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879466, "uuid": "2e838b0f-5f55-443a-851f-99c931f8be6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6937b431-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824989, "uuid": "50949987-2e43-4243-9797-9b18eed07f11", "comment": "Malware payload (Prometei)", "value": "0a8b7ac2b0786491257314898565cea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824989, "uuid": "05052047-d9ab-4fee-a429-45b033855162", "comment": "Malware payload (Prometei)", "value": "115e1235029c06e9ec5a79abdac689e3be99bb7dee9b209a382b0ca2d3254a1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824989, "uuid": "e9dfec9d-505f-46e6-aff5-fb00cf6401f6", "comment": "Malware payload (Prometei)", "value": "7cfab189e74d991c913a4aa2c45a9815fca58271", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824989, "uuid": "50d27b5c-33f8-4770-a1be-7fcdd9ae6b1b", "comment": "Malware payload (Prometei)", "value": "b7891c7499667557a54ef1670ea4c2b0cc5a1c39783e43993e569a85d3d4e446ea54d66ea773df5401b70ce1e4ec3a66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824989, "uuid": "1509866d-fbe7-467a-857d-981301d20654", "value": "T1BE155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824989, "uuid": "c7a14b3c-59af-4fa0-8e4b-68bf359ce769", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplw:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824989, "uuid": "bfd2d869-0008-4206-933b-a1a56965c588", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824989, "uuid": "30ac9951-d07a-49c9-9da0-3ed1c50f8e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824989, "uuid": "53bb3a89-2db4-431b-b443-65c66144c02e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffe90c6-0043-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741894928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894928, "uuid": "096c0377-1fff-4eaf-8200-d0f0428c028c", "comment": "Malware payload", "value": "974565ceb7151f3b0596af548ce83edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894928, "uuid": "336bfcc0-4a47-4852-8779-161fbe64834b", "comment": "Malware payload", "value": "117694576d72e373e5be093ef2b68ce7560bef06c55b57fd83eac56fd120f838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894928, "uuid": "103ddb77-1b6e-431c-b469-bb70b00083f4", "comment": "Malware payload", "value": "7fad12dd4ba2450074f08afaefb968f57f33f2e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894928, "uuid": "a0f02c95-9023-43e6-948b-d0a9f2bb4322", "comment": "Malware payload", "value": "33997dbe642d24893f309b4fbf6e2fefbb0b08b8f79790615482fa0a00a537a89bf4422a93b5becd10eb5637726af076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894928, "uuid": "07f412ad-3d05-481e-b6e0-26307029854f", "value": "T183E6AD02F3FD02A9E5BFC278C5624517E7B278551720E7DF15548AA92F23BD0AE39322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894928, "uuid": "90250a2c-3e55-4a1d-809f-c53087b73b50", "value": "4b1892ce4fbcfcf064c6f69d693fc6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894928, "uuid": "09e2f0cf-64e1-460c-b6cb-19a5640465ef", "value": "196608:3ZdyirGA46KGiTjG1XG8XpqeqWLQsiuA4tcBqi:3rRGb1Tx8XI80siu1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741894928, "uuid": "5ec6b2cc-b07b-480b-8d55-bb6320b671a4", "value": 14421696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741894928, "uuid": "1a39d7cf-2dae-4786-9ae5-133d4d15cc70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894928, "uuid": "7d57b9c2-5d69-4193-978d-5e7c4e0af70c", "value": "Install.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5262e38d-ffe6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741855016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855016, "uuid": "3eea4ba6-7668-4de9-8f53-c4c378d41ab9", "comment": "Malware payload (Prometei)", "value": "4f5df349ee219467401c4a5b2e44ce39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855016, "uuid": "fbb0c3a4-541b-484a-a8e4-a33fc796de96", "comment": "Malware payload (Prometei)", "value": "124556bee89c6974529be830a7b3d8e6511b60c80edb74531eb1f1c062d8404c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855016, "uuid": "9c7a1fa5-7384-47c7-98e1-ba744d82ee70", "comment": "Malware payload (Prometei)", "value": "348b2c044cea0e94e6321690fd66123c4ad6d577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855016, "uuid": "bc190c4d-4ace-4dd1-9b0a-ec3bbaab6080", "comment": "Malware payload (Prometei)", "value": "ab9a5a354d0ded9ace402b73c657ad1d197b6bbc594f9c81b66506266d80a50294d0ce5ad43cdf2729eebf12ad6d2857", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855016, "uuid": "c9306c97-86db-4e30-a424-a743d93c3081", "value": "T1CA9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855016, "uuid": "742f84d0-9010-4956-8935-196197964839", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgh:25WOSACZSV6eKRH5EPiamb4DsDwwcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855016, "uuid": "fe017da6-c45d-4af4-b679-2f103cf39fc0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855016, "uuid": "60b459e1-eecf-44f8-9e3b-ac173bbbc5b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855016, "uuid": "9267940c-889e-445b-beaa-d82a82db5bf0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8892a5-005a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904853, "uuid": "8d748b27-499f-4ad7-95b0-7edfc1581085", "comment": "Malware payload", "value": "a0c84b1652178e6bb71e7497821c5d1e", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904853, "uuid": "3247e286-10dc-4584-8c33-86c2d3916210", "comment": "Malware payload", "value": "127d88bbafefc12b3dcd8c4f5434d073e09dd41cb75c53a48486f9509aef603a", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904853, "uuid": "393aa011-e19f-4e53-9563-8c56802e61dc", "comment": "Malware payload", "value": "c86b5af320afef572e956864369916150474ee95", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904853, "uuid": "d5b70aa4-0610-4036-abd3-d1082e39b36b", "comment": "Malware payload", "value": "6e823f04f4c54752b207b0fd8944214b6f1fa02b8095f368a6d2d76342d5664e7980817feedae71950ce15fbd19a36e6", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904853, "uuid": "7811ff79-cd9d-4d51-b62c-0bc7b24d011f", "value": "T1B0D59D11B697C136C97E45712A79EB2E50BE7FA51F7444EB27E84A7F0AB14C20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904853, "uuid": "98135560-e4e4-457a-8eaf-0a98bd9dc204", "value": "49152:B9RYq39Mftgk7A/VqVZ9Rw4YP/BD/vTWPduTRUhfwEzB6zDojOwfFl3pqLOSGRDN:NYiEANq1PdRBqwbpqLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904853, "uuid": "fdb2ac6d-30e2-4a99-bad8-76262bdbd28a", "value": 2880512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904853, "uuid": "793f0cf6-3fdf-4af7-b122-7cc132f3bdc1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904853, "uuid": "5b24ee0a-f911-40cc-8832-2b429cec05a1", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92045e7d-ffdf-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741852116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852116, "uuid": "f8fe6f0b-cddf-452b-a54a-09161e538fba", "comment": "Malware payload (SnakeKeylogger)", "value": "c115613bdeeef582663b98b91348ba55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852116, "uuid": "18373d49-c8cb-468b-acff-5504578c4c8e", "comment": "Malware payload (SnakeKeylogger)", "value": "127e0f05b7b37ee7c27e2cf7bea75f5eae94be3e237ae3a60f9176950d0d68f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852116, "uuid": "0a90cc22-a33a-43bf-a3af-04907d8e1f1c", "comment": "Malware payload (SnakeKeylogger)", "value": "2da29044cff0ee0d983a4c5794842fd59206ea3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852116, "uuid": "72734273-5e42-4ad8-8e75-d8626ddfafdf", "comment": "Malware payload (SnakeKeylogger)", "value": "ddd065b95da28013ec37048cc056364348de6344e1298f9cb26a6850d30893231193b630d719a973490b1fd8d1292b30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852116, "uuid": "e7e76dfa-e818-4332-b380-e826b12ff357", "value": "T13CC40299674BDD62EED917711EB4E37602699FAEF02183138ADCEEE374043A0B00D695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852116, "uuid": "3781332d-a65d-4dc6-b493-4d9af5b21248", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852116, "uuid": "58169c93-565b-4a0a-bcdf-a5d4462bc0ba", "value": "12288:85MOiV1emg2TNSCEdlU5CalGvsv3KJpE6KV3McpFCjcmYB6:85MOiXej2TNSCiZrv7shtqjWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852116, "uuid": "035683ca-5bcb-4ad1-8c7d-8914cc680a06", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852116, "uuid": "90ed23cc-9e32-4397-aa41-5d1810c90a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852116, "uuid": "439c8f3a-4390-4573-9429-9fe36d9bc638", "value": "Product Order Hirsch 1475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b107a788-0042-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741894688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894688, "uuid": "1103176d-6907-47b0-b45b-6bb4865274e1", "comment": "Malware payload", "value": "363aed5231de0d87a77519e3c3e8bca6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894688, "uuid": "c8d4e7a4-3d4a-466a-beab-67a034c2a60a", "comment": "Malware payload", "value": "12e552526cdaef83c1d0ba18b9c4d826363bcd5847c15cc42a9bae350f0626df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894688, "uuid": "1e51aa84-e203-453f-b467-69fab6762435", "comment": "Malware payload", "value": "fdd711673095316a3443823c57352d8ec475f974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894688, "uuid": "82fabece-5ba6-45cf-b91c-45ad3266bf1f", "comment": "Malware payload", "value": "3b364aa3ba6b9dbcf4464660c6b9dd815c69aa5e10e6d7705d8094ec918bae66a588c1a73799a1e2ad6ed9f962c56d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894688, "uuid": "298617ac-dea3-4464-a6bb-6a1765a21e91", "value": "T12AE7AE11A7E80B06E73FC27DC6639252E7B1B4431351C6CF0198DA993F53BE19A362B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894688, "uuid": "a1bb120d-6803-441b-b0c2-8e36f351b25e", "value": "4b1892ce4fbcfcf064c6f69d693fc6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894688, "uuid": "ff60ca7a-98ad-4a79-bff3-5ca8f087edf5", "value": "393216:4rRGb1Tx8Dh+MP9ZGVWOeU85mlZoSaH8z1HSajXgJgV36hqM5+t7MH1tMnJWQuix:1bn8DhuWOb85P859MOV364MM22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741894688, "uuid": "67427eac-394b-4220-96a7-f9acd37b1b2a", "value": 68974752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741894688, "uuid": "5f1e24ea-7dad-462d-9d10-3d74e7fde144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894688, "uuid": "03a8209a-f70f-41aa-a76a-da96d02f9b52", "value": "Distributor.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74361ba-ffa6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741827697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827697, "uuid": "d4a48fbf-71a7-4d8a-af18-544f01bb0ece", "comment": "Malware payload (Prometei)", "value": "5a7da3e981b66cffbf58408ec8029509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827697, "uuid": "1ca52ad0-da6d-42be-bceb-1a62514396df", "comment": "Malware payload (Prometei)", "value": "12fa51595483b9bf144b7103f08c64a6c27ed4b10e2cca9c691fa0fc441eafd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827697, "uuid": "7ca6c8c9-abcc-46c5-8fad-1202f3d28da4", "comment": "Malware payload (Prometei)", "value": "d5ddaabee9649b3419785e3d3eab76cd4b9f366e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827697, "uuid": "28532ca5-3978-49fc-8c49-763ba15da299", "comment": "Malware payload (Prometei)", "value": "254ae346a1ad6858023728b12c1cf71b980cc1508cdd5980e1d4ef4b4e3854e8e0598f4f373f280380f5270f614ea0fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827697, "uuid": "ff0b0313-97e5-4cf4-8822-172a5cd13bd0", "value": "T1879423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827697, "uuid": "b2cda1ff-c687-4868-848a-7132570f6527", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgs:25WOSACZSV6eKRH5EPiamb4DsDwwc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741827697, "uuid": "bafd4627-197d-40c4-b071-c5192f63f853", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741827697, "uuid": "b0cf327e-d88b-4ff6-8941-703864a8af68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827697, "uuid": "b28afea8-406f-4860-9aed-3a0b5eb9c8e8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1068711e-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741879386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879386, "uuid": "a421d478-0126-4ae2-b3f6-1dfa56d429a5", "comment": "Malware payload (RemcosRAT)", "value": "09e7f186c05c01acb90d50b3a2b2985b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879386, "uuid": "6b0c00d7-358a-4aa2-a29d-9e59bf74b05d", "comment": "Malware payload (RemcosRAT)", "value": "15627a894811556dd8e5f9c8af8bc8205d503673c41fd65076398ed1738a1717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879386, "uuid": "0b1bf718-e812-4a71-ad51-a0c6ee2108d4", "comment": "Malware payload (RemcosRAT)", "value": "39719020a141af5744e9cd0f6edb654fb3f69e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879386, "uuid": "93aa8203-b0b5-4438-a62e-2b6383b72636", "comment": "Malware payload (RemcosRAT)", "value": "13a09c19d475fd4aa8a4ac2e065bc72726081a400530bc722ab975b5785ad6723fd8163c8fdc9eb84a9225b970aee8fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879386, "uuid": "bedae5c6-8c25-46c0-8d29-bfc7ac87a58f", "value": "T154B4B001B9E2C172D57654300D2AE776DEBCBD2028358D7BB3D60D57FE30190AA39AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879386, "uuid": "3ff1ce22-2661-4488-a06e-0d825b54af3a", "value": "41e05d591d7d93bdd5bc6d5da04da74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879386, "uuid": "223ab9f4-e718-4cdc-9480-ce532b59906e", "value": "6144:vIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6dJ:v200OFp+G0imvHn3Cp6qyBP+YdsvZGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879386, "uuid": "20257bae-378a-4e29-8e75-d974a5b2b8fe", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879386, "uuid": "3b15a2a1-7eaf-498f-becb-6cf42daac143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879386, "uuid": "1cc44ecc-4059-410c-a909-a0cf1e77b0a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f56ae9a-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869103, "uuid": "d26aa61e-ec4f-4a64-9d14-f2ee49adfbca", "comment": "Malware payload (LummaStealer)", "value": "dd71e60b511b74a3e0e41023a39caff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869103, "uuid": "860c4b44-3ce9-49b2-b5cb-791216971479", "comment": "Malware payload (LummaStealer)", "value": "15a205b9631aba7dd2396ad9fa7ee0ee06c3c8f76e256e0fefb97bbd92d8ffd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869103, "uuid": "715102dc-4b0d-4e91-b5c9-0a191015b6ec", "comment": "Malware payload (LummaStealer)", "value": "b1aafed41b0c808950659349dd6a4d328dcd79dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869103, "uuid": "3fb3d1a2-b1c5-4d17-892b-7aaa97784fed", "comment": "Malware payload (LummaStealer)", "value": "b74504aa9b68938d98923dd23ad36e629ffc70e7b3ff92fd4d34dbbb60e54e26923dc2c2f3263e8ee60053c7a042a60b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869103, "uuid": "923a7490-8865-4477-b98e-798a25f022ef", "value": "T16155E07270C1C073FA4199B135A9E379146BFA72DE2E4FC7A2B4E3649148BD017AA11F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869103, "uuid": "a3efc36c-d495-4490-a7a7-4bef692a181a", "value": "d462aa757f68629e41b3df6e6d4c6a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869103, "uuid": "79b7747f-3d8f-49c7-a7cd-cfaa9d8668bb", "value": "24576:nAi/c6dNtEWZ4B+UsxoxbzmXwxQAJeqL5Z8xQAJeqL5Z:x0qNtnKB+UsxoxbzYwxQ2j5SxQ2j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869103, "uuid": "e87b567b-ba6c-4201-ade5-7e4c5079eb2b", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869103, "uuid": "9162ebfe-f858-41a2-a87e-99bfd661d993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869103, "uuid": "cbd3b407-388f-4126-9ffa-6b8b6710c536", "value": "CheatInjector.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d5e40c-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741833414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833414, "uuid": "276d04d4-25e2-4e13-8887-e9e38237cf1d", "comment": "Malware payload (Prometei)", "value": "02d3b71e97e14d551a6ab2dd6fd73a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833414, "uuid": "c6ab2ff4-f0e3-44da-ad28-51793be15a13", "comment": "Malware payload (Prometei)", "value": "15e8615cb228cfbc68f3a7e2f49fe93c18372064b642ff35f4b5e89986c87e25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833414, "uuid": "61ec03b0-a2af-4a82-8d97-26ccea29eeb3", "comment": "Malware payload (Prometei)", "value": "7d41251917f75a17bfec32ce4d1b06ebc749e59e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833414, "uuid": "0878e3bc-dddf-4f49-a2aa-2bb4ebbd20dc", "comment": "Malware payload (Prometei)", "value": "ce426da3a06a6110239ac8f860f88547e20e636ee03ab433a561471155150c9add16e8ede0413a42bfaa2edf413aa1bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833414, "uuid": "7c114aa3-6cfd-4abb-8c8b-dcaed17bcead", "value": "T1B39423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833414, "uuid": "ce414653-a0a9-480b-a053-535ec6fb38d6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgy:25WOSACZSV6eKRH5EPiamb4DsDwwcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833414, "uuid": "230b9f6c-d293-49cd-9da7-65a20a7185ad", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833414, "uuid": "22882fd2-baee-42cd-a58a-3bd6dbbfc7fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833414, "uuid": "f0441d98-f736-4f82-be9e-6c6e4052757a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977f8941-ffb2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741832798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832798, "uuid": "fa7b12e7-28d4-4590-828a-61a65d57a11b", "comment": "Malware payload (Prometei)", "value": "675342d6f09f9ffaf2b108e6c7b15796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832798, "uuid": "0fc01b28-03b0-45e3-a7da-033717903216", "comment": "Malware payload (Prometei)", "value": "171324dbe94fcb2a5d072a99e18ea4f0bbeddc0c9dd2f2db18d289d6352853ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832798, "uuid": "cee292c1-9e11-435c-95f9-a25924112b6a", "comment": "Malware payload (Prometei)", "value": "7f76a99830cbd7ad4be66d1873b10a62c64d669e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832798, "uuid": "3b805b43-a323-4c9a-9824-cb8830cdac51", "comment": "Malware payload (Prometei)", "value": "fd5ae0ee3b75c10d1d52198569a4e479a5552f9073995c2f1c62ce976b2279e372097cdbc0826a971449186ee3aba0fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832798, "uuid": "6bbb7beb-53b4-4539-8886-e84447980e73", "value": "T1AD9423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832798, "uuid": "0d1a955c-226c-420f-bc3c-202fe7582e27", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgc:25WOSACZSV6eKRH5EPiamb4DsDwwcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741832798, "uuid": "0247021a-3d60-4f42-8472-039743f6ade3", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741832798, "uuid": "9ff2c372-9c84-4d71-bb2f-ecea95acab16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832798, "uuid": "21c7df03-414d-4f60-9fe4-4b08ec0c0af4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d55c55a-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825050, "uuid": "ff5ebafe-f36b-4ae8-b9f2-017c32cc4789", "comment": "Malware payload (Prometei)", "value": "da59f28e73a3d5072e27127bc9ffefff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825050, "uuid": "72539e84-e57d-4476-9550-a95bc0bf3ee7", "comment": "Malware payload (Prometei)", "value": "175c32a73b007a075371dd5f56ef396e985db52e3bc3464ad9a6b8bbc00d934d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825050, "uuid": "84a09796-e918-47bb-ab31-b9c4ad744230", "comment": "Malware payload (Prometei)", "value": "3f58cd59f8898741a26c28e77d3b83360f96d649", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825050, "uuid": "4d7ce8de-12f5-435a-a879-a2a3a94fd67c", "comment": "Malware payload (Prometei)", "value": "2112bac7c441016152013a39bb5e5653873e5113867d5d2d857eaa15fa80bf9de153df29d471e8fa6b5d50ce6057412c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825050, "uuid": "3b4b2f92-6468-4966-8cac-1cb40ffd6c5d", "value": "T1179423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825050, "uuid": "1c286193-f5c7-4cc2-8286-6059b25cdfc8", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgg:25WOSACZSV6eKRH5EPiamb4DsDwwcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825050, "uuid": "45978cda-db9b-407d-9d70-ce5fd3ed9c6b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825050, "uuid": "32a5ed9e-5a04-4b77-a7c2-3f645d9ee956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825050, "uuid": "55ee47f2-373f-43c7-95a4-ce9f3054a4cf", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82183130-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879577, "uuid": "0d54cd18-1f45-4b4c-9595-2c63ae2d6ed5", "comment": "Malware payload (LummaStealer)", "value": "5b63b3a5d527ed5259811d2d46ecca58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879577, "uuid": "b448e531-c093-4cf4-bbc6-4ca8f9579df9", "comment": "Malware payload (LummaStealer)", "value": "17a3259df1b54d390acd9b338e0afd6a3ed926f294e494e07512efdb99bb99fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879577, "uuid": "ea548cf9-049d-44d2-9147-20cdc931e08a", "comment": "Malware payload (LummaStealer)", "value": "8382155b7c465dd216ea7f31fa10c7115f93f1c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879577, "uuid": "37b4f334-f3f6-4d08-85ab-9e0f101d1ba0", "comment": "Malware payload (LummaStealer)", "value": "317e857b74b8ace2f6fdd9a8a400e0a6bdfd400214806d7f967eddc3e4cecf4b81b2ed2c01698bebba93e41d1e130d60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879577, "uuid": "6e05a87a-73a8-42e8-9a10-a9309c330bd1", "value": "T102F4D046BC91D0B3E91628B14D29E7C50C6B6B604F20C4FBBED89D646FB36E18932357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879577, "uuid": "3db3a252-7ed5-4427-8981-56d58dfd4eb2", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879577, "uuid": "e414d6f2-58a0-4ff0-9fdb-91a3b79e2899", "value": "12288:GIJQ/s2kiatVPnIpbWiJ621POPAANU/Sc+e1RoKq/T/+Kc5fBzBS0+I4d0Z2cdPQ:7BnIpnJhdQAANeNboz/aKc5fr3l4dzcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879577, "uuid": "af59c764-eeed-4633-9f18-30b21a6c2111", "value": 775488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879577, "uuid": "add499ba-ee7d-4318-9c5c-da655f1d5270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879577, "uuid": "694d6ff5-316b-4dce-9a7a-b93d14c78fe7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011de39f-0048-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741896970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896970, "uuid": "48260202-a550-467b-89bc-0df9f51171bb", "comment": "Malware payload (MassLogger)", "value": "e160de033812eb66ef818ef415e8ff84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896970, "uuid": "7ac76462-80b9-44f0-a833-9697ffc6047c", "comment": "Malware payload (MassLogger)", "value": "1827dfee3f5db9c0924437ebc91434d916f36f7ed1be8b643d2df2fb9d7e07db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896970, "uuid": "4d29ac67-3c97-4b48-9d78-4465e2d34853", "comment": "Malware payload (MassLogger)", "value": "da4d6e7ad211d7a7db5e39002bd4f972c530013d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896970, "uuid": "f6c6b15b-6841-416f-b5db-94849e07d569", "comment": "Malware payload (MassLogger)", "value": "63cadebc316f7dee6e46f49f9811f5028ec00d428dc109e4a5b67653d45b165afae9f18442eeae7682315431c0a7195b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896970, "uuid": "c45ba5c0-78f3-4a8a-ba9b-7173c30a1290", "value": "T1A1C4DF987644B59FC897C9728E64ED30A2216D7B9207D343D4E72EEB790D1ABDF001E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896970, "uuid": "5d7a5ed3-27b5-4360-a2ab-c55725eb2b55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896970, "uuid": "bf4b92de-b158-4cc2-aa51-74016aae2cc3", "value": "12288:C5H5MOiV19XrPwuEHGq6zkQnOtMIa60xXM6NYJ58OKnEtoW:Cd5MOiX97+mPoQmMG0x5Ns58OL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741896970, "uuid": "e560fcb6-91ba-42c0-9069-d1f7a131d613", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741896970, "uuid": "0d59fe27-e012-4848-919d-ddf17efd9bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896970, "uuid": "e8867956-0936-4c59-9ebe-6bb0f0f83b73", "value": "Mv Arkadiy ChernyshevCall for disch logs 8000cbms_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde99cc0-ffa1-11ef-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1741825588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825588, "uuid": "00d799a7-b7c9-468d-af6c-61e2da91899c", "comment": "Malware payload (SSHdKit)", "value": "77e5c8c88cc3302dbe27adf8a63d8315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825588, "uuid": "51c0c84c-a6e0-4f3b-9d35-ce91d3467d3a", "comment": "Malware payload (SSHdKit)", "value": "182d88fc3d4f143a7b072d80a564262e887c221d8e3e09fffd31a7c01664c64b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825588, "uuid": "a863ffc0-49b7-4ecf-9c8a-b7c4722fc0ce", "comment": "Malware payload (SSHdKit)", "value": "317e7cbeac0d72bd47395a368a4af2fc902ccf02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825588, "uuid": "441ee68e-d899-4c8a-8258-41a2d90ae601", "comment": "Malware payload (SSHdKit)", "value": "5fb5e204d62ad086316efaf8c1fb2365b2aac298d595deb565dc07a59b2a7671d3ebfd3f48fa65b25ea99d208687f52a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825588, "uuid": "fcb0726c-d001-4b1b-94c9-289513144e61", "value": "T1A0356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825588, "uuid": "da407a94-05a1-4908-9cf2-5423b5728eb6", "value": "12288:E8dASOYRNCAJmmp208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbs238+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825588, "uuid": "768dd300-d5b1-4a40-b5b4-c77368fb41af", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825588, "uuid": "1b48bf66-951b-4bb2-857f-a09c79482222", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825588, "uuid": "ee92fdd8-998e-47ed-a1c6-40950d7797f9", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba580b0-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825020, "uuid": "562c9511-dff4-46ab-8529-fd1f6e10c996", "comment": "Malware payload (Mirai)", "value": "b580026c4a72ea0ce1f1bc0903c7722d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825020, "uuid": "0fe357e0-6b2e-4081-88b2-1209fb05684f", "comment": "Malware payload (Mirai)", "value": "1ac117a78fb1a76205b327dd19fa4db1944869010b8e55bc76b794c9822eba1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825020, "uuid": "091e9275-15cb-4e85-9802-912e91e49ccc", "comment": "Malware payload (Mirai)", "value": "a853abe1268cd7af4fdb625bdef25084ac726536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825020, "uuid": "aa6e07f3-c5eb-4e25-9a17-ba6ae18ec3ff", "comment": "Malware payload (Mirai)", "value": "ff3ed59c31d2feaa08439d377964b9552544143e7cb47dc50e15883e59c2a27ff5feb4394d2e62968c0aa77fd07f1ec9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825020, "uuid": "ec49986d-8f62-4bca-85c6-a5e7b0350ca5", "value": "T11B834B96F801DD7EFC0FE67A4456090ABA7063D206430F3663ABFDA36C731A57916E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825020, "uuid": "ce522336-0536-4a9d-8d59-dd4547377c94", "value": "1536:Z7CsERYpLOsMErQLzTMwQRVhgtVU8pep5yxdbBqRK1xPQt2CUnL7y:ZbUvGbhgtwMd1qIaUL7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825020, "uuid": "b9ca11bb-5207-4da7-ac8f-4dd4805dcccc", "value": 86800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825020, "uuid": "9e086e03-9b23-44b7-9ccb-add7fa0f7602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825020, "uuid": "96b8b4ab-5359-42ee-a8fa-5d94a9e93d38", "value": "Federalm68kAgent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d71d3b-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825036, "uuid": "47fc1eb9-9b7d-43c3-b7c2-ce50c4ae4ce7", "comment": "Malware payload (Prometei)", "value": "298cb7655b61fe5565b5335866fc3e1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825036, "uuid": "1a40fd11-95f8-4727-823f-8f9da565c806", "comment": "Malware payload (Prometei)", "value": "1aef01501feef2f2d0382b86709f778045fd2d83c7fd46d3045a6cebf4d5c3ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825036, "uuid": "cc6f5a77-3c63-4199-8e83-93e6423f9890", "comment": "Malware payload (Prometei)", "value": "1b47065f9c51da0b237f7f6f36acecfcaccda5cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825036, "uuid": "7451891e-5880-47b0-856d-4a00f7de0b41", "comment": "Malware payload (Prometei)", "value": "c0507cc3a65423fd53d784d34ef01e05fcd2da7f3c648a75cd62a29683e72882a367b5ebea5e85d13b2f0b09daa37c4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825036, "uuid": "6d28f747-3644-4a53-be3e-b1e73f7e74db", "value": "T184155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825036, "uuid": "5019d672-d72b-4b7c-a640-f81630b2bf2f", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplw:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825036, "uuid": "fd95fbfa-bc44-46fe-a38d-2203e7b95fe0", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825036, "uuid": "c9bea950-a3b5-4d28-82c5-2418e64a6cc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825036, "uuid": "43757148-1c65-4c3f-a516-f230e9983058", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9ab18d-ffdf-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741852055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852055, "uuid": "5097e355-0e83-46f6-a1e4-b07d41b74ce0", "comment": "Malware payload (RemcosRAT)", "value": "36957a0ab1111e6cd8af65a76efc5e75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852055, "uuid": "a85b47dd-a4c6-45c1-8808-866bbbf27c93", "comment": "Malware payload (RemcosRAT)", "value": "1b2296e9e4652b6fb056c0c2d0ef009af653d13dd274af267314288759165fe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852055, "uuid": "717ee215-f5f6-4c98-9d2d-d8974f37423d", "comment": "Malware payload (RemcosRAT)", "value": "bcf5d2e28a34e06cc95c65ad21ef3de69a0dd45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852055, "uuid": "59bcec3b-9f9d-4f57-a774-2b7b5d61bfc7", "comment": "Malware payload (RemcosRAT)", "value": "e1248c20d3bc55cc5f34e4fe6dbb72f9bed473d6e2b4834cbc1eb398b186f7e297379cc686f4817a7b92c8bf218f8a61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852055, "uuid": "562e3926-3f06-43fa-9753-7c36d0736c5c", "value": "T1DEE4F1163B78F417E115E1B45BA2D2BC6B78AE54182B830AF7E07FDB7A687436C09314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852055, "uuid": "f5a49b3a-6a1e-4d01-8fcf-7d2c31029225", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852055, "uuid": "49290904-a33f-4994-b8e1-d22429d6051d", "value": "12288:Acpp++yRYfE7WxIQFxzpX712UoSrtGTiOJQ:Acpp+di82xp2u58ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852055, "uuid": "d3233052-0e84-49e4-b3db-8ffb1863965a", "value": 664785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852055, "uuid": "c4bdf42a-7431-4cd0-89ea-9247b050a6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852055, "uuid": "1e7c7151-5175-4498-8a2b-3d9a592c0164", "value": "Pre Order stambe offer 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da1f907-001a-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741877288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741877288, "uuid": "505c06df-d5e0-43b7-aa83-3c597581ee07", "comment": "Malware payload (MassLogger)", "value": "80580301bca52941a596f88ecd40f28e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741877288, "uuid": "a3f205f5-9464-4c9c-bff0-f5e0ec5a6274", "comment": "Malware payload (MassLogger)", "value": "1b5cd72684917ce49995daafa3a6f98ff082b0f2d05807c746ee04a94c8ecaf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741877288, "uuid": "f729031b-ff97-4a8c-a846-980a3ad4614c", "comment": "Malware payload (MassLogger)", "value": "3291ab96b2a08a7e2199d877061b99ae9b437402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741877288, "uuid": "fb306360-f5ce-4785-aed7-58bd7faf5d2f", "comment": "Malware payload (MassLogger)", "value": "7d0fdecf20b39897e5794448690d43273696ebaac38423632530fa060cc0dd8de3cd3978eed56b37dcc03580100c3c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741877288, "uuid": "95f10b88-ef4e-42cb-9072-0307da26665e", "value": "T109250291F648D750DA041BFD0D58C5B687B19EF8A871C2522CEEACD7FAC0B63A609707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741877288, "uuid": "69ea2e2d-713d-4891-b002-3086de9cceeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741877288, "uuid": "86af155d-662f-461d-ae0c-8b46ecd74197", "value": "24576:tnOeNMOiXBVlVlVVVdHSMpCIxB3GyMJ9rH5L0PKVW+EGjc9VlVJ:FMpRPPP/HSMwIv3Qjz3E+EGwPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741877288, "uuid": "9f3ae8dd-6634-43cf-bbf0-9b92ee86ae65", "value": 1012232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741877288, "uuid": "66214212-3995-4f7c-8325-8e957f8f254a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741877288, "uuid": "063ba3df-2c67-4f32-8df4-d9053203c21b", "value": "TU SW Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e7f780-fff4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741861160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861160, "uuid": "49dfabfb-2c4e-49e1-9b00-0d1c448f5564", "comment": "Malware payload", "value": "8a12e997e672b80319c5b852b237e5a9", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861160, "uuid": "e56c16d1-9171-483e-9426-724417726d6f", "comment": "Malware payload", "value": "1c486702b74550c0abe3f5e353f52b1d4c737bfc253b4db3fcdd9caf6612c98a", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861160, "uuid": "59450143-00e7-4b81-8550-587904e261de", "comment": "Malware payload", "value": "d11a0b8b22869c004247e1888ac5ebe6b207c1d7", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861160, "uuid": "d65925fe-2620-40de-9455-3b8f2abe7a05", "comment": "Malware payload", "value": "7c7c8fa45600cbc07f92a0d7f3795c80aee407fa32191ca79d1725e0f08a10a80890f404e78d50ff79dfbe0e51999269", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861160, "uuid": "547a7440-aea6-4dec-9ca7-8ab2a7491e40", "value": "T15431FFA1F8FCB45E11B7112C60096842D0FE2B831B3C0A1B9BB4BD65562C216B0DEEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861160, "uuid": "97fbdff4-f1e5-42a4-8828-606b322cea7d", "value": "48:geT5KtfEzwy8zJ7fREQQfI96EZtPtcuXNr3LiSqi:geT54R1DRhSe6Q9Fr3Opi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861160, "uuid": "77c165fe-4ea3-4ad2-bccb-31e0b64f18b7", "value": 1654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861160, "uuid": "0b018d5f-d234-4da8-a5ce-1b84954f8959", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861160, "uuid": "487e1c65-9976-4c29-9eab-2728e50bcfdc", "value": "1c486702b74550c0abe3f5e353f52b1d4c737bfc253b4db3fcdd9caf6612c98a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c61389-ffa9-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741828715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828715, "uuid": "70109e4f-8888-4359-9858-4517ef2880b5", "comment": "Malware payload", "value": "b5dcda10d5904974701246aadd2141fe", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828715, "uuid": "ec160749-a843-4581-85be-f1734c00cc37", "comment": "Malware payload", "value": "1d075cb044ffe864c4e597fbbe1830c009c454bfeb935d89709a85771e72125d", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828715, "uuid": "159509fb-43b3-4bf1-afb1-c0370bf2dba0", "comment": "Malware payload", "value": "94bb9da8d78305c30bc0409899ce28613f7f77c6", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828715, "uuid": "97f910ca-2bbf-4e18-b3fb-87d0ce139343", "comment": "Malware payload", "value": "c15b65a1b8b9eb707f03089612d60a0ef575619056e07fc2646aa92f7e7afae39431970ebe469918912b555a1b505e98", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828715, "uuid": "bec372c5-562b-4d57-9eae-d94bba9dd179", "value": "T1B795D097BA89ADE3F824023988F69325033DF7C50B824B975D30993A1B575E0BFA5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828715, "uuid": "d44c7281-488b-4867-aafb-8d1c98fbc1d7", "value": "db509f0d296d268770c3b20bf5581bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828715, "uuid": "d73c2a20-f696-4648-98f1-552cf412c062", "value": "24576:yHqCurMqTBSVFdk52o/pQ0WfMQ1jEqpFfrRVGs3:lIiBSVFdOF/Gn1YIdrRVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741828715, "uuid": "def1f273-9fce-49eb-a111-9e9b7549ac97", "value": 1976832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741828715, "uuid": "342a831c-5365-4f8c-ad5e-d729cb6c2a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828715, "uuid": "810c2483-15dd-4415-8973-c2930e7a6ecb", "value": "fuldfzfhjjog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3ce9c8-ffdc-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741850685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850685, "uuid": "e6716516-d086-4227-ad13-a88be8cc6e9a", "comment": "Malware payload", "value": "f83b2303485f3a9e291aa288c40e4b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850685, "uuid": "6caeb82f-e190-43c4-bb85-3c420d2847f9", "comment": "Malware payload", "value": "1d4106e95290ae2588e4c718d4a3e609c90658768428f5ad214317766e219eec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850685, "uuid": "d4757f0e-06b6-4f7a-ad1d-5c6973faf191", "comment": "Malware payload", "value": "9dc7bbc90718d8c9ef6c1392a0bafcd322761d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850685, "uuid": "048356a8-b31b-4596-a020-32c3871f125b", "comment": "Malware payload", "value": "ca5db54cc13dd6cfb081fdde257c3f45d78e0d87eb57887650c5091acb059ca64c535c0afade8a90d3e1f3cff5d8f653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850685, "uuid": "6fc0059e-df55-4dfc-81d7-fa7f2e51f2b2", "value": "T111D228092FBDCB69D2BC4B7424F254540BF5E21BB952DF994EE860EA18A37804501BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850685, "uuid": "8520726f-98b9-49ac-bf4a-648b251da034", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850685, "uuid": "1bf9e6ba-9976-4495-b9d7-6945d9eefc01", "value": "384:J1qkrWeGpXhpE2XadFL/LMcpKGtyx5CD4KU+BaZjlKa3YO/IxYykDpSewuolv:jqvVa73MxdxAfGZ6O7XDElhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741850685, "uuid": "5e6a1a34-d205-4970-833e-192fd091f00e", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741850685, "uuid": "e14d97c9-7c76-4389-ba52-f1ff2b3cb831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850685, "uuid": "6baafc5f-517e-46bd-b556-5fd906f352c7", "value": "dropper_cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b56599-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824978, "uuid": "1cc11215-0156-47b2-8593-92afe0406291", "comment": "Malware payload (Prometei)", "value": "2df630ca4cedd48514819f6edde437eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824978, "uuid": "3f41b24c-4fd4-477e-9383-d406684f576d", "comment": "Malware payload (Prometei)", "value": "1d4bf41a1b9faeee4cb3a66aba65a7a0527a91e2f98231cfa12c17bec7e2c8c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824978, "uuid": "a577c888-af24-4375-83c4-e515c3b9f5a1", "comment": "Malware payload (Prometei)", "value": "4f7580fb066ebc481b3c6606bf9eb17229e0c7ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824978, "uuid": "dd030cf1-04e8-4558-b3e1-6d72ef5556a1", "comment": "Malware payload (Prometei)", "value": "ac286220218bb5952d337a5e988492bc1c303fe77809083ad83eaf46565dd7815734a2839300e84f43dfa76118ecbda2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824978, "uuid": "efd5ee81-e5ff-405c-80fb-5ccd6700ef3b", "value": "T11F9423F8C87D2E3098169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824978, "uuid": "b020978d-ffc4-40f1-bc9d-850e5abd94d9", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgQ:25WOSACZSV6eKRH5EPiamb4DsDwwcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824978, "uuid": "c8ef0333-7ae2-4593-bd1e-86924bed226c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824978, "uuid": "66bbab56-31e6-4707-9cd7-e80d68cafc17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824978, "uuid": "b6f5344e-9313-47ea-b039-64d037efc583", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db08547-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825024, "uuid": "e70c1313-c40e-4ba6-a5fb-ea471e78cc69", "comment": "Malware payload (Prometei)", "value": "a5c680dd9aac542be24349fb3fb582fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825024, "uuid": "afbd3b39-428b-427f-a1d2-2934c9c8f374", "comment": "Malware payload (Prometei)", "value": "1de096b9e8504d4d481c1022221df6512cec494a13ba711344dff08bbd7ad81e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825024, "uuid": "b04795ae-ebf9-4460-8c9a-215916a13e61", "comment": "Malware payload (Prometei)", "value": "de84e927eff98eaaa03f817062dad4ab4c584983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825024, "uuid": "1e8bcc31-2091-49fe-a322-e9693b9105f9", "comment": "Malware payload (Prometei)", "value": "7db57346186476475ccd91102dee74dadeb9b9df0fa97606b3ec2e24880e6c6558a284a4544e4e11c4c49ea69af0c598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825024, "uuid": "86528bca-4a56-43d2-81c8-5388a25ca8e7", "value": "T1D99423F8C83D2E30D8169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825024, "uuid": "edf0aec9-714a-470a-9c33-06457872e1c2", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgd:25WOSACZSV6eKRH5EPiamb4DsDwwcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825024, "uuid": "b6b0f298-4b05-415d-ac11-3023867f587e", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825024, "uuid": "d1227f13-5708-41b9-8405-59829fbdf709", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825024, "uuid": "54495eb8-0050-4ec1-9d42-070d7ab25c1e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e3b4c7-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830401, "uuid": "10ead5d5-df24-47a3-8da2-3ddfeff1b5f9", "comment": "Malware payload (Mirai)", "value": "39be61a6ad4e0e41c667664f326f8921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830401, "uuid": "88505207-09aa-4013-b1eb-6733bcaaed44", "comment": "Malware payload (Mirai)", "value": "1dff9a1d391ecbec67c6abcf6e03e7ea520243b0294c2c0bd40e57dafa69d6b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830401, "uuid": "f3fe2335-145b-4539-b2b3-fe10b83f242a", "comment": "Malware payload (Mirai)", "value": "f0c9ce5aad585db842e54082ae82c62303a17430", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830401, "uuid": "c95ae2c8-b547-4ddb-ae02-79972da974bd", "comment": "Malware payload (Mirai)", "value": "b195773049ac939c6575ce01f1ef1d633b0a71575da7a034268f9cea3731eac3f2cb15f80b104f8a6b440564b4845a8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830401, "uuid": "7adecf44-0b23-4ac1-9e9f-2da3c3395147", "value": "T1B8034BC8B903DEF8FC1606F52136F776ABB7F07E2168D997C39994329C42A05A5022DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830401, "uuid": "85a1b3b5-ff03-43c8-a742-311b66516f99", "value": "768:wZT8eJBPC4AJ2UKM8jbY9A9/4OEG1eIqL6EKLILEOxhPEdEe7V:wZIeTPC4AJ2UKMAbY9Ax8KA6eLEOxhcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830401, "uuid": "74c53d7d-ee05-4a9d-8735-dd2c35a26968", "value": 39388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830401, "uuid": "05bac57c-25ed-41c5-b0db-8b7407c0383e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830401, "uuid": "b1bcda4a-b51e-4c4b-881a-cb92191d4708", "value": "NewAge3ATOx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfca0f4-ffb3-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741833104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833104, "uuid": "b5a29887-e01e-4270-8421-a26267655dc1", "comment": "Malware payload (Prometei)", "value": "682e4992315ce913e4fdb04cfa31a132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833104, "uuid": "464fff73-de5a-4b90-a98e-79f4f95baeb4", "comment": "Malware payload (Prometei)", "value": "1e42179e64b3fa89b3c4400a0247dd78c827b33ee84e3760bf8825c7a40d0361", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833104, "uuid": "30721344-580b-436c-bed5-6c9d45bfb0b1", "comment": "Malware payload (Prometei)", "value": "919bb08734fa89c6082ef06ef919032ef17bb3c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833104, "uuid": "9e5fa1cf-f8ef-4a88-90e7-dcb3c13045f1", "comment": "Malware payload (Prometei)", "value": "72c35979fcab474510506883718d834f2d543cf796d6ff143df2221fab757bc91289fc1ebfcc3f2952d5f9eb89b922a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833104, "uuid": "04269962-1fe0-4654-b905-4ffbebd7c9b7", "value": "T14B155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833104, "uuid": "e2311a84-c0d3-4996-9f7c-fba6d95be865", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplY:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833104, "uuid": "91eb7a3e-d9f6-4649-afc8-89d965db70a1", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833104, "uuid": "51164860-08ed-4e55-a615-8ff42ada0a7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833104, "uuid": "4ff9c9e4-490f-4fad-b8a1-9fdc4b86310a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfc34ad-0037-11f0-ad17-42010a9c0004", "comment": "Malware payload (DanaBot)", "timestamp": 1741889715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889715, "uuid": "584625c1-9665-485e-a580-c1896678237e", "comment": "Malware payload (DanaBot)", "value": "43f619fb53532ecccbe43ef562216828", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889715, "uuid": "561c4296-8ba8-46de-99b2-0e1ea870354e", "comment": "Malware payload (DanaBot)", "value": "1e6401779ea281591bc1d5d64b649f4930c27d6667f3af2b693a881ef998fe8e", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889715, "uuid": "c97cb4da-45c2-44e4-9974-28c9515833f5", "comment": "Malware payload (DanaBot)", "value": "77aa549d4a54351ecb49ba65697acb3d8451c110", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889715, "uuid": "642cd6ab-08ab-4237-8de6-afd3b4093e47", "comment": "Malware payload (DanaBot)", "value": "42018c3c3f9ec211194eb2c5d2d209042966e08ed2d9fa82f8bc6cc1e7389072b8ba17f9274c7a8ae5f298886eddc887", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889715, "uuid": "fc70faa2-7238-49ea-916a-da1063bf0672", "value": "T11A563320B5A0C434F6AB1AB18E7143E5643A79A1FB70A4F725C138E95630FE19C71B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889715, "uuid": "8fd118ec-5fa6-415e-bbe0-e96227896ec7", "value": "84280d71006cafb4d601162512079e24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889715, "uuid": "91ba8667-396b-4641-9886-746a889bcddb", "value": "196608:bN9GjzJtbnktN9+ETUrEOB24lQGsyUEAgs2HQVfxkP2/:bTGhVn4N93UHJHsy6LlfxkPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741889715, "uuid": "561b5616-388c-41ab-87eb-f174735e952e", "value": 6330486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741889715, "uuid": "32d8a65c-1df7-4098-8e83-fc24ba7f68b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889715, "uuid": "e84cfa71-ba55-4c5c-8811-07df9db58cb8", "value": "43F619FB53532ECCCBE43EF562216828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdc2eeb-ffe8-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741856085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856085, "uuid": "cfc75c44-52a6-4b54-a36e-8f384a32c921", "comment": "Malware payload", "value": "5debd022a232b43ccf244c44ac968039", "object_relation": "md5", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856085, "uuid": "d5862bc3-7f2f-4f6b-8fb0-8bf80fc67317", "comment": "Malware payload", "value": "1f1147b7a5491864eb01724197a1767809bf866b6e5725bc22894edbc844b48f", "object_relation": "sha256", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856085, "uuid": "a8ce7978-467d-4efb-8e7f-89296b20f781", "comment": "Malware payload", "value": "9b8270d7590ea7b76f1599ecd59d15df76569237", "object_relation": "sha1", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856085, "uuid": "5bb954ad-556a-43e4-94d6-e3787306014c", "comment": "Malware payload", "value": "19077a479024512af1ae56840cea1070facc8a60f7355de906345f6763f8102235ad5b84d17b1346ef88f405c6a1d4b9", "object_relation": "sha3-384", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856085, "uuid": "08dfd1c6-8da6-4484-945f-2bf37db86810", "value": "T1B5C249837F02B25802F7D36ADCB575D0F91D966B070D28A97A4CA4804F79B786B7CB48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856085, "uuid": "1f887c1c-edbd-4757-917e-89f51ca4c2c6", "value": "384:kH+2JRLUi/TZWQLW7NnWl0c7mAYUoEkbOgc35vn8fPhh29C/h1HWO0VKktisWn:g+2JRLUibZWtZnWl2o2OdJoPXWiFWHls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856085, "uuid": "a3d44a5e-c493-4412-b6c9-951ad2daccec", "value": 26470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856085, "uuid": "b2c372db-54e7-4f26-bf95-2988a3ddd48f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856085, "uuid": "330fb454-25ed-4da4-a912-0c6be032f5ee", "value": "brave.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab75073-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825045, "uuid": "8068c678-a9c6-410b-a4a3-226a12db47e2", "comment": "Malware payload (Prometei)", "value": "37d2e646233707e40e16e024a0151bdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825045, "uuid": "5d81bcca-f0eb-45c7-8a93-324c84ae8d57", "comment": "Malware payload (Prometei)", "value": "1faa556995b4e2f8aa99672f2a7cdf2398ac512ee64f958b141148d5838006b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825045, "uuid": "4430b392-bac6-44cb-954a-a8d6c797db34", "comment": "Malware payload (Prometei)", "value": "4af075aa2774653670139c006390adb70d12dc1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825045, "uuid": "3a7ff763-da5f-478e-96cc-a8d50c27f23f", "comment": "Malware payload (Prometei)", "value": "bffecac48eeeadedf5e2a9f33cacf6d1b40c6af67b61aacaeece957c7a52e32a7989a6356b1bf54fd380e20f196da451", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825045, "uuid": "bbedbc3a-c890-4972-820a-8788bf61912e", "value": "T1AE9423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825045, "uuid": "1177c7cb-e383-43c7-803e-489065357b18", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgu:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825045, "uuid": "dc82fa85-8134-49bf-b00e-05a5a43c3fef", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825045, "uuid": "31fac26f-d746-46c7-8857-8400f2be60d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825045, "uuid": "f008168e-723b-44a1-add3-022c58f7706f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f96a5f-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830406, "uuid": "5db1d431-a812-4e2c-908d-445bba153a6b", "comment": "Malware payload (Mirai)", "value": "eddb30b0a73eeb7a8acbc663a467066f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830406, "uuid": "c43e85fb-54df-43f4-a963-b100c0086cc7", "comment": "Malware payload (Mirai)", "value": "2028ac2bd21ed7138bd3fb5e8ad2b12240cbd377b3714f4a00b866f2fa3e4aaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830406, "uuid": "e49a9ab6-3edf-4f8b-86c4-94423cb6157e", "comment": "Malware payload (Mirai)", "value": "a6f211f8cab8b6ceff77a6fd6ec22a530c36d6cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830406, "uuid": "6a3e5bf2-31ba-46e5-bc1e-a80b090057af", "comment": "Malware payload (Mirai)", "value": "959a27cc922902947cee4e670b4917dcf542177320116d64181237c53961dd4f6a5bcf2325f519f75954869abf6c2229", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830406, "uuid": "d5c49c1a-ec35-4e12-92c4-61847511d07a", "value": "T1B5130807B98680FCC0ADC374477AB53ED53375BE1239B2B63BD8FA129986EA11E1D444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830406, "uuid": "a67b1b24-cb3c-410f-8c0d-f32ee6594057", "value": "768:Gk5eyDqS5ElOs+Z9DpN+Tb4/409SAAWg7NX+GBz79Zt:bdDqS5Elt+Z9lsTbU4b9JNX+qRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830406, "uuid": "1dba1e92-f2ef-41af-83b8-944d7ba415ff", "value": 42784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830406, "uuid": "13fa49ad-ec0d-4088-95eb-1ba983a159e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830406, "uuid": "e47c429c-1791-40cb-9d73-448dc9748fb0", "value": "NewAge3ATOx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab063eae-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855594, "uuid": "fe2b4d19-5b26-4682-8ce1-fd23794daace", "comment": "Malware payload (Meterpreter)", "value": "b4af8d1f1b89b5a3ebf97b97aaf0ea4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855594, "uuid": "21ef45be-323b-4a77-a746-7c13b69e8fee", "comment": "Malware payload (Meterpreter)", "value": "20951627ec5ed069edaa2522eb3cd587d9644ee94f7c15e91d9553a518a4e1c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855594, "uuid": "6c15350a-ffc8-4df9-ade2-4df7f64d7e2f", "comment": "Malware payload (Meterpreter)", "value": "06066c2d10291377cea0fa3f1f8d7cee9e8383d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855594, "uuid": "9580f460-fb94-46aa-8b0e-fb885b43f367", "comment": "Malware payload (Meterpreter)", "value": "beae9a69d56f7ce75acc1282f5f4cde9c5586f299028864f98579cb967fd4d2a3dd0e44b6b5f5a3f6650def74687c6f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855594, "uuid": "e2cee5f1-7ae1-45fb-acb0-82f9ad0e8787", "value": "T141E1752337144DB6D87C153D56E3FCA761884E283F2B82B58D1803173962124B9F4D14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855594, "uuid": "2f829d03-6cfd-43df-b543-125a8fd9ad40", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855594, "uuid": "55303059-ef8a-4ed8-9977-4f1230fb252b", "value": "24:eFGStrJ9u0/6S2SnZdkBQAVAWYNwKLqY1eNDMSCvOXpmB:is0N2qkBQjeQSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855594, "uuid": "8f8cf66c-ca36-460b-a26a-d26e0862c742", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855594, "uuid": "86c7d222-1aca-4693-ad92-92505fa8187d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855594, "uuid": "ba7cf281-ab12-4039-b589-bf87918bb533", "value": "443_2003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ea5224-0056-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741903127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903127, "uuid": "b50370c5-3c3e-4c56-96e7-7e0b0f6c370d", "comment": "Malware payload (LummaStealer)", "value": "b121ccc530e761fdd8d3c141a4f348bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903127, "uuid": "c8e39aa6-4557-437e-84ae-dea3f3712ea8", "comment": "Malware payload (LummaStealer)", "value": "21b722775a2d91b9d932b3dd3f665e0531dcda3a848939766521f079353cea38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903127, "uuid": "820aeeb7-1dca-47b8-8973-0de51d6a785d", "comment": "Malware payload (LummaStealer)", "value": "e90430c6e0a496d7affda13ef964f5438b5418f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903127, "uuid": "5c82b61a-04a6-4f5f-b005-c5e6054e7740", "comment": "Malware payload (LummaStealer)", "value": "7063852a2f051d07ef68a6bd965506381899fcfdd2b43440bdf1b5467865b9cb8235083f17d7e56937e51fc5f4249ada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903127, "uuid": "39037a89-8005-4595-a646-1778b55cb854", "value": "T1BE76E141B1C1F3B2FA9211322D58E7B919FEF9719B280FE7B2D8E6795650BC0072512B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903127, "uuid": "9215cec1-d615-4792-bf78-16b3e9a2f8de", "value": "5b8a8fd8d0e3522d76d1afe467a940bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903127, "uuid": "98134b5f-db8a-4a0c-a5dc-0961aa5f51f9", "value": "12288:CRi2C3MaZ9O+qyZkXvjT1D3HrcKxRWTfG4HC7QL5qZ5vj5mKk5b:CRYVZuT1DbcZzXx5qPvjPub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741903127, "uuid": "0a6ee3b5-754a-4532-a68b-3fd302c775ea", "value": 7641376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741903127, "uuid": "4aa88cf6-fcb9-4f9b-9f21-d86334247cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903127, "uuid": "c5dc48e5-bfcb-4ad6-a112-46fca64ab99a", "value": "FusionLoader v2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a765482d-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848716, "uuid": "ae77e756-87d8-4437-9251-3ed56dfc2a85", "comment": "Malware payload (Mirai)", "value": "a981f8ad1ea102c5dec4b445069f78a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848716, "uuid": "96600af4-9f28-4e45-80d0-70ab9aff0421", "comment": "Malware payload (Mirai)", "value": "23465b2e89e2c7dcf24f0406013b9749023b87eca7318c8507e2962196a199a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848716, "uuid": "332dce31-6576-4269-b7ff-d03c9859bf0c", "comment": "Malware payload (Mirai)", "value": "d8e0c49385b678de331c7013b0473d5795b710d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848716, "uuid": "ef61ec0d-fd8a-4d48-8aac-87ff46142bfc", "comment": "Malware payload (Mirai)", "value": "b33a5060ae8a5a08766b855d9edc3a9f7e7e43599a3c6b5cc95b63888797cf983c97d7339d9b6929a9397e454897d797", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848716, "uuid": "aed61f77-d446-4341-a9f9-fb36bd412d8d", "value": "T197D2E078C3FB1A81FEEE5EB518C0C3D3276586627719497334F1AB451C16DBAB2066C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848716, "uuid": "69a2b3bd-1190-43a0-a8a3-2812b5e53245", "value": "768:L3uBvLOTzGrEV4BLtcF/GBkN4uVcqgw091:ISTsEVs6IU4u+qgw091", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848716, "uuid": "b859c62b-0e00-4cf9-83fd-dbbe4f21e16f", "value": 29552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848716, "uuid": "cfa84dce-9904-4367-9fb1-e88ff32d337e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848716, "uuid": "5588c1d2-b7ca-462a-b41f-a8c670bf9b50", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b7b436-ffda-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741849815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849815, "uuid": "696cf7e2-7c06-4ce3-ae91-d0d40f3c0b7a", "comment": "Malware payload (Formbook)", "value": "f2699010123637762f4c4f0b6abd6a1f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849815, "uuid": "efb98a07-79fd-4e2b-ad0e-f7b329014bdf", "comment": "Malware payload (Formbook)", "value": "23505165d56d49942289a2ea98011b6533ea8b4bd0aa36865d80932fadb8603a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849815, "uuid": "a9f28d30-e54b-4dda-88ab-9e6ac31c6216", "comment": "Malware payload (Formbook)", "value": "68dd1230d3c995ea148df7233814cf0ce26e01bd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849815, "uuid": "331822ed-1445-4ecd-a736-077805de0c05", "comment": "Malware payload (Formbook)", "value": "1c05612dd9baf3f727cc2e4ab721523b84cb3309696658901713d70e1c71d5920a89e170446a167558a5e7f6b0e50f8e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849815, "uuid": "4e2525e1-735c-4114-a0ab-7aa5d515a055", "value": "T1ED53C45A9A5C85F70B07265AEC3C0E32BDA8C007E11F71F4BE951239D2895587EFB2C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849815, "uuid": "d00200b8-df61-46ce-9c00-6eb07114a219", "value": "768:NReeJFdqYvwS8GeI5TQy4+hIPQe2laB8QngKZPtCROc6fM6bbFOnq:N0eJpvYG39Q2IX2ldKfVtCIp8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849815, "uuid": "3bee5edc-5806-4dbb-957d-270bfd082fe4", "value": 64702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849815, "uuid": "18b24b17-36ba-4260-ab9e-8b7d878d4c89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849815, "uuid": "41c64215-6760-4e90-aaa0-593eef6a54d1", "value": "Remittance VPO - 4500003275.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2139c17-ffd2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1741846613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846613, "uuid": "1e6b575b-1626-40a1-9384-b7bca0589ce1", "comment": "Malware payload (Hajime)", "value": "34ce43ccc6048564d40719f9698c1077", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846613, "uuid": "4e7778f1-da38-4c56-97aa-9a1d7b0be8ad", "comment": "Malware payload (Hajime)", "value": "23615e25d2ca5bd07304808b7fbb344f383bef4824f0487956affd572a0d460d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846613, "uuid": "5281a157-0437-4a6e-80c9-8c7b6580c4ce", "comment": "Malware payload (Hajime)", "value": "f370619c43ed541804bfd569bb2117cc1396a672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846613, "uuid": "7117622a-600b-42c2-913f-3d97f090aff9", "comment": "Malware payload (Hajime)", "value": "43154efb3d69b9261155a29217acf7993f124a2046e8101b64cb05e2af2ee68202eb24e031f9a65f8ed8a01bf7bd74da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846613, "uuid": "db9e529a-f1d5-454d-9dce-d54fa611e9ad", "value": "T19753020233AA29B196714AF1E7FDBB48E6493D588FF26C256C123D6CF97235D1CC4908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846613, "uuid": "f96a7edb-f410-40ca-be01-535972d02a91", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8Pxu:yYI0ARqw1qAEv7UIFM8oJorFquyjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741846613, "uuid": "22c3b3a9-8b85-46c4-b585-49a0e838d5f5", "value": 65184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741846613, "uuid": "63887a8d-abb2-49b4-bfe4-ec950328b22e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846613, "uuid": "d91e87b8-3603-4b14-a4ae-07d18f28f944", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec67574c-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883191, "uuid": "81ecb94a-6391-41ea-8e96-894d3db07de5", "comment": "Malware payload", "value": "fa5de35e4fe56cc28f278c5851d948ef", "object_relation": "md5", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883191, "uuid": "9c4d6bdb-d579-4742-91e0-2f36869a930d", "comment": "Malware payload", "value": "23ac6f34aff45a4ca9049d5574c80f0a8c87d63e515703b5e8f0b7efa1465fae", "object_relation": "sha256", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883191, "uuid": "d3a88e00-080a-475e-bb8d-c63a9900011a", "comment": "Malware payload", "value": "0b97d87a4a82b00d924ce235772711eee5b652f1", "object_relation": "sha1", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883191, "uuid": "54d448b7-c4b0-465c-9450-e5f46d51a11f", "comment": "Malware payload", "value": "e3c2b5a0486042d71a50ad9cb8d5a4542fda78046c16bb0129c371a1c717fc99700c3cbc56aa61eb68479570ae818127", "object_relation": "sha3-384", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883191, "uuid": "0e71c7e9-50e1-4e55-bb2b-523dc9a92991", "value": "T19E312D586A960712E6728B3998BEE722C53F3C42DDB65F1D018D464C2727114B4E5F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883191, "uuid": "aa6ad6a7-79f1-41ea-85e8-f54e5e6e4fd5", "value": "12:8M0m/3BVSXvk4+/n/6s/UrW+Uc+NsB9WIWXW1YpyPlKd9O7DiN37+lbYx:8S/BF//Z/UK+/+GbWbmC4Prarab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883191, "uuid": "948ffae4-2bbb-403f-bbb4-a69a18a34a0c", "value": 1498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883191, "uuid": "e5ef4d0b-952f-471f-a0f4-19aca8530ca2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883191, "uuid": "44b3769d-4361-4170-bcb8-4c45e462a5d4", "value": "file.lnk.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c31fc7-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883534, "uuid": "19779c98-da61-4859-bca5-513620c96206", "comment": "Malware payload", "value": "38235c37aebd29802fd991dde7fb977d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883534, "uuid": "e409e02c-743d-4eef-b028-4b108af1f89e", "comment": "Malware payload", "value": "23c52aeabe2f7e1526efd4feab32a58f41a1ab38fa1c3e1ff452ead95fdb65ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883534, "uuid": "ccd0e9a7-c359-43cf-9c49-4956c9996518", "comment": "Malware payload", "value": "91b1fed1fa16ef1c31da7bf33e63dd77524cd2eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883534, "uuid": "639aec41-8c5b-472a-bc8d-0c3216c4b4bd", "comment": "Malware payload", "value": "d8e0a8309f47bcc127d52f5a1f2c2f3376e5d9dcc46eb90e4440e72a9de8a37189a0580f059a10a1908160e36c1799a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883534, "uuid": "7534d5c3-56a3-483a-86d4-49f50c9c0bed", "value": "T163A5D013F2CBE03EE06D1B3B05B2A25494FB6A616422AD5796ECB4ECCF351601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883534, "uuid": "317e1c65-2700-49f7-8f5e-6efd9404a439", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883534, "uuid": "156a80f2-c531-4555-bf0c-2988ab039c28", "value": "49152:OwREDDMBIvdK27Dl3ftiaOXziJD+QzMm1RBoBVtYHqgv:OwREwIY2fl3FMi9+Q4m1PQKqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883534, "uuid": "828f5ba5-39d9-47bc-8a27-f4506970f5af", "value": 2241944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883534, "uuid": "c3a16635-4cf5-482c-80f9-7c19425cb914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883534, "uuid": "dc37195a-ef06-45ea-ac4e-84682760495f", "value": "cfwbtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103bf733-0029-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883681, "uuid": "6e9a9591-c5ea-4ce7-b710-aa0376ed528c", "comment": "Malware payload", "value": "9685056a7cd891697d0dc3ee567ce146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883681, "uuid": "6b2aa2a1-780f-40ef-af1e-2861cfa302ce", "comment": "Malware payload", "value": "23e30602e6b2ec8901583ac2b363059cd08c4edd74754254055878ed5c3dc504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883681, "uuid": "bf180a55-7104-4742-96c0-baef621148cb", "comment": "Malware payload", "value": "24e74f3c6ea4810e0845f4a9ed072cd60dab75ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883681, "uuid": "f6e550ca-7dc8-46ec-856e-85f43c0d4b28", "comment": "Malware payload", "value": "486b0e2adb9d7bd05f89d88049e8aedf139f7eb69513f3f26f7f70bb9bc2a07a0d34fea40bd0654a47850c4ba457dd25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883681, "uuid": "94d70e53-27d4-43a8-81c0-7ffbb6305c81", "value": "T13FA5D013F2CBE43EE05D0B3B05B2A15494FBAA616422BE5796ECB4ACCF351601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883681, "uuid": "1000042c-105d-419f-8b66-d15b59990b7c", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883681, "uuid": "fac5852f-dc04-420a-85a9-c4841d899a56", "value": "49152:JwREDDMBQJ+YvSJY3ftiaOXziJD+QzMm1RBoBVtYHqge:JwREX+YvMY3FMi9+Q4m1PQKqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883681, "uuid": "90f0f909-6783-499d-b8c1-9d622a57a217", "value": 2241632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883681, "uuid": "f200767b-5699-4876-88e8-3ed30f01366b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883681, "uuid": "1f3726ed-8f5b-403a-bcaf-476596fc62ab", "value": "ulbtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0c2cf6-ffcb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741843306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843306, "uuid": "1b18f87a-a0a2-4412-acdc-8e4e5d80b1a2", "comment": "Malware payload (Prometei)", "value": "a8d50b424c86006014cc5e3d1b9076fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843306, "uuid": "16d5db38-0f77-43e4-ab69-c29847013589", "comment": "Malware payload (Prometei)", "value": "2451610f87bca856a42166979aa05debefc4b805a5a81fe7e2bf007a8f68dc7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843306, "uuid": "881bf1b9-1a5b-4538-b8a2-0ee852d003d7", "comment": "Malware payload (Prometei)", "value": "548baa27d8a9037d860f8c73bba47e8cdb10396d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843306, "uuid": "71220379-f0f6-4026-90a5-d6e2952f34c8", "comment": "Malware payload (Prometei)", "value": "0cdf121c385206f49d898e346fe1318535a9e13d0cd0068a496e1a61641b108a46ba60b3c942b864287f61947c99e077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741843306, "uuid": "9bf0f06d-a06d-4765-9eac-e7f85bf7142b", "value": "T11D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741843306, "uuid": "56c42472-a365-4347-bc30-06a9229c9298", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplq:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741843306, "uuid": "7bf303ce-df34-4b70-8f2e-47d474882bb1", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741843306, "uuid": "7a6ed14c-a53c-4bd6-92ee-5d4f78f78f01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741843306, "uuid": "73b4e483-b591-4e11-b8ee-15e574a12809", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f041312a-0031-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741887493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887493, "uuid": "e8a3bfdc-d6f0-4223-87cc-260edfb37248", "comment": "Malware payload", "value": "8241ed56f4165b032d078a4b4a523493", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887493, "uuid": "2e1079c6-1c76-4192-b16a-98b8b5c2b220", "comment": "Malware payload", "value": "24da30c29b2cada602c9016c7ac43dfb0e6d41684788e1dbd19c29f1c016d474", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887493, "uuid": "f4a0f81e-aac5-41da-911b-92c960c044dc", "comment": "Malware payload", "value": "588bd9344c23650e20af9a1eaabecf0be8088395", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887493, "uuid": "1fe6db44-275b-4b35-be82-9cd7755fbf07", "comment": "Malware payload", "value": "ddf499136cfbf2502d633d09c386bf8d9b4c71f1941dc4e9120f1b8cd04775d7a2aff77814be184ba8f273e934f53f6c", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887493, "uuid": "eab3a1e7-f351-4800-b013-a06de83971e3", "value": "T118F2E4477686860BC5AB2D3C2A34C255126EBC71AF2C471763913D2E5C363CA7B2867F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887493, "uuid": "cfd0d3e5-b86a-470a-a022-19ced87bd684", "value": "1239f70ff2bf566f292cc63e10061088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887493, "uuid": "7e9bc7ad-5e1c-452f-9c39-0d8768620706", "value": "384:fMCL18khxBiRdiBvwBLhv//V01cPJL5OjzhxtzTus2NtM4WAB7yZK:F1Rxuk4BLd/W1cP9EtzcvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741887493, "uuid": "fd511cb2-0c08-474e-a406-342d3ed3962a", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741887493, "uuid": "63e1f597-f13e-46db-bc88-9fecff153c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887493, "uuid": "f700f50b-cc4a-43e5-86aa-b1df7d36e6c0", "value": "winnit6,6,6v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82de32ee-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825032, "uuid": "b0d59b16-c80f-447f-b1fe-4923d944e964", "comment": "Malware payload (Mirai)", "value": "615da907f75d90e4ef9e028fe5cac7be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825032, "uuid": "74b7c1db-4b85-40a7-8230-b13072334ca8", "comment": "Malware payload (Mirai)", "value": "24ec0b8bf39d1dabc3f3fd0621c9c3cfbac3a227da962332eda9e2d896a33215", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825032, "uuid": "90c063a6-56be-4369-b1b0-299444a5732a", "comment": "Malware payload (Mirai)", "value": "00edc558a3830e5bf2664338ed64f110273ad0be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825032, "uuid": "d33c6fb1-1a2e-4483-9342-3c97a0b5cee1", "comment": "Malware payload (Mirai)", "value": "d68af0e6c20ea116acd5b21bf7d2236f7857db378c08b9d0c7c6f15a1cfbaedefe8ba0ec83894495bd707271ec22ad69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825032, "uuid": "2aebb1d8-0780-4245-a9ec-bae366eac6b5", "value": "T164238DB3C02DDD98C5490279BA285E3D9723F40087671EFB5E9A86A59007EECF50A7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825032, "uuid": "4c9b0bc0-6db0-4db7-b1bf-c7b4fff75055", "value": "768:Ma1/hnrsPxgOH59EEvk9Nh+/ZJCtsqFaYVnD1gn3CbouWWwkCvZ:Ma1/tsFZ/k9Nhr4SnAjuokCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825032, "uuid": "54862841-42bf-4b4a-833e-a69707b3e7a8", "value": 47224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825032, "uuid": "d137638a-eff4-42cb-819f-cc98e5ea23e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825032, "uuid": "31e9dbfc-14e4-4531-978d-4ffeece0e99f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221691d9-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869108, "uuid": "c1cb04bd-60b6-4f1f-a5b6-50e9a7a76006", "comment": "Malware payload (LummaStealer)", "value": "e070bcc6b4f0e004b91f73cbe27d73ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869108, "uuid": "17b1acd9-4ff7-4511-8e1c-35a73d6caed7", "comment": "Malware payload (LummaStealer)", "value": "24fb33ac2e21129c190da102e9d5d8ac9079ccb429711cc3dcbbdda44ca073ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869108, "uuid": "5d74e0df-d7d2-4cca-814c-95b635a65ca9", "comment": "Malware payload (LummaStealer)", "value": "cfc88488870730d1a9ab7076ef62aed1ef991ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869108, "uuid": "87b0d503-3423-4b3a-8521-f3c62f92a9df", "comment": "Malware payload (LummaStealer)", "value": "443a1475809aa118dce73da51e92f81ed28cbf77b0c785fa85d821ee2b8ef9f483cc81fb5d075857908dba407b78d55b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869108, "uuid": "d8700c37-7690-484b-a0b0-551958279b8a", "value": "T16155E17230C5C073FA4195B33598E275046BF672DA2E0FC7E2B4E3699148AD117AE52F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869108, "uuid": "054c8ac6-5337-41e4-a4cb-9710903651b1", "value": "d462aa757f68629e41b3df6e6d4c6a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869108, "uuid": "98a40145-bb39-45d8-a97f-132adde6ec67", "value": "24576:yAi/c6dNtEWZ4B+UsxoxbzmXsCr//aRhCr//aR:80qNtnKB+UsxoxbzYs4aRh4aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869108, "uuid": "65bf466a-b2eb-4450-81f9-3879e0c44a61", "value": 1364480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869108, "uuid": "d9888e4f-d229-45cb-9393-7fcd5c2b2c7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869108, "uuid": "b5589679-5ba5-4834-ae81-20b36ee7834f", "value": "Installer64x.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccc6cdc-0001-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741866683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866683, "uuid": "ffccd9e4-c965-48ce-a316-7378fb2de146", "comment": "Malware payload", "value": "fcd7e60cd597394cd997b402977d4fb1", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866683, "uuid": "35703b4f-27f4-447d-9dab-00470feef276", "comment": "Malware payload", "value": "2524550bd17e02303da99f54447b19682f496a2e8402d7a13fec405e3da10f00", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866683, "uuid": "776b529d-3b7e-4328-aeea-f81d0d8a1953", "comment": "Malware payload", "value": "a9186247fef7cddf5f60bceaeca84241758c51b3", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866683, "uuid": "e8f46365-48d1-4e8e-985a-e4779ecac2d8", "comment": "Malware payload", "value": "8d18bf0905474db868641050773c114774ed6e8ccfd5a974b29218ed94eb9052c95a37e0f106b4ed911b8f3084d81501", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866683, "uuid": "ecf78c65-cdd4-4e5d-8752-357527cec8d2", "value": "T1E0E3217163C17CA511075F62B72EB7FDEB1E7E6832AA088FE1057C51E7A6909D6E0830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866683, "uuid": "d25dbb13-88b9-4b93-b32a-2554b242e60c", "value": "3072:j25IBLgnhNNIlJX5B1GP45OAVcVg0sEETxOkoefYHOW/dL:j2ImnhNSll56PaVcVg0sXckoeYZ/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741866683, "uuid": "2c67aade-4865-41c6-886c-f0993a0c2133", "value": 146116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741866683, "uuid": "98ce04b8-17da-42b6-8bb3-aa730ea2362d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866683, "uuid": "1dcf80bf-aefb-4ed4-9d7d-a33fdb5c3267", "value": "PO_L202503042.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f068292-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825026, "uuid": "267ca91a-73e1-43b1-b772-8ac6b5d5922e", "comment": "Malware payload (Prometei)", "value": "3db8ef8242e24f9d28ff2e4856cced3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825026, "uuid": "da3dc6bc-93b9-4125-945c-ad60d93ce6f0", "comment": "Malware payload (Prometei)", "value": "2574ef3049a48a4a477888fdddd8c38ef2dac8ff2fe27b9ba987dac1131ac472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825026, "uuid": "1b7a5117-11bc-4101-a602-e73f682d773e", "comment": "Malware payload (Prometei)", "value": "ed2b59daad725e7d27b7ef5e067552cfd5a806f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825026, "uuid": "a98832bd-e247-4f29-ae57-f6c6cc4ae217", "comment": "Malware payload (Prometei)", "value": "536944dc4f02e78b3da1c61d386e3b38ac497d10cf577e5e8b9169c112f3828fb728fef5a4ff23d415a17ba4c8a4a221", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825026, "uuid": "9f88ae47-da23-4a14-859e-d8e18ba21ca2", "value": "T1BC9423F8C83D2E3098169B3CBB1A826CF0A15772D9562F7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825026, "uuid": "50a7dce2-d236-4233-9e6b-a89a2bf3a255", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgZ:25WOSACZSV6eKRH5EPiamb4DsDwwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825026, "uuid": "467a06c1-de8c-4935-a7ec-66a64f1f094b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825026, "uuid": "ac6122a9-6642-49f4-9ebd-8747d0f6b886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825026, "uuid": "155ea1e4-7c03-4afe-b352-dc66abd27976", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab933cb1-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (GCleaner)", "timestamp": 1741879647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879647, "uuid": "f14f6844-4b36-4b9e-afda-639d9ee690d2", "comment": "Malware payload (GCleaner)", "value": "75cc61d91046024c856975027a4a9716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879647, "uuid": "c3fbfdc8-9d5b-4372-b213-e80ada934bae", "comment": "Malware payload (GCleaner)", "value": "25fa10f08a510ffc6bb8c811e5a1625e95c70c4bec94286a265005094554859f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879647, "uuid": "5b619764-e0a4-4981-a2f5-2a73933627d8", "comment": "Malware payload (GCleaner)", "value": "4eea443d7e5d27e2801ffe2a2238c49b55786458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879647, "uuid": "c7134912-f499-4b9d-9831-15e707c5771b", "comment": "Malware payload (GCleaner)", "value": "14a7647b3fbed80a01c879d6fbfa03877cd8eff90cd56f775250aea1230e8cd7625e8fef3b4051c1b0c4e5497f7e0bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879647, "uuid": "f93eaa7a-c7f3-4325-b076-d813da4493aa", "value": "T14106330A7A77D736CE52A175FB9E41CB30256C1FA46426CD6B11E4B411E332F2A8FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879647, "uuid": "4044795e-19b9-4303-ac01-2295df7e3410", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879647, "uuid": "20456fe8-f8ca-4ddc-8f0f-0e62091dae2f", "value": "98304:F95KdPy873ue1V13ae2T+lXaIZMHYvQJRBHx2cVx2Ofr:zey873ue72T+QUMHZ3Vxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879647, "uuid": "97f5d44d-1aae-4b7d-b45f-8864a6509198", "value": 3970560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879647, "uuid": "3feb3ae5-847a-4759-9afb-fcf3bb745142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879647, "uuid": "6c21e545-2e22-44fc-a3f3-f78ec5342d11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3670e7-ffac-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830391, "uuid": "69efe37f-bef1-42ee-be68-65053316fa40", "comment": "Malware payload (Mirai)", "value": "b019dd0765b97e3dd1e1ceb5422ffa7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830391, "uuid": "d71c6238-8f38-4041-81cc-652541fb2095", "comment": "Malware payload (Mirai)", "value": "260969f76fd4055d760607458ab5cb5316f110e11aafaed0add9814ff4f43a71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830391, "uuid": "88348603-5062-4730-abe6-5834e4c6fead", "comment": "Malware payload (Mirai)", "value": "c2ae944cca630efea2703262d312a314c12174a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830391, "uuid": "01ce34f3-9c60-4206-a691-90fffa2a730f", "comment": "Malware payload (Mirai)", "value": "7518832a3743c025858c7b919d71e8799b82674ce9d86ff21865a356f82c06a805ee01ad560ae759d44dce21295f19ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830391, "uuid": "e671cbe1-142b-4835-94b5-ad9b2e78832a", "value": "T10E037CBAC4296DC4D6154274A8358A7C6F63E11093833FFB5B4985A68047EFCFA093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830391, "uuid": "12eb46ae-85dd-4574-a6d3-48e957de97d5", "value": "768:MaVfGwtowdiKfNx/eeNd8i8MNOb3rXC/oKnCCa:MaFGwtz1jGoWXP8CCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830391, "uuid": "7c53b777-5126-4ba4-83db-73c333ac7ee5", "value": 39220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830391, "uuid": "7ca13fd3-c75d-4bfb-9de4-fd376b569c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830391, "uuid": "7c9400b5-4308-44a6-ae8b-5a3926f1c4ce", "value": "NewAge3ATOsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0ee6f7-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855592, "uuid": "689b877d-6cda-4a55-8ddc-a138a0953843", "comment": "Malware payload (Meterpreter)", "value": "86037eb311086927eb75f9ddd6c867a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855592, "uuid": "f533b9d0-f0ef-4dd3-9438-695621b5c7f4", "comment": "Malware payload (Meterpreter)", "value": "266bd997249b09fb8171cbd9339e7f85963143efa3ff64e5ec9757ed00348066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855592, "uuid": "b6250c88-12c1-4049-bb81-490cf1c63046", "comment": "Malware payload (Meterpreter)", "value": "2f01c97e901225177d5cffc4cbc6e6c8f5d99f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855592, "uuid": "b9101ef7-9b46-42c3-8bae-5c959a69a443", "comment": "Malware payload (Meterpreter)", "value": "a9ae23db833e6d33cf2321ab524060dfb31ceda2c899e83f4acd98a4d664078e0b7a544f77c903368a8f7d6a48aa7870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855592, "uuid": "63910659-9beb-44c8-9284-037f6432f37d", "value": "T102E1940233A56DB4C88405BB0BA6E9BB708AD7313F07D2E68E18030FA9A102159B4885", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855592, "uuid": "f3200a10-7ead-4f43-932e-0f832f097959", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855592, "uuid": "5c220bb7-b238-46a8-8f55-7ca3e1b22dc4", "value": "24:eFGStrJ9u0/6fydnZd4BQAVKG1c/YKBFxYlrep110eOpLjxR/wJhbuqiksvcsFpg:is0fd4BQvG+QuKe0jkqqilk5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855592, "uuid": "4514530e-3c03-42a0-9591-708489cdee83", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855592, "uuid": "ddaea3e5-60b7-4c08-8548-b316adfad5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855592, "uuid": "727b2c14-6157-4a8d-b9c5-60277387868a", "value": "443_2001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d41018-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883155, "uuid": "01084731-8664-4ddf-bd1a-fab1dbec9f18", "comment": "Malware payload", "value": "fcec997931f7ed8ae4b114a72138a088", "object_relation": "md5", "Tag": [ { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883155, "uuid": "3aad783e-abc0-4d63-aa20-a3c52a7a9614", "comment": "Malware payload", "value": "26f199d390ca7d8aff6008ce490eaa357269dddb624cf04690e8fb473bcfd42a", "object_relation": "sha256", "Tag": [ { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883155, "uuid": "a84442c3-60bd-4f2a-968f-dd6f66f5301c", "comment": "Malware payload", "value": "665b232066cc8ab47e171098ba90867ad9422039", "object_relation": "sha1", "Tag": [ { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883155, "uuid": "182e9625-6094-451d-a75b-be73e5783ec5", "comment": "Malware payload", "value": "7792e3c2e998dddbe5c17e4dbf4b67ef8d794778a3453406c8e96c322ec23ccc8c8ee1b70ac1773f86faa6cd5d28844d", "object_relation": "sha3-384", "Tag": [ { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883155, "uuid": "8f9b5b16-b77a-4737-b7dc-8c28386092ae", "value": "T1C8067B20B596C036D57E01B2A92CEE6A157DBE720B7144EBB7D87E7E09B08C15332E17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883155, "uuid": "62ce6c18-c754-471c-b839-fe14c467dc1e", "value": "98304:oK3+XTQyj1s9wPoxe1Qw4QFgBOnn/8/Z:ov5SwQxeX/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883155, "uuid": "61ce38f7-6786-4a47-9931-b2cfc91a11b7", "value": 3910656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883155, "uuid": "e302958a-1761-43f0-a1f1-e3c30988fa2c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883155, "uuid": "ddf65fab-7e61-4d10-969f-113ae61f84d4", "value": "PDFizer_no_update.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720fef03-ffe8-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741855928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855928, "uuid": "e96f19c9-feb1-4f65-a6b3-ec6739c6f93d", "comment": "Malware payload", "value": "56fa5c9aef74520dea4c439ef81c0f86", "object_relation": "md5", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855928, "uuid": "0a53a59d-8739-4461-839e-5368247f743f", "comment": "Malware payload", "value": "2740f00c8d9732b8afaf2ff6b5325fdaa7d58ae0b72568c030076ce068c4d8f7", "object_relation": "sha256", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855928, "uuid": "3b397ab8-487a-45d3-9337-1f51719449d4", "comment": "Malware payload", "value": "a3e90e38ede7946be892c3a84f2f56db1f8e3fdd", "object_relation": "sha1", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855928, "uuid": "3fc864c5-b349-49be-8fe3-ef4af9b209e5", "comment": "Malware payload", "value": "7d1bd8982c1cdf146260a73ed819bfc5ff4d7266736e0c681256e1f0e2c98af6beb0558c463f65778557506e99cc2e97", "object_relation": "sha3-384", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855928, "uuid": "dd21fa47-9da7-4578-af7e-c580fdb0ea8f", "value": "T19FE3E6719CC36FF29B2A7890050CEF05AD981BEB86699007B84D71956FD54309FAE8FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855928, "uuid": "a46c75da-8545-45d9-b2e7-112d1ca6af6a", "value": "768:gpwboYO7BgTNnvUQe3OJ/CQFPjrdnxFTB6Va928Yd:GfyrlPtntw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855928, "uuid": "ac273d9f-38d6-4e60-a2ff-ffc5e8600ead", "value": 148541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855928, "uuid": "159c7914-0dc8-4f0f-ac55-fa2a69c24ed6", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855928, "uuid": "04f6e627-41ca-4184-83b9-9aade6f70161", "value": "exploit.msc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cab19e-ffeb-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741857352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857352, "uuid": "01c469e3-c1e6-419a-853d-3563c603e954", "comment": "Malware payload", "value": "af5f2547ca803311743aed9718b8434e", "object_relation": "md5", "Tag": [ { "name": "196-251-69-62", "colour": "#F402A1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857352, "uuid": "27036355-ccc4-4ca6-b673-4c94c51bbec6", "comment": "Malware payload", "value": "27998eb575368e2214e296f9d7cc21013109638ffc854dcc3257b1f1749e1669", "object_relation": "sha256", "Tag": [ { "name": "196-251-69-62", "colour": "#F402A1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857352, "uuid": "cda27b23-2330-4ebe-b409-e0891d773897", "comment": "Malware payload", "value": "d17b0fe62ed98276f687eeb0d4bd4a77323f1d4b", "object_relation": "sha1", "Tag": [ { "name": "196-251-69-62", "colour": "#F402A1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857352, "uuid": "78f444e8-d36e-43ff-b567-b737143265ee", "comment": "Malware payload", "value": "ce5534ee9ebd8d8158e9e47a6650b1cf3f227b6d8793d46e3d925bba15fa188813ef46caddb441b96b953a3a0386488f", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-69-62", "colour": "#F402A1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857352, "uuid": "d3ae3365-3c67-44a7-87bc-6b358be1704c", "value": "T1E95623909B8E5F6D4A07837FE4FD7B7E1B854FD34424ACEB82A011851BCBA198277D90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857352, "uuid": "a46133d8-bd12-4591-bdb3-91fc1ec798f6", "value": "49152:b3Ldw/A8R5u/EIYSA5XjwxAZPkfTwg5efNY7gUiWx/4KQVuW5doJkg:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741857352, "uuid": "c4075ca7-6094-4cd7-8dfa-f909944b92c3", "value": 6260390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741857352, "uuid": "26ade679-fd47-4088-a64f-e560bed9609e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857352, "uuid": "893d91c9-773c-4466-9e67-a5ad0bc85505", "value": "27998eb575368e2214e296f9d7cc21013109638ffc854dcc3257b1f1749e1669.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b827336d-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860340, "uuid": "7a1ea470-e368-4c29-9b2d-986bbfdb1879", "comment": "Malware payload", "value": "d13c6bf0d56449fd952a8e26bb040fae", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860340, "uuid": "e9141d04-7a15-4d3e-9346-731da40d6417", "comment": "Malware payload", "value": "27af6b46ac4297ad0921f014d756acb7cdecfd01cc00c746d04ac8855ebe5a99", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860340, "uuid": "3cf64f4f-ef7d-4ac3-8998-4fe3ece09e9c", "comment": "Malware payload", "value": "ceff34eda87c7d4b9bc002fa600f025d003963b1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860340, "uuid": "403d5c1b-1813-4093-9e6b-7d7463bd5318", "comment": "Malware payload", "value": "beb53d5c3d29a49b61ea147f2e8eecf53721b4c5a794ed3ec1715788d0657db26c2bd304723c07040bca4d506f4f3de3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860340, "uuid": "4265367c-64f9-4b78-ad08-8c92fe3453da", "value": "T12651ED0267FD1770F3F25A71197AB6209E37BC52AE51D66E6090828D08A2E14DE28F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860340, "uuid": "a2dcbd7d-5c56-4b3d-aef5-71e4cf6ae6d8", "value": "48:8/0mGX0GEyKaAVkPOTOte7dLXuHz7Jk7gF2JqsQ+z0YW+:8/0jdPKa1POTOExuTWsFCqsQ40b+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860340, "uuid": "587493a1-fdd9-4170-bb85-d12c6dc98e5f", "value": 3129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860340, "uuid": "4e57653d-bca1-4fdc-a221-1cc5c1632773", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860340, "uuid": "f8e2d19d-6db5-463c-99f4-811e9c303a38", "value": "DE-10192.pdf.lnk.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec73d0ee-000c-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741871595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871595, "uuid": "2e83ffa7-2278-43e1-8e85-6e698f4210a5", "comment": "Malware payload", "value": "8b1c19d5beef17574c431e6f4e618db8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871595, "uuid": "3bcb55b3-9fc3-46f0-88aa-43407ebb1402", "comment": "Malware payload", "value": "2a2e307db35445c4a21d1f0e8ca9d6cca363cafa21b418341ffd702139be88f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871595, "uuid": "69803e83-d752-4390-96cb-fb857807c425", "comment": "Malware payload", "value": "909f13550c506ba1b7d8cd7405d345a648933342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871595, "uuid": "5dbb9065-b5df-4107-9504-ed5730062ab3", "comment": "Malware payload", "value": "6558449ee8a6b10272812a574e191c502e85b9a09b2e86d5cb77b12c4ba70da10082d212c7ca3adc35c5abe295a1dabb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871595, "uuid": "18763a6d-656e-41b9-bdfb-7c071f7014ef", "value": "T19D4612BA6158335CC01A84389833FD5872B6562E4AEA95FEF0EF76D0379E421D681F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871595, "uuid": "6f217418-cb4e-4ce5-90d8-9e13419e5d03", "value": "0ebbec4c01f9c5dc0bdcf56621ea72d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871595, "uuid": "58c7971d-08cb-41d0-bbf2-de0675292801", "value": "98304:l2x8j4+6uF5TK2J9Sz/bQ7zQEG2U85usODSon9j1vyGjELneVfbJfDHT:l2x8j5FBlQ7koh2jOGE9xvyGALGbJbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741871595, "uuid": "d3b4a829-72a1-47e2-9db5-afa4d194277a", "value": 5769216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741871595, "uuid": "97d386c5-f09e-4dfc-b366-879862c4f617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871595, "uuid": "f5533771-9bb2-443a-98de-604278cc325b", "value": "SecuriteInfo.com.Win64.Malware-gen.16534.10179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237eeb19-ffda-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741849783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849783, "uuid": "bf8aea4b-e07d-4f45-b9c8-ea4a4a098f95", "comment": "Malware payload (Formbook)", "value": "2a05dbe2a4ff7174cf52e51b3b9855ca", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849783, "uuid": "efd05155-50cf-4837-a0ab-8337612a1bf3", "comment": "Malware payload (Formbook)", "value": "2b7f57676e5ca57765272dba44c4ebad3b4b0cc9db7904d6009aa78e2ff08adc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849783, "uuid": "3a910c75-6178-47cd-95dc-8d818f39cd9b", "comment": "Malware payload (Formbook)", "value": "d1ffc456add1b0616576e409dd6361e83f5031aa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849783, "uuid": "15904a0d-c7e2-4430-bc95-b4a09ab086d1", "comment": "Malware payload (Formbook)", "value": "9c07f5b98a8aa9a19339e31b57b0bbc94d8870ad814ec1b29b3e075838d8098ad5b281a8f87a4bb2c95ad68270ca0a6b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849783, "uuid": "cc148cd8-581c-4220-bb04-ca75672fda21", "value": "T1349533146E671C9CFFB3DDBE758B988005018431C85A65F2BD2BD8392286F783A647E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849783, "uuid": "e90d77be-eb4f-47a8-888a-0da385e92373", "value": "49152:L7/W6sPlUcMiDoKScsXX3LgDFLeTFS6Y7VjRLpex:LToPOriDoeAsJ6c649mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849783, "uuid": "589dd944-a90a-4d98-bb64-36f9a52e2442", "value": 2024906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849783, "uuid": "7c649bb5-9d68-4125-8d84-232480217eac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849783, "uuid": "64051bf8-e4bf-4e49-9f5d-859abd387117", "value": "RFQ-JC25-595837.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299aa965-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741872986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872986, "uuid": "f49ec8af-b072-4429-84d3-d4f738dc11f0", "comment": "Malware payload (XWorm)", "value": "a03f437613e3e211f67eb617abafa8c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872986, "uuid": "3874a94e-baea-471a-b13f-c266e6eb9118", "comment": "Malware payload (XWorm)", "value": "2bc4914c90a2d1c4115a50a1dc1c21f5401532ffc8e40225af6ab9179adb1215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872986, "uuid": "87a149ce-93c0-4cd5-8057-da026e190f88", "comment": "Malware payload (XWorm)", "value": "518f6cd5ba3788f84f8a55c1ff1c792816bbac54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872986, "uuid": "858eee25-2e9d-4d73-9a9a-f556caca6ff9", "comment": "Malware payload (XWorm)", "value": "65891912abd26626c9a58017b5264c6f7008aaa20bb9091916e1fa9b2bf8edc60e6341bc6346aa55916b60256c55c488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872986, "uuid": "dc3f1703-a536-49de-bc98-296552aea147", "value": "T1CD046247A2280C21DBB4EE3591DCD8BB495F6E3AF5A2424D7CF5FC5824F68F1092AD06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872986, "uuid": "ae9c5309-fa47-477c-a4a5-1711438e9101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872986, "uuid": "db9d2ed9-b3c1-4ae2-9cf7-17d35c2a930f", "value": "3072:mdJKY0k5fbefpyNOL27qlXod2a3v7EsUT8rmtIhp:iK7QfbWgga+odF/HUTftO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872986, "uuid": "b393f2d6-9cb0-457c-81fc-9c639b9d7f4f", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872986, "uuid": "a40a39e6-9540-41e8-b064-a0448361ecf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872986, "uuid": "a1084e67-f0a8-48be-bb13-1d21a3179bdc", "value": "Skype.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd4b540-ffac-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830392, "uuid": "14f1cfdf-cee3-4536-ae18-661c027d6773", "comment": "Malware payload (Mirai)", "value": "7795fcf085cbf6789cfdec7633b0a670", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830392, "uuid": "bcf17c2c-39c0-4984-a4c6-591e4c1095ad", "comment": "Malware payload (Mirai)", "value": "2bdc83cf3dddb99e20e1b5a1815c9ebff7d4c37e8191649cccff48161c2e4b11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830392, "uuid": "f987cb8d-fbfa-4b3a-81e4-25ad7f084b90", "comment": "Malware payload (Mirai)", "value": "c809ac6dac6f1bed4708bcfe9ad22cd6c57dd3fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830392, "uuid": "4b943a6a-2a93-442f-86bb-9f497f524941", "comment": "Malware payload (Mirai)", "value": "d97efce37b37d1cf067133d2ba65f0fae95399d97d3b1ff5320082b5140405406027908c46eef39580f9cae328986dea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830392, "uuid": "67486937-db76-4d8c-a830-60dd4c4ca6d3", "value": "T167131B42322C0E5BC6A65AB0293F17E093BFE9A020F4F585655F9B868275F761087F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830392, "uuid": "94a36a24-4b59-4624-adfe-6d2063a4260a", "value": "768:s2+mLyDPtK4waS1U54GHGmRwb55avsLpNAI58RbhooAEdj:dnyrt7waS1U54QFklFWPAgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830392, "uuid": "29e3f68e-8144-4107-915f-8431b7bfe1c1", "value": 41892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830392, "uuid": "ba3ef983-abc0-4f74-8e80-7f9d3c6167b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830392, "uuid": "ef143a1b-1157-410e-81ce-168f37887e3c", "value": "NewAge3ATOppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66018d56-0001-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1741866645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866645, "uuid": "aa47e06c-173c-445e-baff-7c9812086c78", "comment": "Malware payload (GuLoader)", "value": "c35bc78a9b31928d09ebb17c314e59d0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866645, "uuid": "8150e2c5-84fc-442d-b09a-d0747a1dd056", "comment": "Malware payload (GuLoader)", "value": "2be07ddc19c8c8fa0b882e6e878f1c9ca58fad188dd7778696a4e1b8171277e7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866645, "uuid": "abbd006f-7f19-4003-8e87-1735d4f1f7b6", "comment": "Malware payload (GuLoader)", "value": "b6d70627e673aec403b8dfce2fa1972ff0dfe17f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866645, "uuid": "af897007-82b3-4398-828a-dd6108bbb4b6", "comment": "Malware payload (GuLoader)", "value": "f486e8a69c80b3608adc8f9ec12476d81169117e8fcb6362e41a91f025f99d5fd7bfb89ae1dea658fb1949fef00e23cf", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866645, "uuid": "c2426b32-591e-4964-b8c0-4664643bae0b", "value": "T1C6D423F2759EE674707A343F58E349B893E74435B06A9153EC07CBED887072162AE239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866645, "uuid": "ad980d7c-8787-43c8-b994-6592ce7dc19a", "value": "12288:MBIV6xRk2u/i29naF+PAcn4dPlQpDZV6r3tvM0JkHctei5:gIV6xRk2qdnS+0dtY1Vi3CEWcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741866645, "uuid": "19c76cc1-ac06-477b-bcee-783a8b7554a1", "value": 652869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741866645, "uuid": "2544a258-b525-47a0-815b-d85efad32e19", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866645, "uuid": "eb9848ad-06a9-4ded-8938-7f13eadba167", "value": "PO-USH3gS.pdf_10.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00e78db-0001-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741866742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866742, "uuid": "b9a5a8e9-403e-4bbb-9c58-26e21a329486", "comment": "Malware payload (LummaStealer)", "value": "aa18cf91459419a595a00b20299c5a34", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866742, "uuid": "e2e8fbe0-e1a6-4057-95d6-694cb0c5f111", "comment": "Malware payload (LummaStealer)", "value": "2c2d737487a4d2a1520f0d1310d002e078152acc9c31c80f4a8d37737d2d5a59", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866742, "uuid": "9d0add6d-5f3d-4f5d-a3f6-f52e08d71a9b", "comment": "Malware payload (LummaStealer)", "value": "ec6647f2141d90e22ffb0beeaaa822f81c46a909", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866742, "uuid": "8ddbec1e-fd15-4eb5-86e7-df7b7712404e", "comment": "Malware payload (LummaStealer)", "value": "10469e57199d81b1c43d5a91a67311c66daf4fd9a76054faa9792bef68a97c08da234fe50aa8054db58ece0672cd5f5b", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866742, "uuid": "6ee6c7a0-73ad-4342-ace2-b7306194c1ca", "value": "T107B6ADDB639C07EDA7984DDE420A355B61E2C1773C7F1288A9E24507B43FE12BA25B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866742, "uuid": "9da1a70f-1cd8-4e53-97fc-e19c033fda46", "value": "24576:UtQt6tmtKtJtRt/tct1xt1pt1at1ht1ht1At1It1zt1Bt1Pt1Bt10t1Tt1ht10tM:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741866742, "uuid": "1cf4f616-49ec-4b78-9657-438b9004635d", "value": 11096941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741866742, "uuid": "7e0999a7-bb23-45c9-9eaf-4339e0ce15e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866742, "uuid": "e1d2d4dd-c5fe-4bd2-a2b0-3823cb1f4173", "value": "script5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3045673e-0063-11f0-ad17-42010a9c0004", "comment": "Malware payload (Adware.DownloadMR)", "timestamp": 1741908646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908646, "uuid": "08441e3f-f9ea-48cf-be5b-41635760878e", "comment": "Malware payload (Adware.DownloadMR)", "value": "98f6a1f71a5854c648f6fc407327fc99", "object_relation": "md5", "Tag": [ { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamethief", "colour": "#3B14C8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908646, "uuid": "8ccb48aa-27eb-4e55-ae52-120fb23ba6ed", "comment": "Malware payload (Adware.DownloadMR)", "value": "2c9cfb3fda9ca9277d25d4ab96647cf6b5455423aa6576fd4775cf11c6db26d3", "object_relation": "sha256", "Tag": [ { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamethief", "colour": "#3B14C8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908646, "uuid": "4af0b1db-66bb-4d60-872e-2cd65f696030", "comment": "Malware payload (Adware.DownloadMR)", "value": "0d710b9a35aa5f700b32e742dbf2452cf9c4c4ea", "object_relation": "sha1", "Tag": [ { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamethief", "colour": "#3B14C8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908646, "uuid": "5585c4ec-eb1f-4c76-9a82-44bdac4eabef", "comment": "Malware payload (Adware.DownloadMR)", "value": "950f948f8ca7b9be398ff84f2ff484afa143cfaade2cc53846ce26f5239394a1579d928a20eeaf85c5681c428f6c1e7b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamethief", "colour": "#3B14C8", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908646, "uuid": "21b3b572-6434-43e6-bc0b-423b2febaf12", "value": "T151C3D8C0B28AA4BEDF674D3035FA9D68DE193D6C9861564B2C83721EE6F731304F8529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908646, "uuid": "cc9662d5-7e57-4cd9-9047-94d72ee17594", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908646, "uuid": "af60232a-ce65-48b8-8a8a-5515321d40f9", "value": "768:y3Q6rV6rM3/xSbUuOtMq2gdB8gVSQWMalM3kBIcGTLrs+5CbX2/6Xk5:yJ3cb3bq2gn8QSnMalMKGXsyJ//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741908646, "uuid": "037e426c-3e39-44cf-89e8-4a14ed271266", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741908646, "uuid": "79428af3-85eb-4e1c-9d32-c3214f6d9aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908646, "uuid": "565db5ff-89b2-4d24-8fe4-b8792c9b2c18", "value": "Synapse X (Cracked By Henri) (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee787f3-ffe9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741856513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856513, "uuid": "ca46f2bc-f208-428b-9a86-7f44d2a68550", "comment": "Malware payload (Prometei)", "value": "9941a058661ac3bdf59ed7020298f707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856513, "uuid": "dd42d906-4276-4a34-978a-4dbde18ef3f6", "comment": "Malware payload (Prometei)", "value": "2cb1b70931e8bac2066f8a68aabf804b4d1b6dcc57cf3184c272304123c17474", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856513, "uuid": "7a57d18f-04a0-4bbb-8b63-587646423c7e", "comment": "Malware payload (Prometei)", "value": "0e20e3b143eb71af158be31e0a37bf4502784bed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856513, "uuid": "986b56bc-8720-4636-9cb1-e607d6a3b651", "comment": "Malware payload (Prometei)", "value": "dba61578704e80947fb73e7f7193c5669f77276be1b263eef135770a62acb247b4a85aed48184f711474bd6c37b1e721", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856513, "uuid": "2d4a59a1-741f-4d9d-8b27-53a06a6d442b", "value": "T162155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856513, "uuid": "dc49a676-c35a-4571-9936-27b60fb611d0", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplL:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856513, "uuid": "e597ccf4-803e-4ea1-bf8f-74b64081ac1c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856513, "uuid": "378d4e0b-7860-410c-a9b3-6424a05a9db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856513, "uuid": "fcb04730-ca44-4330-8b1a-3415bd72c7c7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f52ecd-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825029, "uuid": "e4718b50-f7a0-475d-83b1-ed2b4714ab9c", "comment": "Malware payload (Mirai)", "value": "b8365ee6c5690b0d70f22760373f2f43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825029, "uuid": "f8b98868-93b9-4c3d-a221-0ae94c06cc30", "comment": "Malware payload (Mirai)", "value": "2df2da855b0ccf66eadbeb83bfed32b55c489401480cca825ee13c2a4915a4d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825029, "uuid": "c73fabcb-10df-4022-b5af-f791ac5426ce", "comment": "Malware payload (Mirai)", "value": "b6cdf0cdddb099b3c716bff3e22fae844468cbe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825029, "uuid": "7caaadf9-2368-49af-86bc-26562138de1c", "comment": "Malware payload (Mirai)", "value": "355af0d84c0a9f30b0ebfee810492faa39526859fa92d188106f92136c0895a3afe92257e2434533d4f42a98ab7308d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825029, "uuid": "fa92186c-f74e-4977-92b0-151062b40b3c", "value": "T15E133986BC92996AC6D01776BA2F108E3321B3E9D1CF3217CD245F0177C9A2F4D27A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825029, "uuid": "9bcb6431-5c1d-48aa-98fe-23158fffbc61", "value": "768:vPE7gmGGg93AVu/L+dZ03bytpmair8tX3cw8ySMr/vqoNCX5xBNA9:UsmGT9QViaZsbytpmattncwLSQnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825029, "uuid": "7dce66c0-76b2-4829-8715-9195c02f1faf", "value": 44140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825029, "uuid": "848a6254-9fcc-4d2c-a96e-0da6949439f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825029, "uuid": "adac64d4-cf5e-4c86-bc42-c30f7c36940d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b71f91-0035-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741889086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889086, "uuid": "6ef839af-ff21-4465-8815-09df90ec4df0", "comment": "Malware payload", "value": "ce4794434f374ee35a755f733f301c0a", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889086, "uuid": "ad5cdfd5-538c-4a7a-bc2f-89af78bbc862", "comment": "Malware payload", "value": "2e142d29e264689ddd3721b47c9f5e290a6140981260e8abf0b28a813dde14ca", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889086, "uuid": "14efe2a9-2577-4c59-871e-a15583538c6c", "comment": "Malware payload", "value": "d5083f687939cee8a4f0ddaf24f2ec036230b82d", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889086, "uuid": "2af069e0-acaf-45dc-a727-44e44cdc590a", "comment": "Malware payload", "value": "3aa848c00fe24f72aabe2e69778062037d82779b3ff03abb91bda7f4c3e6fa64d47a845bb357836259643c8431c6cbfa", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889086, "uuid": "3dc2c34c-8a7f-4deb-938d-7210bd9cfc70", "value": "T101C3118DBF86503AF54A3436F65392F28F1F9D093B0C0ADBBD926907D11E866684E11B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889086, "uuid": "39f43f7f-f7f5-4cc6-b561-6db17f399a62", "value": "58469d376b9b85ccb7b632f00639f5bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889086, "uuid": "b4c8b380-d8df-45c2-ab80-9aaa46860324", "value": "384:QjgH3YOu3wTbhiU+bgPw9LnoPQbMBjCLvRh7bvFpg5AHlJAfNiRXXXXXXHXXXXXu:QjgH3mMAtMI9LnoW9pUaG8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741889086, "uuid": "0850ef7a-381e-4872-a071-ae08b0e50ddf", "value": 121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741889086, "uuid": "8b0443d2-35ea-4257-85a9-4e9d27fd003c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889086, "uuid": "92400384-39b7-49ba-ac9f-20d6b96d7ba0", "value": "olympicene.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656c1d39-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741824983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824983, "uuid": "1999dc58-c8c2-4956-88b6-e06892b2a8ac", "comment": "Malware payload", "value": "3eb8506b3b55fd64949237f32b641939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824983, "uuid": "fecd0124-8c7c-4a4a-8555-2c124cecfe6b", "comment": "Malware payload", "value": "2e2df88fa56a7e9aeb83468330a5efd8ad467ab9896c76bba20998472afbccd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824983, "uuid": "e5f6a064-19de-4627-bb07-6724b7b6392b", "comment": "Malware payload", "value": "ed7c4e7a86cd248c1d2c563ff8a2a52a25068151", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824983, "uuid": "714dfa54-d8e5-4600-895b-52fb3105c899", "comment": "Malware payload", "value": "4077ff7cbb3dc91531367cfc2bca24db85bccdded2b1282acffb87d3bae7d3ec925366bb696dc7e6cd62844d46333e17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824983, "uuid": "507d6bcb-eb73-4b78-998d-777bb8fe2c49", "value": "T19BD3136F45AAECE3C9385B7603C598913A8518378F1D4F467DB4E9312F94E23833E64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824983, "uuid": "aec4d9b0-4ac7-48e1-897d-3c134140c2af", "value": "3072:ZhGZuPvqjVxcMQ1T+7dioPaxMCxfaCkOPdf3q4DK2sgWaUkWhWc0:PQeswmwxMCxiCkOQ4DF1O/J0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824983, "uuid": "d36b898e-f6be-4c73-95b6-9bcdcaada6cd", "value": 142827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824983, "uuid": "3618f337-5c4d-4817-9ef1-bd43f817033b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824983, "uuid": "f6650124-4da6-492f-87c4-c03d8f4609bb", "value": "miner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bca3d97-0003-11f0-ad17-42010a9c0004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1741867594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867594, "uuid": "a46b22fe-78aa-428c-b58a-0cf6e91e922b", "comment": "Malware payload (VIPKeylogger)", "value": "226b9b93d3a16ddee2722fc32384d5ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867594, "uuid": "171a6123-b2cf-4688-ae4f-c388895ef53f", "comment": "Malware payload (VIPKeylogger)", "value": "2e2f0dd7f4cff14d7889290ab1dea80e5fd3226b5eae0523c526d74396023866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867594, "uuid": "f5c635ac-b88f-41ae-b1bc-b1d445db1674", "comment": "Malware payload (VIPKeylogger)", "value": "59ee84345f971fb8fc3c09bf2905787e28e1bf97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867594, "uuid": "965a0841-265f-4001-96c6-e3f394c2fc0e", "comment": "Malware payload (VIPKeylogger)", "value": "c63338ecc13edfc317e6d99a5e2954d34684d0822168f3c7a9d0cb1d7e85db6619d88ac216b0f41a5b4f582524dd46e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867594, "uuid": "8e61b814-62a5-4485-8692-e39004efb7a8", "value": "T1EE250185F654DB60EA1847FC0E68D5B687A12EF8A531C3422EDDBCCBB6C1B235618743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867594, "uuid": "ace5cca2-30d3-453f-a88a-02abeae0cb3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867594, "uuid": "5361f9dc-66b6-4554-9b7c-890dccdc67c1", "value": "24576:TnOe4MOiXBVlVlVVVZfM3AzRRauyxyh4JEY8TQeVlV:iMpRPPPM3xuy40eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741867594, "uuid": "0de4d363-715d-4d77-a608-49b361a9e3e5", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741867594, "uuid": "fdb417e3-dab5-4e66-bfee-6bca00795309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867594, "uuid": "3c0022a6-83b1-44d9-9150-5b40dc528c9b", "value": "2025 5595 TEKL\u0130F \u0130STE\u011e\u0130 - T\u00dcB\u0130TAK SAGE RFQ_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8d9496-ffda-11ef-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741849877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849877, "uuid": "4d10af98-56c2-44e2-b3a5-a03b7ad2ef56", "comment": "Malware payload (AsyncRAT)", "value": "bedf9f8d070a5d3488689018a7156958", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849877, "uuid": "2a949206-a46d-46e8-9dac-2258bfb90d00", "comment": "Malware payload (AsyncRAT)", "value": "2e5f27c97a9f4ca39ec96b4e636b7d84863e87f4e73885207c2183272f8f921a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849877, "uuid": "212f3f01-ac64-4260-b57c-bafa0c5970cc", "comment": "Malware payload (AsyncRAT)", "value": "e0e06e27b7343cdb1a75aacb4c539bc311530820", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849877, "uuid": "eb84612e-c8d0-470c-a056-f46c4cfb90d3", "comment": "Malware payload (AsyncRAT)", "value": "a6bf3af46d13473249de7edb3bf4d626cb61a2ef85ba0de50c12a0d37a6f17858f43177d2057def8c36265969dcf74b2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849877, "uuid": "9d749881-a0ea-412e-9556-b4dd2fc0b0b8", "value": "T1A6C0C009504CD2353654EB24DE2E0C92F38A2EC1402437819733AE244270485EE28006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849877, "uuid": "d66bdd0f-1621-4cff-9fd3-19f20a4a783a", "value": "3:mKDDGKSSJJFI9IrFhkUvPkAY/KOLISBb55uVi3LlLXXdsITmsBnXJXWXLF6B:hSG8qXk0O/K8IC15uVi7lrGITHnXJmXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849877, "uuid": "09c68d3c-80fb-4610-b218-081362e257ef", "value": 171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849877, "uuid": "bb0385cb-264d-4ddb-af40-27e22c52f9ed", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849877, "uuid": "3b90b2c9-1948-47ca-af7d-3db81c573575", "value": "bedf9f8d070a5d3488689018a7156958.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8479998-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864179, "uuid": "33a2ab16-6be0-4d77-b5cb-baa2721594d9", "comment": "Malware payload (Mirai)", "value": "988768cda0bda2f23875f27983c945b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864179, "uuid": "b2056513-207c-4de6-9a44-d61b963ec61d", "comment": "Malware payload (Mirai)", "value": "2e7cbd53f5eb3cea79d853c0d497c0c025e6a60d2a0e5cf39401ebb3ae6af873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864179, "uuid": "c76b7d73-72e3-4a99-85d2-363a57bf658b", "comment": "Malware payload (Mirai)", "value": "a681eae326a0eb4bc6c8af0c68429c8d2c9c233d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864179, "uuid": "962eba55-d3e7-4e4e-93dd-3741488b312c", "comment": "Malware payload (Mirai)", "value": "85c0e2e0ad555416d25572d2eee9877e7ae0d592480bc3af5574f29e283813228b2cc143337a8f8797e5a14eee568484", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864179, "uuid": "386008fb-5f17-4f6d-9553-69cc121f0d16", "value": "T13423011BC188A5D1862808BBED31DBD90369647A83AD743C462431D25DBDB2B3AF0DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864179, "uuid": "fc185c33-07aa-49be-85e0-88469ae8b192", "value": "1536:upaazivG/0oNJvv6RvAFd3+vCFgmUM/NFR6Wz+:uYazivxoSpGdOcJLtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864179, "uuid": "151c667f-66ab-4f98-b05c-2356396852b0", "value": 49832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864179, "uuid": "62280da1-8af9-4d08-8e19-5db91606d95b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864179, "uuid": "fe37adef-ce25-48f8-9a81-08b04f1f3d3f", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6691e30-ffde-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741851721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851721, "uuid": "5085d6c9-f6fc-4a29-9ab9-98b01fc434ed", "comment": "Malware payload (RemcosRAT)", "value": "33eefe04890a338f5effd9c69745a48b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851721, "uuid": "28e06a34-8285-4e44-bf3a-9297222f3bab", "comment": "Malware payload (RemcosRAT)", "value": "2f742cbc639ee7878cc901c2a1ac27ba7039c6db26f3d15ee16ba01496757688", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851721, "uuid": "49c263b9-a7cb-42ff-bb35-51f9481cff2d", "comment": "Malware payload (RemcosRAT)", "value": "a6a8a25f475e3c7c9bfe7080cf167b818625e524", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851721, "uuid": "0aa4199a-43bb-42b2-b50d-4f526b9adf43", "comment": "Malware payload (RemcosRAT)", "value": "f019250bdcb192b10eb815a8fc3762b265e6a14d4d1b90c5c8abcf2b8d0a6d5339fa9be225d0376d19a111af1524919a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851721, "uuid": "07829581-3827-49fb-b42f-ec311039567a", "value": "T1146233591C36CDF943DA802D24EC62D55A8C83BFA0953B2BB19D8503A3E4A5C94EA3C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851721, "uuid": "fa838588-d898-4e5c-8bb5-92f3de141574", "value": "96:brJ0Arw02ssO5mHfO5i2v/86Br5rJ0Zr++:bV0Ac02ssOsH0BF90ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741851721, "uuid": "d14e8c85-e3da-47a4-83ef-4e093789ba19", "value": 15028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741851721, "uuid": "7f2bc5a8-5513-4cad-9c8d-fd4b6f3814f5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851721, "uuid": "55550c65-e5ce-4525-a82f-9f2c82b0548d", "value": "verysurethingsonherewithgreatthings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0663dc66-0003-11f0-ad17-42010a9c0004", "comment": "Malware payload (Worm.m0yv)", "timestamp": 1741867344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867344, "uuid": "a9da1295-bf9d-4b66-8b62-e703ec57d31c", "comment": "Malware payload (Worm.m0yv)", "value": "69746bdc4650cd412bcc2169e749f099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.m0yv", "colour": "#F3591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867344, "uuid": "2185150c-636b-4b4f-bfd2-12d8a864bd49", "comment": "Malware payload (Worm.m0yv)", "value": "301dc94eb5d63a0fcd4a53c6b378d5d20ae42d0e56e0a5ab584f0baa59b5c8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.m0yv", "colour": "#F3591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867344, "uuid": "43f22c4b-c760-4000-b80f-a8ded04bad7b", "comment": "Malware payload (Worm.m0yv)", "value": "fe3cc1db48e050a70858264ce2abd26fb82cc716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.m0yv", "colour": "#F3591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867344, "uuid": "ff16c0b6-dfa3-4675-bf07-85b9af9b2ea3", "comment": "Malware payload (Worm.m0yv)", "value": "b530ecf83ff5320ae2fd2cf5fad246bc8c68397350e366827c99d88ec905e0463dfaad7e3150e6920769299235353a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.m0yv", "colour": "#F3591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867344, "uuid": "f78b7cd0-e85b-4766-9879-8f37e252e38c", "value": "T17585E02273CDC361CB769133BF69B7006EBF3C614630B95B2F881D79A960262162D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867344, "uuid": "73d55eeb-fe12-4fae-9b1e-81d1264ada42", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867344, "uuid": "58f7f774-844f-4d04-82a5-087b7776c25b", "value": "49152:ic0c++OCvkGs9FajlDJJ3DYVLNiXicJFFRGNzj3:rB3vkJ9SDb3DU7wRGpj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741867344, "uuid": "fcdd1977-d4da-4ac9-aca6-50d1bae1e9f5", "value": 1771008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741867344, "uuid": "7ba5b0e5-379b-4cdb-9bc8-026c472874ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867344, "uuid": "7f71b3b0-d2e0-4a12-9f57-2494f597f623", "value": "Supply Tender documents PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31198a2-0044-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895524, "uuid": "17352a9c-76b7-468b-9385-6ac7b95ada52", "comment": "Malware payload", "value": "0b7f50e2561d9742bea896a2d31f6390", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895524, "uuid": "0ad2d01d-d7f9-42db-83bc-e59cc44d3270", "comment": "Malware payload", "value": "3093142d2e61e5d4fbc9a787299f0c576fe4ff0b573bb4028667ea5ec6017e4f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895524, "uuid": "399c0ebb-000e-40f1-8157-a0668d521656", "comment": "Malware payload", "value": "e006c516322f1422f02393f66391eef2b7324aa2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895524, "uuid": "1bfc5bb8-5773-4d72-9128-933d221578ac", "comment": "Malware payload", "value": "9f2dbb0c3f8aa4a00576bf45a7a8f3bed91871c5ef811826374af135faa8f319f681fa413f55d725f1807adb44a75d4f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895524, "uuid": "8645938c-cdeb-4782-8cd6-f81ef998dff5", "value": "T1AD369E307A5EC036E66E45B1A63AAA2FA53D6DE20BB044DBA3D0BC5B15304C39335F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895524, "uuid": "6951bd2a-d55a-4654-aad5-5257e46ac286", "value": "49152:mueliN15sBAbwjHtS5DfKFT3zGLAl+quHMlKJM4L1aLKc78DZuzkvoS9xeXf7LKF:w8HOFT30u+oUwXXMAMs4LBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895524, "uuid": "b8b40823-d6a7-4c23-a00b-c15a01266797", "value": 5051904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895524, "uuid": "83e09ea4-a707-4d3a-ac01-587653e28ccd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895524, "uuid": "8fa3e78c-2c49-445f-94a5-31b014229863", "value": "Distributor Software.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5839951-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848713, "uuid": "4d7aa0bf-eb44-4b63-aa44-cfa0d7b2d3a6", "comment": "Malware payload (Mirai)", "value": "43d96262b05c44c653c415765e7d9b63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848713, "uuid": "4a469bb4-3ef3-4752-a5bd-ef3ac8188515", "comment": "Malware payload (Mirai)", "value": "310985b3f1da8403dff24b7a9710a3d24f0571f81758499bbc758fdc61ee84f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848713, "uuid": "18008db7-9891-4988-812d-0f3b23ad358e", "comment": "Malware payload (Mirai)", "value": "91fcecda378611aacbe36d390d69c242c016c510", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848713, "uuid": "46a10555-c37a-405f-87ad-b8fe4fc22db9", "comment": "Malware payload (Mirai)", "value": "891cd33a70e360f5806dfe80a956d393693e6e0ddc52c7a25f6aa471755a7366c775f52928777aec8383e17d0a758969", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848713, "uuid": "71540b37-4d38-47e1-aa15-c24ef6456d35", "value": "T160F35C46EA414A13C0D6177ABAAF428E3322A79593DB33069D185FB43FC675F0E73A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848713, "uuid": "a74cb255-3750-4174-a70e-772c437cfd1a", "value": "3072:9IKa0t08BiM4TZGL0/uXtxgSKQ5noxtZt2r2Xd9aSspypM/9kSsQvamq:9IKaO08BiM4TZGL0YtxAQ5noxtf2rYXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848713, "uuid": "4d4c6ded-bb5c-4216-a674-e324677adc09", "value": 157399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848713, "uuid": "e4e147ba-5971-4c81-98ff-9c0834b9fc31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848713, "uuid": "86423cd8-0689-473b-93f4-db18f33b40a0", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1841d176-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879399, "uuid": "e0d0d550-46fd-4f59-bea5-b3ad7b3af2d4", "comment": "Malware payload", "value": "d77498d87e570315407c13189ab0b52f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879399, "uuid": "d57f5f1d-62e3-4a4e-b877-58175e00d27d", "comment": "Malware payload", "value": "312abdaa163c72939848c59992257e9de0c0ffa9b2d56fe2e3e75f42719a1d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879399, "uuid": "f2b85fa1-3c1f-4fa8-a08b-f5f2ff351d54", "comment": "Malware payload", "value": "74b8464a93719b4a8117a58d09ae6c7f08df7223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879399, "uuid": "f502a9ad-bcfd-40f9-b034-e3a8c529a726", "comment": "Malware payload", "value": "05447c4f4676ee4f408694d1a16bf652ad683d9b0503ad14571057e4a936704cc207f7272d47a068a84c3c6b9623fb83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879399, "uuid": "4cbe0cf3-2fd9-44ba-8fe8-d9cf581e0b8f", "value": "T1B8D4CF46BC92D0A3EE1628B15928E7C50D6B6B244F3094FB7FD89D646FB36E14932313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879399, "uuid": "c9fce7e1-da72-4b14-b3be-f9ab0ec41d8a", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879399, "uuid": "30634175-0053-44b4-88d7-2aa73e23e366", "value": "12288:uIJQ/s2kiatVPnIpbWiJ621POPAANU/5cPe3rKjn0ZqyJx9/PJ:DBnIpnJhdQAANe5cG+jn0ZbPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879399, "uuid": "b60082cb-484f-4580-98fc-fdd244c21b00", "value": 618304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879399, "uuid": "8b5f0912-975c-4525-aa70-c0d71031cf4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879399, "uuid": "aa48f6de-a5b8-4356-89c3-217bd2d81866", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366dfaca-0025-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741882027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882027, "uuid": "f7398f4f-cefe-4dca-8928-db56a5820ff0", "comment": "Malware payload", "value": "bfeab1796769b6598343d8ff7de63ba6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882027, "uuid": "b8905739-0027-4250-8116-6b6df8b7c630", "comment": "Malware payload", "value": "3150abf2d4463ef27b34372fe26ad29c51efeeafac9953cd08cb5dd44821bdb7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882027, "uuid": "5773e7c1-fa48-4c27-8609-2abd74b20fb2", "comment": "Malware payload", "value": "03bf8c8b023cee33b026512fddb415e9a06e5824", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882027, "uuid": "83388951-940f-4c23-9cd3-c35adef4d837", "comment": "Malware payload", "value": "e42fd434b3775ac7cbbc14a0ff2230a6eae83cbf262dd0e121c1b17baca80266a99e99453a21bfe49330d26b72baba4a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882027, "uuid": "f4d086c8-1019-40cc-a059-3e4e70d7cefd", "value": "T125180257E72C9FCAC0E3D2326A35C091106A6CAC434BD2A72C2CBDB907B75C7571A9E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882027, "uuid": "25ce98fb-4596-4db7-bd79-0d45764ca11b", "value": "1572864:jkwM/andxULjzlXjKlobSPuKJAwAys7VglFNrmOepzB6Vp:owMaXClXue0uKDGVCNrmOeWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741882027, "uuid": "107a3bc3-381b-4c47-8da7-4fd344717630", "value": 88501833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741882027, "uuid": "847d5a19-7616-4259-af94-253b467f423d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882027, "uuid": "e149beb2-cf95-4997-98fa-f94bba723f7e", "value": "YO_3316_38.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b619c4a8-fffe-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741865491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865491, "uuid": "20a96715-8089-4816-aa56-d13756908a11", "comment": "Malware payload", "value": "162d0181fafead74dadb5e61168bac39", "object_relation": "md5", "Tag": [ { "name": "ASP", "colour": "#8F50BB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865491, "uuid": "a557db77-f9a7-4804-a692-89e4b51a87ee", "comment": "Malware payload", "value": "3182bf1fe044060300238c19fe3a7708da044ba15296c376f351f7a31a0698ff", "object_relation": "sha256", "Tag": [ { "name": "ASP", "colour": "#8F50BB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865491, "uuid": "17b4c7fc-9c2d-4ea7-95c8-6a81d62dd177", "comment": "Malware payload", "value": "96c0f4955815ec1b544afbf2f348efc0ed26c98e", "object_relation": "sha1", "Tag": [ { "name": "ASP", "colour": "#8F50BB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865491, "uuid": "3accb0a3-1320-4b3e-afb8-05b2762ac9a8", "comment": "Malware payload", "value": "b9c2e86e3c525c50a1db079c5e1789d8fc18caf29dee4f9f24f838079f83ea4147faf125d304e756c67ceee5781b871d", "object_relation": "sha3-384", "Tag": [ { "name": "ASP", "colour": "#8F50BB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865491, "uuid": "56a1f598-d2f2-444e-9410-cc89a05283c1", "value": "T1A7A0222A2C200C88F8C83083B03B8C0C3E300BE0E208023030883C0A820AE2F0CF0088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865491, "uuid": "f8f9d824-d0b6-4f56-8537-c18b263446c2", "value": "3:aEwJkW9F0N3A5eRtQYUfvbGun:aEm7Ea5e/QDfzGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741865491, "uuid": "ab1e8704-85c4-4954-9754-8aaf1bf2a1f2", "value": 73, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741865491, "uuid": "519b620b-5b28-466b-9471-6f9cb4c32602", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865491, "uuid": "eb18aa53-92b8-400a-83b1-55ba62d09dbb", "value": "444.aspx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f447326-0045-11f0-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741895732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895732, "uuid": "b42240c7-1fe0-4391-8df4-e6bb3ff2c9c3", "comment": "Malware payload (DCRat)", "value": "2a1305b51a81523b006bdfb440f1968e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895732, "uuid": "e14b5648-79a0-49a2-bbc6-ea4e798cd554", "comment": "Malware payload (DCRat)", "value": "319f968ee706288c0a62d96e5571104de53f952f2cbb2b40651aa05a9f48d73a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895732, "uuid": "87b451c2-a7f8-40ef-9392-71bbdf208f79", "comment": "Malware payload (DCRat)", "value": "53112e60487222544da78b91baf8d379179f6097", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895732, "uuid": "a591b8dc-873e-46d0-a32e-ccb0931a9310", "comment": "Malware payload (DCRat)", "value": "bec7bb76758722dc66030b80e38ba7fad1c6088095bf5962bdfbbd84c27ff24ddb4a6041799964af4bc0b9b2599af052", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895732, "uuid": "5567a44a-a3fc-4352-805a-4df558da83c0", "value": "T1C0D533E161ECDC1DDFF893359E29ABA82440B32DD901A5F50E274F86D77382648EC6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895732, "uuid": "c240db48-9148-4c06-83e5-f0dc7099196b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895732, "uuid": "7c942996-dfa3-4110-9b03-052b7f757db4", "value": "49152:Z4Hd6N3rl/SFsn4ik/D0HnXTWqMw6wecuKnwmSz59WjVYLE8vhC4Vq2Mr:Z4HENdpWD03TWq6wecuKnwm4MjFCk4Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895732, "uuid": "c84341f9-05ad-4b68-84df-fb9897bb1bfa", "value": 2921273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895732, "uuid": "5f426541-007b-48f3-9b0a-ffb2a7865117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895732, "uuid": "d92c7943-51e7-4d6b-90ca-00604ade3c1d", "value": "2A1305B51A81523B006BDFB440F1968E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9b6e6d-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883081, "uuid": "e5adbea0-c374-4f6f-a01f-5e22e81b9b7e", "comment": "Malware payload", "value": "c995b246855b5ec0baf4381ef03236a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883081, "uuid": "d28bf8ae-6ffb-4779-a45a-575b77d7a695", "comment": "Malware payload", "value": "31c385eaeb8ce5d8c845fbc3132bd7441e6afc9f2fb90ff111193722ccfb07f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883081, "uuid": "da132c2b-daae-4a1d-88a1-acde7576713d", "comment": "Malware payload", "value": "6394c456f77527d3728e4b0832328f84f08f0e00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883081, "uuid": "c8571ef4-b892-4676-8c22-882c83237b4b", "comment": "Malware payload", "value": "e49f6bf676799b212003215760aa0392c659dc9a41272bd1efa6a36f56eff516ebd2290145a78d4689c920675579250b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883081, "uuid": "f7f98555-3d21-456e-9c0a-60091f14f671", "value": "T156A5D023F2CBE43EE05D0B3B05B2A25494FB6A616422BD5396ECB4ACCF751601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883081, "uuid": "149bc9e0-1ce2-465b-8e1f-cc9306a07401", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883081, "uuid": "9482db14-19d8-4231-a663-a197af8a4892", "value": "49152:6wREDDMtS0uLNA3ftiaOXziJD+QzMm1RBoBVtYHqgA:6wREYS0uLNA3FMi9+Q4m1PQKq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883081, "uuid": "5715a516-f9e6-47f2-81c2-aff8d165ad62", "value": 2241760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883081, "uuid": "2015b286-67af-465d-a0f9-dadbccf0f153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883081, "uuid": "1436d870-3091-400b-a472-01477e6b9c94", "value": "blbtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43a1e9e-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848711, "uuid": "a488ac7f-6a64-40de-a74c-8ad15e6b5f05", "comment": "Malware payload (Mirai)", "value": "83ff5535bccad0fbac7ff0f985f3976f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848711, "uuid": "f31b8e5c-020f-4f8f-a84a-21c52796e9d7", "comment": "Malware payload (Mirai)", "value": "31dba760db561254df14594ba45cb7308bbe42e5addcb481ffcaafe7e416bbdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848711, "uuid": "5052903f-0b58-47f7-b1dc-ed0341e634ea", "comment": "Malware payload (Mirai)", "value": "86c6418fe2c79c8105ef3388132dadec55ffda9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848711, "uuid": "61e84f0e-ec77-40c3-9e8f-0d5769174269", "comment": "Malware payload (Mirai)", "value": "9870ab88843c0d659e0b71772383ce3227ed05fe1caa1536c9bb173df99b76925af98a1ab93a7d54a084ad330c86ad49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848711, "uuid": "9ddb07b3-4a3b-4ff6-9da8-f679b9db602a", "value": "T13EE2F21A1A015CDAF83AD1BF0BD917266A12C7B69457782F3FF4D0968C6C05C78937E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848711, "uuid": "202c3b62-7074-45ce-8db5-63a77acc20b6", "value": "768:3LHAmM1r8iRvylPd2Ww+9r8qG5Wu92uVbaMPsOKJgGlzDpbuR1J7:3q3Kv2oD4Ww28a7VJuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848711, "uuid": "78a22779-b8e0-4a20-9352-f0b9c608640d", "value": 32188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848711, "uuid": "c982c613-a90c-4282-9e8f-ed644ed1ae81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848711, "uuid": "e185d35a-1669-40f8-bcb2-cfbd12367273", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e01a69-ffdd-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741851424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851424, "uuid": "f70a4f68-304b-4765-ab9d-b49ee50338c4", "comment": "Malware payload (RemcosRAT)", "value": "19edaef8096f34e2ce49f55960c3add4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851424, "uuid": "50569357-2d56-4ef7-bf37-25b6b77c3b15", "comment": "Malware payload (RemcosRAT)", "value": "322538eeb708f6f481acc7166a17737e161a11297149603095d0ef43ea255569", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851424, "uuid": "f7fa3ed7-3f59-4c91-ab79-e7d81b33c5c7", "comment": "Malware payload (RemcosRAT)", "value": "d187f6b9ee1e9e3664a758be2f379f0af128ccc1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851424, "uuid": "02e75049-4245-4983-ab3f-0ac727596476", "comment": "Malware payload (RemcosRAT)", "value": "1a3e144df40a707bb329434e06bf1fb8005ccbc13380ccfb22f0b9de10be63b1ce436b78f236409173bb3fa6eb264044", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851424, "uuid": "de10aa4b-8df9-4f82-aac8-6d8303f68b12", "value": "T1617246552C29FD9483D3925C75CD6CC9E90E8B0E448A183FB7CF38EE976016A94D5283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851424, "uuid": "a7fd454e-1fc3-41f1-98ad-b835a61d1d6c", "value": "96:2H1dT8qH1dp8KDPsc5ZADfg3RuLH1dHH1dHV8PH1d3+:21dT8q1dp88scbADZ1dn1d18/1du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741851424, "uuid": "5379fb10-11d7-42c8-b0ec-1ce7f022e008", "value": 16121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741851424, "uuid": "98506d83-40f6-46c3-9968-521f4aef8436", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851424, "uuid": "0a54f1ff-36fb-4e65-8f3c-10c78f07baca", "value": "newworldbestsupportingthings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e91047d-fff6-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741861935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861935, "uuid": "b0c3b636-8b97-487e-9eb9-cc05655fa909", "comment": "Malware payload (XWorm)", "value": "eaf4bc6b3e0026c9c9a3be7b6d0eba6e", "object_relation": "md5", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861935, "uuid": "30133603-b10c-4910-910a-76dae906a3a8", "comment": "Malware payload (XWorm)", "value": "325a12d12fec73e302307abc5572574fde2a502d1241af65ecef57b0c8502e4d", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861935, "uuid": "2a2f7d7a-abff-4964-a8b6-d76a5a0d83db", "comment": "Malware payload (XWorm)", "value": "32b765dbeeea4b3d363cee585a5d51076d9b9374", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861935, "uuid": "baa6ad5d-541f-4de5-af40-d8bd1e8f31bc", "comment": "Malware payload (XWorm)", "value": "346e7bf04cf257870304e7164b9685316f9e59dfa2f97c30b729f3b6a8ea97073c13604f2edb9dbb374a0dcf533a9a8f", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861935, "uuid": "a00c351b-7e94-4ebd-a8e4-742c6824a88c", "value": "T18D53E63ECBF4EDC8077B70C0169D3B06104D1B93FAB96B6CF9D11AA55898544EF3A249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861935, "uuid": "923e2d33-a658-41b0-b559-04c1b73580f1", "value": "1536:wuHNwc87BZkbmEKUgXEXzICKUnFj8n5jqlwYSL4fAtgHOB/ZT0GFb:wuHlaQHfQ5GMuVHOJuab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861935, "uuid": "5c4da86a-cd60-4813-b867-850f90679e8d", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861935, "uuid": "746c01fe-f254-45d5-8100-eb0e03f8eacd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861935, "uuid": "806d5b97-7909-4e51-92d7-df31efeea021", "value": "dwm.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a45aed-0017-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741876305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876305, "uuid": "9987c10a-e984-4ca9-ab39-5c3e7f25ff41", "comment": "Malware payload", "value": "80e6aaf97f5ad096ac6192458e71c69a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876305, "uuid": "a0e209cb-6426-400f-a577-fe77b602d360", "comment": "Malware payload", "value": "331aebd534c9804606a1ab57c761c8bd14fefb0b09495cfb9817ae892ac732fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876305, "uuid": "491a4c1e-2b9e-4ca6-a31f-055fd2157a4c", "comment": "Malware payload", "value": "0ecd2b29f831d3a79ec05875a52830d78bd1acc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876305, "uuid": "6f3593dd-cd17-4745-b3c2-d5b84676caa8", "comment": "Malware payload", "value": "9da88f36d82fb3b1fbb90602afb9ff16eb9c63008d8a9b712e90e0b88ee14252480422fb6373d7c775d68ef2e6ebb63e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876305, "uuid": "506c2584-2d1a-4f8b-81a4-18641072e775", "value": "T1C146332432A85A55CD568EF5E43F353FC2A684E74D0EF6C7B066A65F4C826C3E970223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876305, "uuid": "e4a252ad-8a9b-4b4f-a56e-1d2c8fe697dc", "value": "98304:5UrnajFOM173cDXdAUuh9JeY6u4U3F9tPSgu+03lm9rgbAhUn3YiGR0iXyEWS6Yw:5BF7RMDXdlk9l6n69thPJrgb13oR0ayD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741876305, "uuid": "dec941b6-af08-44f1-8b79-678ae1fd6c1d", "value": 5393920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741876305, "uuid": "12c01ca3-0b50-48b9-9740-d4ac85c26383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876305, "uuid": "63c436f2-751a-41dc-94c6-520d4bb7537a", "value": "SecuriteInfo.com.Win64.MalwareX-gen.32018.22490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01332c21-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879361, "uuid": "5aa2e9ae-7e83-485e-a4d7-14f3f0a7d0a4", "comment": "Malware payload (LummaStealer)", "value": "3e5cf2d6661bba970360bcb9a1c89d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879361, "uuid": "4e61093f-a938-48fc-8438-a6969090f9ff", "comment": "Malware payload (LummaStealer)", "value": "335c55c746b95bdd6133a52810630be11d0f1b0840a45856d9c5390833842026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879361, "uuid": "5e356a36-b6f9-45e3-9ca8-0aa61ad93485", "comment": "Malware payload (LummaStealer)", "value": "9a9fc6e8fd6e2c7e471c0b5e5226fae47e9e2361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879361, "uuid": "071bd033-0c6b-4bf2-b74e-fb898f722428", "comment": "Malware payload (LummaStealer)", "value": "771d2ad93b5e549d2c3f962eb1c0417b2207ad8f100ba06260cc8580f405cd5daa59e3eefeaf91f7d95e0ba280d1e0fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879361, "uuid": "c6c0eb5a-1a6c-4298-a13e-e1369a50e7b3", "value": "T1E0F4DF46BC92D0B3EE1628B15928E7C51D6B6B204F2085FB7FD89D646FB36E14832317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879361, "uuid": "b607a478-fe1b-41bc-bf28-77764f90fd40", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879361, "uuid": "322db7ab-b602-4a08-a100-75bbd870b359", "value": "12288:DIJQ/s2kiatVPnIpbWiJ621POPAANU/FIuETl5qGlsecGHaRsuAVHETqpVEe1a3N:MBnIpnJhdQAANeStTTlkG6FDmpuQAzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879361, "uuid": "456a2bcb-30fb-4d9d-83ec-d5543a28de62", "value": 784192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879361, "uuid": "5e7d2412-589f-40e5-b303-8d4430e7125f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879361, "uuid": "29559c78-f983-4256-bbec-83b66d3ab04f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a4fc40-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830399, "uuid": "8b5ae8dc-87ef-4fbd-b1bf-060210904251", "comment": "Malware payload (Mirai)", "value": "33fbd966bf301b0f913270fca5ca0c82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830399, "uuid": "a1bc61ef-74d4-4efa-a507-15accf840971", "comment": "Malware payload (Mirai)", "value": "336e7a949299f3a9c063a10783edbdfd9455ebf8d29bebbfff74545904aa2779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830399, "uuid": "0ea3c58c-9a42-45b7-a961-7ef8d9701332", "comment": "Malware payload (Mirai)", "value": "cd9ec59b4fc107c5dea7cf61651b4cd8d9d10e3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830399, "uuid": "ffdad934-c8d6-4228-b29a-7abc0297574a", "comment": "Malware payload (Mirai)", "value": "f995de9fb3f35f1d371fe4b7b7fa4cd3249e12b7e006f7a179a4cce1dd2c499022e7f1993fa38c0a626d65e9e49c5c32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830399, "uuid": "e1309e39-3ca1-421c-8620-cafdfc7c81cf", "value": "T1DF63A506BF214FBBE85FDD3709E91B05249C641B61A97F39BE34D818F64A25F09E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830399, "uuid": "c6ea9fa7-4eae-411f-9a43-ad73ba3240e7", "value": "768:haCU4ohpIaKDjBCFqJmtKH6Sq0oC5UQWSI1hx5aSeOeWyeHPCdKgXi5chgBj04R:haCU4oLIfCfEvobBSgx9D/ycPCscgVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830399, "uuid": "a327b5c5-2817-4ed4-9570-e48dd2d98d2f", "value": 72132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830399, "uuid": "426fae88-d075-438e-910a-7cf1888fd3a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830399, "uuid": "7f1c816b-c4d5-44c3-90c6-452eca45241d", "value": "3atoNational.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab9ca4c-ffe0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741852345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852345, "uuid": "5733b4e1-5359-474c-9f21-d37f251b923b", "comment": "Malware payload (Formbook)", "value": "c28dbc0d132d97e07c97c6756572505a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852345, "uuid": "116c48f9-8efe-421b-a11f-5ae35f014b4f", "comment": "Malware payload (Formbook)", "value": "33774bd8fb57c533fec4aadf210dbbe065237bd2d09a79a3a3b7dc5db11bba41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852345, "uuid": "82afe55c-259e-47d8-99c0-e017fc307df8", "comment": "Malware payload (Formbook)", "value": "1514f34b3d68bf37521f21b36d6d7fafc22f0080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852345, "uuid": "fe0e3136-359f-4b20-8e61-80562d90faaa", "comment": "Malware payload (Formbook)", "value": "1019dd7ba0b8e189185ba3c9b5952fe731752f95aa0cfa11bc78a351677b01c3af82c999dc0105d1660333068a095894", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852345, "uuid": "dcc80965-4265-4ed4-a1a5-3cc483e8ff0f", "value": "T19AE423C598D198A3D6AC97BA807DCCE05B797872CDC9271AC714E55BFC31303A84BA2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852345, "uuid": "b6c1e5a7-cb73-47cd-b6a7-d1a06a3b67ad", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852345, "uuid": "d15839b5-c4b6-405a-b214-59dd934d3dc2", "value": "12288:aquErHF6xC9D6DmR1J98w4oknqOOCyQfQPQhj+YdjCgdl/G80lAV0nVTgaHfCjKt:Prl6kD68JmlotQfj5lCgdl/GvpTg+Cj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852345, "uuid": "52f1e2e6-cb72-49e4-9320-0edb01cfa562", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852345, "uuid": "5c9d882e-d117-43ec-8de8-8d85b489a65a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852345, "uuid": "5ba544ca-53be-4e3a-8b20-2ab240aa9e82", "value": "PURCHASE ORDER N0259305-06SN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681bb153-002e-11f0-ad17-42010a9c0004", "comment": "Malware payload (DiscordRAT)", "timestamp": 1741885976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885976, "uuid": "0119e852-2d6d-4092-b1a7-af0a053f6bc5", "comment": "Malware payload (DiscordRAT)", "value": "24b2b8aefc432bdbe57f6d2a13679b84", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885976, "uuid": "c643099f-5c4f-468f-ab3e-fac2b9bd98ee", "comment": "Malware payload (DiscordRAT)", "value": "337fd56a904a3919e64d7c2db751ad49d02dfab444e33ed01a937d92866b61db", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885976, "uuid": "95345eca-ce53-45e9-8f6c-135267b0a566", "comment": "Malware payload (DiscordRAT)", "value": "397e559e7814f6d798b742fa6d9483923c82d562", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885976, "uuid": "0b701e24-31a1-472a-a474-bcd0be96c1c6", "comment": "Malware payload (DiscordRAT)", "value": "e06ea281a74a0c6d9ef537ef308e9060db5e4423778928924a9b4d88f8f7b1958568475f274dcf6068d58c24ab4d2798", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885976, "uuid": "1c6a8a9e-4bf6-4ba1-9509-23e466c7e5e9", "value": "T1FC73C8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885976, "uuid": "0666be00-a8f5-4f01-aeeb-05a61ad12029", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+LPIC:5Zv5PDwbjNrmAE+jIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741885976, "uuid": "0f3a611e-4d53-43fe-8dc8-23862827472e", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741885976, "uuid": "4d096dd8-fb1c-4928-a866-36acaafd50f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885976, "uuid": "97fa6394-a181-436e-a60f-25e2ee85d046", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a835e66-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741824991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824991, "uuid": "486cb9a1-d64d-4689-a3da-6f3cb2d7bcec", "comment": "Malware payload (SnakeKeylogger)", "value": "5fa0f6929099205c09e3d67ae8f91544", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824991, "uuid": "dc5be398-01cd-407f-8700-0056a3bc12bd", "comment": "Malware payload (SnakeKeylogger)", "value": "33afc4e7ef1f4dea4b50f62c25612df94db566e7b9986b33a66bbc7c93f3d222", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824991, "uuid": "75ee3a9c-bc74-4fe3-96e0-4eaee9c489df", "comment": "Malware payload (SnakeKeylogger)", "value": "5ecc01c5efeb5971c5fd10c41125212dd44103f6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824991, "uuid": "1f10e150-70fb-4994-a054-ad9e20965805", "comment": "Malware payload (SnakeKeylogger)", "value": "c02ad10b39d07357b8946f9682778cab24e32807ebb6501090eea131de08c418abc59292424f167135e28270ac41a44d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824991, "uuid": "d82bda11-62e7-4b93-aedd-1b63295b2e63", "value": "T1B362C6CAFD55FC048B52409CBAEC4DD4D25E4F7DDC0A1613FA0D2B8267D29AC8ADB246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824991, "uuid": "31a09c05-01c2-4ed1-bed1-f7f34bd4a635", "value": "96:qtQVlgGECQVlCGE/BGpIoenXsXVQVl2QVluGELQVlB:qtQ/XzQ/BMQpXzQ/2Q/V2Q/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824991, "uuid": "52fd0eaf-e1f1-4620-a316-65202cf99dfa", "value": 14900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824991, "uuid": "f53a1340-0eef-4847-9dd6-b8890353cde3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824991, "uuid": "a82db40d-2f4f-4aa6-a4d0-686740ba94ee", "value": "wekissingbestgirleveryseenwithmygirl.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0261e379-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741833407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833407, "uuid": "144e0a37-cd61-4482-bad2-f5b46193df28", "comment": "Malware payload (Mirai)", "value": "7da670d8c9d4c7f9b6448a825e429f5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833407, "uuid": "4edfd039-7da3-4dc5-8adc-d50ea49a84a4", "comment": "Malware payload (Mirai)", "value": "348f573c5f7d9dd376d71ab0bb49cafb0f13fce9b80df4d9610ac9b483ccdd6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833407, "uuid": "12eff661-00ab-409d-bc0a-e3eb17fe81fc", "comment": "Malware payload (Mirai)", "value": "51dbffa874f2bcef44fd841b7567877f6c3a4a84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833407, "uuid": "0961b9a4-6390-4f43-b8cf-d424573f2d6a", "comment": "Malware payload (Mirai)", "value": "7c5b5c69b091f574f5ee4825e342d069a0fffc0390a9efe1041bd5482f74435883f15c94d74a537a5adeddb1d391a9ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833407, "uuid": "ddb134e6-d7fa-4434-955f-34de6c1415ee", "value": "T10A43B6593E214FEDF7BC82344BF74A31A66923C526E1D684E2ACE9006F7034D645FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833407, "uuid": "3d5c1dea-0592-4538-9b35-d4558319f3f5", "value": "768:e3z1295Qq4RufLpgCZIcC89rVrpu6t6uKn+BHG6Cpg7JfFvmgg6z8OrUwPB8T2rj:eD12bQq4Ru/U6V93TgQrUCeQWIUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833407, "uuid": "73501b57-a79c-4398-829f-01e9d7f08441", "value": 59824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833407, "uuid": "190bd44a-3668-4eb3-b177-8c3ae1726c27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833407, "uuid": "f0194538-14ee-49f7-a0bd-b6c1e19575e8", "value": "miori.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfad3ba-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864187, "uuid": "c3a07bc4-10f0-4d41-ae5c-67c429aeab62", "comment": "Malware payload (Mirai)", "value": "f24438272fe7ab9d0e988e90995c48d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864187, "uuid": "acdb847c-0a06-481d-b79a-aa5d403e5555", "comment": "Malware payload (Mirai)", "value": "350d560517f01337acd1dee2469315f18e2d43901a6d952417e481b0b1dc76ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864187, "uuid": "fe20109e-83f7-49aa-9ee7-58610f7621a3", "comment": "Malware payload (Mirai)", "value": "0fe687d4741d69722c357d913dabf57b80995e25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864187, "uuid": "66f8bcaf-8a8d-470e-8b2c-f3701b037766", "comment": "Malware payload (Mirai)", "value": "112a1a56da55a36f326d3e69b8bc7e69fa04ec2fa61de3e9b654b6768f3f863f1ddef96ffa002736a7b45fc41e9456f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864187, "uuid": "f0c60bb7-14be-4fb7-9901-176328b04159", "value": "T17823F191D958FC0DCDEF6D6359C5B081F3E34F0A6A4459A69893D210068BA1FAB8E0DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864187, "uuid": "2507c50b-fa06-460e-a184-2b78dc92217f", "value": "1536:zRqNf5T1T3/X27CQBlUjgRDXa/o4u+qgw09B:1qtJ1bm+QB2jwd4u+qgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864187, "uuid": "85967db0-fbf6-4035-98f6-9210c8c1efd3", "value": 49348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864187, "uuid": "b8fb9565-e905-4075-8784-668a6accdbb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864187, "uuid": "e5c5c7cb-3b4c-4aab-8331-061aadcb3550", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad69d4eb-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883086, "uuid": "93d0e7f6-0048-4a82-8482-3b1bbfe38fe4", "comment": "Malware payload", "value": "a4960649d677e5371182ee4eb119853c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883086, "uuid": "b927a9cd-ed9d-42a1-9956-28e512772e32", "comment": "Malware payload", "value": "35b4a7f20aeb997f1d2a6d77143fbb2834a2c07f297a47d818ab72e647cae071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883086, "uuid": "260c2057-176c-4647-8d35-4ed65e220060", "comment": "Malware payload", "value": "37bc2b20a47dc67e04359a1ebcbc30abdc6e640d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883086, "uuid": "59d516b5-c2f8-4763-8230-1fa6fe4ac1c9", "comment": "Malware payload", "value": "a3d5c479b35deb11fadacff205065b19bd04c4f73e735b6ae9f31b9c437a0812ee765631296baa75150b66c14a75b861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883086, "uuid": "44c002bb-59d7-41a6-907c-8733ff96d40f", "value": "T18BA5D023F2CBE43EE05D0B3B05B2A25494FB6A616422AE5396ECB4ECCF751501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883086, "uuid": "5fd7ea4d-7ec0-4e85-a1d2-52b7e8308c36", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883086, "uuid": "2d603077-7182-4bff-adc6-e5ba7cdebc99", "value": "49152:SwREDDM5nSBWOT08F3ftiaOXziJD+QzMm1RBoBVtYHqgv:SwRECDw0U3FMi9+Q4m1PQKqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883086, "uuid": "407cd93a-8252-4315-b8e2-da6f0dfc54b4", "value": 2241904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883086, "uuid": "18f2847c-c044-486b-8149-63c4a72149cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883086, "uuid": "f037e577-bdb8-43da-9e35-6ad6b9aef768", "value": "cfcbtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c08b90b-ffb7-11ef-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741834819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834819, "uuid": "44ab7378-f4af-484d-a3c8-3144907428cc", "comment": "Malware payload (DCRat)", "value": "a4734f3832166b2855711bc677eec65c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834819, "uuid": "ba4a6dc5-15d7-4456-b2a6-1479eb86a7dd", "comment": "Malware payload (DCRat)", "value": "361518020cf400fa996c547b35a9f612816b74688279497a7a0e71b4711c37e5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834819, "uuid": "555751fe-4708-402c-ac0f-cf449774524a", "comment": "Malware payload (DCRat)", "value": "aa46aa751f4eab6ba2d3e82012f71cfac4e08449", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834819, "uuid": "89654747-e8eb-4146-9694-b62baafd56e2", "comment": "Malware payload (DCRat)", "value": "9190e2388db5a7f5303d71955737fde1577559afa509556195212630177efd0627cd1006a3ff4b946c4c490396d1fddd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834819, "uuid": "817f6529-9efa-4ab2-a409-eab15e91c50f", "value": "T1AF2539027E44CE12F4191633C6FF496847B098556AA6E32B7DBA377E15223A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834819, "uuid": "3b30fec5-7989-4622-ad93-b6406835c11f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834819, "uuid": "99d658b0-e402-4df1-9763-11f219030f4a", "value": "24576:SPsMPdz19fMWvSrX58XtJbsh7Ze0LhWyu:S0k8Wv+cb45hW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741834819, "uuid": "c0a3a8ef-d5e2-483b-b351-8a7f278a49fb", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741834819, "uuid": "bf774c57-08bf-4645-ac3f-67e424e85a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834819, "uuid": "98870efe-2ac1-4f40-86c6-d0c8b1ac84ec", "value": "a4734f3832166b2855711bc677eec65c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7954833c-ffd6-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741848209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848209, "uuid": "cc9c4cd3-7f9e-4dd3-a5bd-ca42b9dd2c7f", "comment": "Malware payload (LummaStealer)", "value": "82505c38e11c312f05b2891d330cf9c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848209, "uuid": "160b66b9-15dd-42b1-9714-21a4248e4276", "comment": "Malware payload (LummaStealer)", "value": "36398113dbc31cc9ee99735f134cb246669c7f1f3932dba36628e24f12660246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848209, "uuid": "e7b5fd99-4a12-4533-a7d7-feb1e7e3f5b6", "comment": "Malware payload (LummaStealer)", "value": "232f8439df61af9b5ef164da0ea24120d866a93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848209, "uuid": "8af0acc7-3ae0-4957-8793-fc8b2a3c747e", "comment": "Malware payload (LummaStealer)", "value": "54f358d4ea8360a3d211631d127eb00bef78a7a3666107c8c239917169d65557f252927b24d9f28478dab201c037c9b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848209, "uuid": "dcc54d31-cc01-47f7-a52b-7be04d318d04", "value": "T1A1F4D046BC91D0B3E91628B14D29E7C50C6B6B604F20C4FBBED89D646FB76E08932357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848209, "uuid": "943981ed-f211-4651-bdea-dd32a1da68e5", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848209, "uuid": "523593ba-2b32-409b-95f9-dbc1e92eb57f", "value": "12288:GIJQ/s2kiatVPnIpbWiJ621POPAANU/Sc+e1RoKq/T/+Kc5fBzBS0+I4d0Z2cdTQ:7BnIpnJhdQAANeNboz/aKc5fr3l4dzcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848209, "uuid": "c0ec94bb-83dc-4be4-a439-4c504bcdcbf5", "value": 775488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848209, "uuid": "0bd65f59-3325-45b6-a84b-c53001ccc92a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848209, "uuid": "74271b47-65d8-40b2-9187-7dffbb26fd5b", "value": "SoftWare(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bd4d52-ffb6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741834301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834301, "uuid": "2c560a53-5ad0-4168-b8f3-37c5e86c2a07", "comment": "Malware payload (Prometei)", "value": "12ef117e1fec01a5dc7eb0a1615534e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834301, "uuid": "77c6cc72-01fb-4e67-87b2-98d52f27fa2c", "comment": "Malware payload (Prometei)", "value": "36503cab1fb7f8db85c378876ea2aef1e37845edb8d3c465abf2866cc9ee852f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834301, "uuid": "dc9fb725-f29c-4792-ac14-9a4ef95a3a95", "comment": "Malware payload (Prometei)", "value": "4ca48a737ad4883bf8e39e46891f509d275888ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834301, "uuid": "ef208606-a1cf-477e-a619-700f678e7536", "comment": "Malware payload (Prometei)", "value": "7b536a85d238e36e9c6ccdc8c43d944dd7598a7d503ac610f155d8a4d50dc4848f19aa18fb625517bd55706e9e26c6f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834301, "uuid": "ee623b1f-e78c-44f1-a9f9-f3d0659beb68", "value": "T1B59423F8C83D2E3098169F3CBB1A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834301, "uuid": "79dfc21f-2dd4-46de-8353-c01e459809c5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgU:25WOSACZSV6eKRH5EPiamb4DsDwwcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741834301, "uuid": "7cbaec71-0276-4f79-bc58-7d964e4d0601", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741834301, "uuid": "0ee8d798-c112-4f80-8a82-98b753e37596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834301, "uuid": "0e954364-bd4b-4c77-80a2-7c1bffb95b82", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2353bd-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (DBatLoader)", "timestamp": 1741824992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824992, "uuid": "78f6d9d3-d315-4d66-9402-ace1534228ff", "comment": "Malware payload (DBatLoader)", "value": "ce2e5cf9073c55e909187a0d16b5dd2e", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824992, "uuid": "491536ff-0aee-453a-a758-4e9c53259227", "comment": "Malware payload (DBatLoader)", "value": "37657f99bb29fc5a5b2f2be621b0f17e619013cfe32a0b97c6e5c07e87699702", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824992, "uuid": "61ad3c72-d671-4c4b-9fb3-209af39eb986", "comment": "Malware payload (DBatLoader)", "value": "dd26f331ca3da30ea8e4065ec6da02bf0469e124", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824992, "uuid": "c78ba1cb-7341-46a7-8e98-80e9a9d96c05", "comment": "Malware payload (DBatLoader)", "value": "fd47c55751a7dae53666f04795fea2fc71f4e98459c2f4b828a18fef3423959d9d66779e6f44a276868082c65efeb14d", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824992, "uuid": "ed799d20-8c17-476b-b648-47f89e54d41e", "value": "T1B662856A4DA0ECD183A982FAA4DC9ED3158E873E800526127C6DC6060BCCF653DE93D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824992, "uuid": "88f3268b-3b4b-4329-9ae7-57f73e3f1aea", "value": "48:3vysyKTVFb2WoJUaMsyKTVRwdb2WoJUaO4jfoz/y/MDLTNG7Lv2syKTVvvsyKTVE:fyMB+cMi+bH/MDLTsuM3M5+KM2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824992, "uuid": "29b5a2b4-3514-4a0c-8a32-bbcf3c8f572b", "value": 14714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824992, "uuid": "b2942f6c-a280-489a-b1d9-429e29634e51", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824992, "uuid": "8dcb3604-009e-48c8-bd84-3a2fc0ecad7d", "value": "mybestgirlfriendwalkingaroundtheworld.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93c1109-0024-11f0-ad17-42010a9c0004", "comment": "Malware payload (Triada)", "timestamp": 1741881844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881844, "uuid": "c7c6cad6-65ab-4f8a-9c8e-3f7d09c39fbc", "comment": "Malware payload (Triada)", "value": "f40f891b132488297b8af66cbdde284e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881844, "uuid": "c5e126d9-5a31-47a5-ad00-6cc97e533973", "comment": "Malware payload (Triada)", "value": "3822bcb6d8bb2b726803ddbd14b52fde1dcc7e42ac8b45d4d38b1cf69f685997", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881844, "uuid": "ce4e5d1f-6391-434d-9043-c96696297762", "comment": "Malware payload (Triada)", "value": "663dadd8ada7b075701387b77bd730a76e19eea0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881844, "uuid": "42dd4124-3c3a-4372-b344-5bebf3918623", "comment": "Malware payload (Triada)", "value": "9e298f3730ea8ff9ac7be0021e4d7f48bc06bb3dd7cfcea26a1d88d3d61a8a0134de5ad88faccb40684f46fa96648f81", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881844, "uuid": "c0a0675a-07e6-4284-bf01-e390773b06e6", "value": "T1E2180263E72C9FDAC0E3E2326A35C092106A6CAC074BD2A72D2C7D7947B75C3571A9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881844, "uuid": "7f7f5901-73fb-467e-a194-560d28325e01", "value": "1572864:bwysandxULjzlXjKoobSDuK9Uo0qy0jREzHGviFOtsPnpOz:bBXClXutIuK4oSHksPnAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881844, "uuid": "f199e09c-c725-4a07-b74f-22ff8d1862a7", "value": 87912009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881844, "uuid": "2252128b-2cbe-4349-9dab-28fc59d005ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881844, "uuid": "5611837c-0b31-4199-9a0d-2eab397a9b65", "value": "FM_3315_40.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d1f6a7-005f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741907017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741907017, "uuid": "13f0897f-9445-4f62-80fa-a642f1501f66", "comment": "Malware payload", "value": "b69f744f56196978a2f9493f7dcb6765", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741907017, "uuid": "a61b4b27-f41e-40c6-8938-0ab36f857814", "comment": "Malware payload", "value": "38907d224ac0df6ddb5eb115998cc0be9ffdae237f9b61c39ddaeda812d5160d", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741907017, "uuid": "934707a9-bd55-44f0-831b-e323b284ba11", "comment": "Malware payload", "value": "3c9400e235de764a605485a653c747883c00879b", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741907017, "uuid": "af14d502-77ef-4a53-aa95-b1c77fb3a167", "comment": "Malware payload", "value": "0bc327138e479c11306e9b1651ee8694a313badc8204745fbd977506b986a7ca9e82a41626e88e7b8fd482ff81073355", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741907017, "uuid": "174e843c-40c5-4759-a86e-f3f303a3d8e4", "value": "T11D620897476864E2FA8F067CC1B1D4129BB4B2612B96A1CB11B0416A1F96BE03F3D64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741907017, "uuid": "126d8a06-b15e-4d47-94a7-317b8a2ee259", "value": "dcff99c11bb15f3fe275d70fbf6d208e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741907017, "uuid": "5b075b02-ae5c-4548-b153-b2cc6a6b98da", "value": "192:mVSfmJKPWOpdPsVaNpnznrX8gyCjtlAur9ZCspE+TMDQrR6xR:DfFpdBNrUHeMD66P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741907017, "uuid": "c3e55f26-4e20-49a8-9b90-566e9673b671", "value": 15840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741907017, "uuid": "ba1d4ce1-d483-46f6-8af4-a4211bca8ff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741907017, "uuid": "8075a931-f7b6-4352-badd-21a0f9ff8664", "value": "ssisd.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a331ca3f-0042-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741894665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894665, "uuid": "a2fb072b-e514-41ab-8c1d-927b82292295", "comment": "Malware payload", "value": "2ac41173d1e4636e5b80db41ceaee419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894665, "uuid": "89ce32a6-2a70-4c32-b21c-27ce016cd36b", "comment": "Malware payload", "value": "39281bfb93651a5ae270190f2c2b1ee1dee23af5202534b4c346bc052b7b8fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894665, "uuid": "2ee27776-b94f-4f55-aca1-749031f85386", "comment": "Malware payload", "value": "12ae47039f699c35bd0954d435ed1a01a4037afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894665, "uuid": "00f679b6-cb9e-469e-aab6-ab49dc0ffbde", "comment": "Malware payload", "value": "ffd704f7c6e58052ff67c84093b5830f145ce453c5bc91b24cf110099c64bad7f033ff4ea5f4729df2e6859fed1019ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894665, "uuid": "a81bf78a-701a-41f3-9804-93ef6b54aa16", "value": "T1B2165A21B68EC42BD56605B01B2CAAAF912CBD260B6148D7B3DC7D6B27755C30233E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894665, "uuid": "2c954352-3921-43db-84c2-03927236aa16", "value": "262f7b623746b414d0e9c48c1d61145e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894665, "uuid": "d54688ca-3824-4fd8-9f44-2c6365c5b32b", "value": "98304:50Fxb8yuO+WFwLId3DUVxaZumRdhfCqcqmP/OF:50Fxb8yuO+JLA3DUun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741894665, "uuid": "ba70cf4c-6890-4f48-b91a-79d3e5e61627", "value": 4118984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741894665, "uuid": "ff0492c6-4c89-4191-9550-2530da34d1de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894665, "uuid": "0420a403-3a5a-4ae5-8f32-07686ba08154", "value": "Distributor Software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070dc862-ffe4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741854030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854030, "uuid": "ac36e503-3838-43b8-b88b-2260704993d2", "comment": "Malware payload", "value": "67dfb679ff9fe2b314af86844f5ea1c8", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854030, "uuid": "c269a1f2-8272-4d3a-9f9d-df8dc3b1467e", "comment": "Malware payload", "value": "3a2f83a62307345bbf273a4292f190636e09110162c7f12a51cb98018c17f27a", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854030, "uuid": "06550307-aafb-494a-b7db-615b493c94e1", "comment": "Malware payload", "value": "7367ef2b7836682f248bbc97539e9e9e67d92a20", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854030, "uuid": "7b9867c2-a875-4c4c-91d0-56bdfc8dfb1a", "comment": "Malware payload", "value": "af90408da88f707ef870f9e741d2523a1d13d544b5eab024e99d88eeae9f3db5a1813258d5cc93ed71c8f19a62c1465d", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741854030, "uuid": "6de80f34-1357-44ad-a173-065de04c7fa7", "value": "T16574237D8B808191E4C9909CF120169DCA271BEA352538F5D5E379BFDCC5E4FA8D3A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741854030, "uuid": "92fc16ce-327b-43e3-8e35-4758c1730a5a", "value": "6144:mpV2WkkQPkKrdMHE8yLPleNaW/51o8Zyr0jzd0fhk1ls4F1Pe8P5xtrQv8:DkgkKxMU9IaG51o8Zyr0jzdkk1l51PBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741854030, "uuid": "b0d1de04-1247-492c-a8a2-9abffd929e76", "value": 356066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741854030, "uuid": "91cc0753-763c-4ee0-9efe-690476bc164a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741854030, "uuid": "d15d17ac-da0d-4f4d-9a11-aedfe9c67034", "value": "Software.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d589d8ad-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1741855665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855665, "uuid": "6084b019-6884-4aac-8127-07b32fc27abc", "comment": "Malware payload (Cobalt Strike)", "value": "038bd62710ad3678adc03722b3413176", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855665, "uuid": "44de44a0-4c6b-412f-a682-206cec6318df", "comment": "Malware payload (Cobalt Strike)", "value": "3a76ffcf4a09876d6cc13769e152457d266dc5d55dd2333a3db4bb12e895de24", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855665, "uuid": "b74c4efb-ef25-4f93-909f-a083ec5a2f4d", "comment": "Malware payload (Cobalt Strike)", "value": "eb456d6f4e2fbb5d804adf914114b8224a0a7583", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855665, "uuid": "faba2cad-a3e7-45f4-b12a-efd22dab82fe", "comment": "Malware payload (Cobalt Strike)", "value": "3a789f1508a6e7f1dde35e7e6596527d9afe16df31fc803d05006f3c9333505d88e5dacbaea6f0c7fbdadffbe6ffaacf", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855665, "uuid": "e41fe8c1-6ed4-43e3-b1bb-2ae6caefba79", "value": "T1EE717B523093F08F008647793A9823E6947AD604DADE6109B78CEFBDB9DDD633A4D6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855665, "uuid": "ec7897b4-fd06-48e8-a209-de7068a9ed2b", "value": "48:w+MThimb7RunK/jPEDfAsxjjy5H71EbhXI3FD1Buv/41:zGT8gPEDfXUcVXIVMQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855665, "uuid": "e3b03ce1-8e92-437d-92e9-cf5609808f75", "value": 3687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855665, "uuid": "83f5746f-04d6-44b8-aa98-476d0348523c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855665, "uuid": "173520f5-d622-4161-a881-6dc088823c19", "value": "443_2003_psh_x86.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdece2ba-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860457, "uuid": "f351835b-e14f-4338-8d51-4bd1c1476034", "comment": "Malware payload", "value": "f8a242fa6a8df6eafded0a6987a5ac09", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860457, "uuid": "b2a2d2dd-9559-4958-a9eb-fe2f2e94ece6", "comment": "Malware payload", "value": "3b22cb5a35d0ea6fe967791ca4f7b3b0f2326cf757579dad3bd3ddaee0751697", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860457, "uuid": "38184ae7-694b-4525-8e3d-24211b858efa", "comment": "Malware payload", "value": "cffa3967ce585ab127346a68b38cd8bd1f3a640c", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860457, "uuid": "ebc95656-2d1c-4cd7-afe1-4a77236d4417", "comment": "Malware payload", "value": "353e161efed6305473c55be31360da34346dc2a3447d7c8cc216098913ac22f45a40a0cc548c7fb64e147e3028a85270", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860457, "uuid": "53a6e3bd-10e1-4701-b0b8-026041463faa", "value": "T137F00281C1FC0C61F37B01219483B0DB77B70A02130B2831BDACEDEE2F4342801A666D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860457, "uuid": "dbf484d6-0ae4-4095-8071-b15ef7df087c", "value": "12:yG/R6kwALZzWv2QALnSpkAFvx8ALJlCtRUpp9eMtORlZzfvWqkLZOF0FCB4kqWoH:lIkwuZKTuS6mvx8uJlCApooIbf+qkFFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860457, "uuid": "347982bf-3a8d-4e71-86a3-e4a96c965605", "value": 638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860457, "uuid": "201d018b-8462-49a6-9bc9-e45f5233a698", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860457, "uuid": "c4f55795-8f92-4bd6-bbf1-ed19ff5d8d7d", "value": "3b22cb5a35d0ea6fe967791ca4f7b3b0f2326cf757579dad3bd3ddaee0751697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8851f2e-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741855670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855670, "uuid": "5b552fd0-84ec-4610-afe2-fceafcf10916", "comment": "Malware payload", "value": "d417590fde169de44fcf14eb49d0d979", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855670, "uuid": "8417549d-c22b-4b76-80cd-f5dfce5bf168", "comment": "Malware payload", "value": "3ba034e459b20607da8c7fb23ee923550c5968d5f695f701d4a8a0228019e4b0", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855670, "uuid": "9fc83122-212d-4ed2-92ed-2ccd80719799", "comment": "Malware payload", "value": "4e0baa2612b1856eead65015669f361d81adcb98", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855670, "uuid": "2453acc4-fba4-4676-9cd3-78962db7b5f5", "comment": "Malware payload", "value": "582acf815aec2cd19924a0737c2f03eaa2481e54f3b71183a0d2c88609c3938fd9a0c047a4171da07d272c738f829395", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855670, "uuid": "a8969ada-3b5d-4979-b118-17d2187d41f8", "value": "T121017567B1233099CA10597E8F17E58888198BF13F2739FEE67A0703B5B685670345C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855670, "uuid": "61bc1a69-1ade-48f4-9282-674886e264ae", "value": "12:yk1tLs9RkaupK9UxRB2DOexWb2RKJFtH2N+skXWmv8fJ11bE1Enb+ljWv0VxcOKe:/YRwKSn2DOIRwSemIIz1buqiksvc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855670, "uuid": "7a189f0b-16da-4211-bd0d-02ca125ebfe5", "value": 798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855670, "uuid": "3f785086-1cb6-4b62-b208-7efee989eb2c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855670, "uuid": "ab2ba4cd-f10b-4005-a9b4-17f5539d6f1a", "value": "443_2003_x64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594f543f-ffec-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741857604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857604, "uuid": "c35deb65-2df2-4ead-be30-318ddf91cb13", "comment": "Malware payload", "value": "ef534265e96edb9ed7c0020354616279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857604, "uuid": "8538ab00-3256-42a7-a626-d7b6db9428ff", "comment": "Malware payload", "value": "3c5192ba28ada3b4d4edfcb37de6fa2413b0537c3154591d2b542eb20b87c29c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857604, "uuid": "d136f339-b228-4fe3-92cc-b14023b0cf74", "comment": "Malware payload", "value": "ca1a5fd3d262b32dc09bd09f1dd2117c5269f337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857604, "uuid": "d1d0f847-851d-4b30-9e6a-b7f84afc5c71", "comment": "Malware payload", "value": "6627a1744ab963fa21c92ad7e57d7b7e8e53e2064417ce589e3f0f8f7cf27c81e32635fd9fbfb170905782dc1ce24f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857604, "uuid": "a33e1ff9-88e6-4b3d-83b0-2c85eebf7cca", "value": "T157C3B1D789E93F22E58FFB7367FB53D50B206E4048805174E9C7A56B3882399BD03A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857604, "uuid": "edfab204-c455-42ef-b217-c49ff4c625d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857604, "uuid": "56d6a0ed-8328-4fd3-a65e-39a022640ba1", "value": "3072:NX7De5c4bFE2Jy2cvxXWpD9d3334BkZnkPR+lePUBcUcB77/O:RDe5c4bFE2Jy2cvxXWpD9d3334BkZnkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741857604, "uuid": "21df800e-1432-471b-870e-5a3567b2fd91", "value": 123144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741857604, "uuid": "4d3c9a1e-9871-4bb6-9aeb-9028b1bb5129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857604, "uuid": "e1448dc1-fe0c-4491-add8-f2de2cf716eb", "value": "\u70b9\u51fb\u6b64\u5904-\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u53051.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a193ad-0009-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741870077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870077, "uuid": "23042e9c-ba2f-424e-8aee-f4d6bce4f0bb", "comment": "Malware payload (MassLogger)", "value": "6157bd9e1f8f34619e222262a71b79cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870077, "uuid": "1475c6bc-c131-4901-a95b-95e3b4cd64e6", "comment": "Malware payload (MassLogger)", "value": "3c7f61519b46af007450df7ef19b49df3a8b60d0b7c4fd82112068994262be6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870077, "uuid": "09700602-b294-4414-bdd9-872704c94112", "comment": "Malware payload (MassLogger)", "value": "31818fbc3eec3c641f28bbcf94c59dea97f1cacf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870077, "uuid": "db721971-cafe-4aeb-b5b1-0016af64c1c6", "comment": "Malware payload (MassLogger)", "value": "d7fffb66ad888a039df1645495c8d7783f246ae9954ad993d8a220f3d5e1a54a7226de5138f6a65eff9061b8b8bb9fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870077, "uuid": "216a571d-19ab-4f48-941f-1c911d584bbe", "value": "T114B412F4935ACD62EEE617710933D27256BA5F6CF012C70387E9FEEF3801222650959A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870077, "uuid": "2781cd16-6879-4e2f-8cab-5524a344ed28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870077, "uuid": "f4cec652-100a-401e-99e9-76c1e7850ccc", "value": "12288:85MOiV1JqhSvYg7IYU/2UPkY1Gp3/B/dQ/Wb8T2DQDs:85MOiX3A9zjM3jQ/Wb8aD+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741870077, "uuid": "24c01d5f-7bf3-4670-bf73-cc30985a8451", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741870077, "uuid": "0a99fc0c-e6d2-4e08-b1ae-2752f284568a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870077, "uuid": "cd2417b8-57f7-4d6e-9917-eb3692258612", "value": "Bank Swift Payment.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf5882a-0026-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741882441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882441, "uuid": "ccfdf6e7-e2b3-4efe-b8f2-9ee3def3a374", "comment": "Malware payload (Formbook)", "value": "129f25313f3eb1cca56bfd7af119b94d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882441, "uuid": "a982db89-3f2c-4d64-849c-9179332b4476", "comment": "Malware payload (Formbook)", "value": "3d5b24a9ffc7c94606ad482591c4836dc8abffe04cb3b409e6a208890a1cec72", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882441, "uuid": "edc77f0b-3174-4f58-9c00-ddecf3b5e307", "comment": "Malware payload (Formbook)", "value": "68d574eedc745e176551477e90205857473f5825", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882441, "uuid": "3db7763c-f1e6-4612-b74b-c6a93a273c84", "comment": "Malware payload (Formbook)", "value": "d9a4fe8c26ce1ca6d6ffed94715852330c878cc7ff891f622974271c8d5c82f29db24fa8b0f04abd0d84161e334c1b86", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882441, "uuid": "93143a40-e3d1-4e6d-9a2a-f056d12b9ab5", "value": "T1B7D422B396C67DBCC9AE9AF74A33B4B47D324C4246397880664793DC4D9909C200A9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882441, "uuid": "5d47286f-6810-4ff9-8993-1dac6fc9ca09", "value": "12288:nNdQl6UCuG+7AKJ8T7WhUAO+ZvkTq2ULgEcyIdYOCsEN687:nNulsuG+7ALTYUArL1hItCsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741882441, "uuid": "649b6392-1ff1-4783-ba27-f78584c3970d", "value": 603344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741882441, "uuid": "1142d8ea-710d-4c30-9661-872a41988070", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882441, "uuid": "bd637456-a16c-427c-8d69-d94d08bd5fd4", "value": "Please Quote-pdf.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a74089-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741824987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824987, "uuid": "ee786e5c-71c0-4eea-87af-4e8f7dd23bd3", "comment": "Malware payload", "value": "537dbc455cc8fe8347903446688246f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824987, "uuid": "64f49881-ea77-4542-9e0e-50bd836dd0a2", "comment": "Malware payload", "value": "3d65393f45e9974f238dace354c51d544b5be190f9a2979f06bafbc8071d6653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824987, "uuid": "5fb89427-6651-4fab-9e98-4343ea0e4142", "comment": "Malware payload", "value": "2fb9346e2b7454c814bbaed5e7905ac9c7bd8318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824987, "uuid": "8f4602fe-dfab-47c6-a0b7-dd390dacf68a", "comment": "Malware payload", "value": "9530a9cd8214d9057053b003a1a6c5a962288f2235db116556c618a6a0f09eeaf641c526512c398edb0ec30fa899140d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824987, "uuid": "b70eea19-ef50-4eb4-9bec-93d9c89ed46f", "value": "T12EA4235E6477A4B7DA789B7122ED0843588D28699A2C4F415EF4C828FEC1D8273372DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824987, "uuid": "8e4a2064-cd60-4271-b441-27fbd506d431", "value": "12288:PQesbwhx7kOQ4x1QJxhEol1X+QbchK0tvDx:PvswhZT3/QJLfl1X+Q47tvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824987, "uuid": "56977f82-f0af-4589-80bb-af2ea27f1e8b", "value": 479035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824987, "uuid": "0ffab330-cf31-44ce-941e-e75264880025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824987, "uuid": "3c299445-676b-45e7-aa65-88a954e37fe8", "value": "miner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac0eb6a-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848721, "uuid": "19faf74c-56b4-4945-9c6b-4221b56622d8", "comment": "Malware payload (Mirai)", "value": "19cd20d4bff8da8ed3b1eff2df097385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848721, "uuid": "7fcb77c6-08f2-4a12-9bc2-dda915fecae4", "comment": "Malware payload (Mirai)", "value": "3e26204eba90ebf94001773952658942d68746d5bf54ec9dbae52ddb9087e51b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848721, "uuid": "3f6b44a2-8e50-42a6-90a0-38c499d8fd33", "comment": "Malware payload (Mirai)", "value": "4cba665763eef2bcace6024ca8d4bf9acbf0b60a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848721, "uuid": "9f56b0de-86cf-4e13-b6fd-2b4ec5368951", "comment": "Malware payload (Mirai)", "value": "05d9dde67d6ee4dcccfe3c0cbc68e53185ca55687857fa7bc965ca49473d7fe3e1e6385443ffc10bd1479257e1670d4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848721, "uuid": "228b10b3-aa8d-47f7-a63b-8f301b11f05b", "value": "T1D2D2E131D0FD424BC87E00B65F6E6E6E4CB4E10A7951899DEEDC30FA4C46AEB652C325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848721, "uuid": "6e404194-46e2-498c-be43-6b1daf430711", "value": "768:fvMioRCNCbSRVmFspQa/bXoQbMFwckjgpVnbcuyD7UoQRjY:bcIRshSXoQoF7ZVnouy8oyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848721, "uuid": "b49a508e-b96b-49a4-80c1-b43c4d83197f", "value": 30404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848721, "uuid": "511e5d79-760d-4e7d-933b-b245426e2894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848721, "uuid": "38ec2ad4-9a2d-4c84-92d2-88dfbf022d23", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d4635f-0018-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741876708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876708, "uuid": "a058e4aa-5401-471e-b708-936ab545e09d", "comment": "Malware payload (AsyncRAT)", "value": "c4ff9f61de98893d0efe24811a47103d", "object_relation": "md5", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876708, "uuid": "368b1c20-18b6-481d-974b-78cd343b5d92", "comment": "Malware payload (AsyncRAT)", "value": "3e4467450145a541f84179dc38ec26e5dab36b2c321e1f185dc951e3caa5a468", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876708, "uuid": "7363b452-49e7-460b-acf6-b07006f927c3", "comment": "Malware payload (AsyncRAT)", "value": "eba2446dc75860ef8b2dfaea767288c8bcaf2761", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876708, "uuid": "6ced04e4-8ee9-476d-a2f3-ad26d388fcec", "comment": "Malware payload (AsyncRAT)", "value": "d5c48fb4bd22aae3c4954e581cbc0ac975e69f52758006e790ca74d9e5647ea10371ffac7bcfc4304b20dc0efca44d30", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876708, "uuid": "bfcc6b7a-5674-49bd-9aa6-bd7112e2a056", "value": "T101F081127D4716064350D3CBD091C4529C7085BD9B5FDE6CD5C87E269C7E3D8CAA0C9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876708, "uuid": "f647d845-36c4-4769-98b2-002fef4c065b", "value": "12:cVfNPzoSf0WobKdJQif1CzRRE4m3jGB5V5pnpFVmg4x0l0z+oYrnnyVMnSn:kfNPE5WobK7QifEEq55pnpFVmg4x0ldy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741876708, "uuid": "1e8b1a8d-28bd-4b3e-bf03-612693b488d8", "value": 602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741876708, "uuid": "97f7054d-5bc6-430c-936e-0674def1e687", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876708, "uuid": "56b0911e-5858-454e-8d36-4a4ec1bd84b6", "value": "b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3c4292-ffdf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741852240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852240, "uuid": "8e19c09a-3c09-46a9-bd10-4cdf144e52cb", "comment": "Malware payload (Formbook)", "value": "5632183a932df29c5e9bacfc9c4f5579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852240, "uuid": "2fdda602-8845-49bd-ab6a-07636be8b5dc", "comment": "Malware payload (Formbook)", "value": "3edd748e79c66913269a64c27716bdf06f1fad52eee64a68cd239a2e04b6cfba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852240, "uuid": "8f4a6cae-7aca-409a-9f02-d5c634d89df8", "comment": "Malware payload (Formbook)", "value": "8c15695ad7a8f054ef2157965594f253cd03e518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852240, "uuid": "ab010a74-5666-4d49-bb4c-3b54bc54b0cf", "comment": "Malware payload (Formbook)", "value": "1fe457a1a9deb93352289492aed4d009e4f43ef6c2383fdc540d188f6e7dd49112a9a6f421c40a45c1da3180d99b64dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852240, "uuid": "e1bd27c3-f61a-47c4-90b1-e13558074b5a", "value": "T18735BE2273DDC370CB669173BF6AB7012EBB78654630F85B2F880D7DA950161162DBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852240, "uuid": "cae0e80f-2434-495e-9850-93b9f828eadf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852240, "uuid": "6caaa2d3-d70e-4199-a2e3-9de1568087ee", "value": "24576:iCdxte/80jYLT3U1jfsWaUIXt/mrVnfP8Q:zw80cTsjkWaUMt/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852240, "uuid": "66b14de8-9ddb-4cad-a02c-a30f95daad7b", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852240, "uuid": "97a8d6ab-cfaf-4664-a6de-89796c687c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852240, "uuid": "6d443a5d-eda4-448d-8ca1-ed5623bafed2", "value": "Letter of Suspension for Employee for Repeated Misconduct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fd5e42-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741883427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883427, "uuid": "1fe3f928-1fc8-483f-a80d-dd85430bb949", "comment": "Malware payload (AgentTesla)", "value": "a29db5be1b14603e6357771560f03325", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883427, "uuid": "2e88dadb-d848-4723-b8c1-757c972292ba", "comment": "Malware payload (AgentTesla)", "value": "3f9664d0797d2b2018493447b69d6f662642c00ec3b652ab1f61b999609baa63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883427, "uuid": "7c324272-8d44-4ab2-9bf1-2cabe57dd16a", "comment": "Malware payload (AgentTesla)", "value": "9b0e099bbaec4c7c13b3fcc9488f06e689127120", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883427, "uuid": "129c7f15-f444-415a-9380-13fc46acaaa2", "comment": "Malware payload (AgentTesla)", "value": "234a0ba0181e3d474f52c9590476a3d24d6e219a56629b5242e0f5cd241d3a202b82a7f6a3c6d39c9c24aae791d32a11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883427, "uuid": "7b92577b-dec2-4a78-98b8-272fac55bb32", "value": "T13C35BE22B3DDC360CB669173BF6AB7016EBF7C614630B85B1F880D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883427, "uuid": "ab5b6c7c-eeb6-4fe0-b074-46539474d736", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883427, "uuid": "dc264f36-890b-4673-b356-41b85107a68f", "value": "24576:Ku6J33O0c+JY5UZ+XC0kGso6FaMnZDSQ5PGB94bdWY:8u0c++OCvkGs9FaMhSaMykY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883427, "uuid": "71cef110-ca83-488a-a05c-3de573df6049", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883427, "uuid": "fcfc1ecb-90a2-4e11-8c72-b046a1c282e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883427, "uuid": "a5c39241-b381-4cd0-a1ad-5265488679ce", "value": "z79RDG987654567890009876567000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a1a4c1-005c-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741905730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741905730, "uuid": "747cdd8a-9faf-4038-bbe4-1128675ccbea", "comment": "Malware payload (AgentTesla)", "value": "51b87956815eaf18d1353e10f2c128af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741905730, "uuid": "bfbf6aaa-60ce-4413-b16f-d468ba351c8c", "comment": "Malware payload (AgentTesla)", "value": "4047e764771fd462a5f5a98dcee4628968b550a8da08e82a8ba238fd8b09efb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741905730, "uuid": "6a84db30-a755-4e26-9e7f-897612726f28", "comment": "Malware payload (AgentTesla)", "value": "e3805eb0892fc06c8d7b35fd96d92f9b835ef8d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741905730, "uuid": "a0398e45-6e9c-4c9a-a173-562ac9ae0ebc", "comment": "Malware payload (AgentTesla)", "value": "ba498f6da66c68529fe8046210909dc374e3bf2a30d863a6762cc9004618cbe06e5d6d94575901369e20771aa0c7b645", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741905730, "uuid": "23c601d6-c45a-4465-8a5d-3aa82e516841", "value": "T1EE35BE2273DDC360CB669173BF69B7016EBF78610630B85B2F980D7DA950162262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741905730, "uuid": "91295f43-baa5-46af-9668-2a84c9ff57ff", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741905730, "uuid": "b8f61444-f2c7-4184-ad9b-a30071e6b0fc", "value": "24576:ju6J33O0c+JY5UZ+XC0kGso6Fae6JJeENxbbKIWY:tu0c++OCvkGs9Fae6J0Wx8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741905730, "uuid": "84e03a42-fe51-4ad5-9268-3b8d86f20b11", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741905730, "uuid": "c9318f47-81f7-4329-be5d-606cc50173be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741905730, "uuid": "85252a99-d935-406b-92e5-f2db26d9d5c0", "value": "wixx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226a3aa1-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (ValleyRAT)", "timestamp": 1741872974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872974, "uuid": "64d4baba-c549-4019-a57c-41d72e24a5f1", "comment": "Malware payload (ValleyRAT)", "value": "e4f5390b4ffc75f52873e4fcc5564595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872974, "uuid": "f0bfcddd-21cc-498a-8e2a-abd938913a17", "comment": "Malware payload (ValleyRAT)", "value": "407bd5007ff872b87d738cb78f6aaccb4b791a506f524a4e030a45b62d5c6db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872974, "uuid": "df8f9106-b9cb-4acf-9fa2-5916fc99c4f6", "comment": "Malware payload (ValleyRAT)", "value": "068a0c6301088dcc2f016c68a0435d2ad76535ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872974, "uuid": "90f8cf6e-7dff-480b-a6d1-3bfaa2510284", "comment": "Malware payload (ValleyRAT)", "value": "d50ab82b8f3ff66ccd7a15e66a8b0be2617a0b13d7db435b9a7cac082135f91f3158bd81169fd85bdc9f18c0809eeb88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872974, "uuid": "8922eba8-7d48-4bbd-aea5-08ce0115cb7f", "value": "T17CD59E01B781C432E5A201F18A69A7FE4479BE211B3981C3B7BC7A6D4F315C2DE3A756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872974, "uuid": "5d7a46a9-f471-4562-8c0f-1997b736d2f3", "value": "1d580e48547161823cea093ae6628e40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872974, "uuid": "f6f031a5-ec4c-402d-a346-2b642c46fa2b", "value": "49152:wrJRcqKh/bY3iJlK7lH/fFT3baPmmqLNfGSn9j6G6SXv:wt9T32K7lf5BmqZfGSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872974, "uuid": "0c7aa136-3bde-45bd-955b-6d22daf9b87d", "value": 2893432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872974, "uuid": "a89c70d1-91ad-4de0-9885-48526d9ec0c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872974, "uuid": "748b371c-e636-417b-8b14-4411618eb148", "value": "LootHoarder.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1a1cf8-ffac-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830395, "uuid": "a287b40f-eaca-45ac-9d8d-a75e03297b39", "comment": "Malware payload (Mirai)", "value": "4254d336aa6d00212205be91e78df2a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830395, "uuid": "cc7474b1-f24a-43fc-900d-6e2ce1fc0690", "comment": "Malware payload (Mirai)", "value": "40ad19632bc4d4f8711e35cd2a7592d52e298ab1860f09908efbfed0a408fff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830395, "uuid": "5910a534-80ae-449e-ac38-2fd2f8b4a69c", "comment": "Malware payload (Mirai)", "value": "dba0ec3705320be6d9c82673bc2407fda9b71b93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830395, "uuid": "74ee886e-6e2f-4ca7-92b3-e39519cd677a", "comment": "Malware payload (Mirai)", "value": "b4fe648794d3d793eface3d30abb8f2420eda798465595ce593ebafbd524e0b1d9e4e6f7b354005bac6b45b438a2bd98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830395, "uuid": "aa352b56-1455-44e7-9f51-dda146095a39", "value": "T17C332A02B22C4A4BF9E61EB0343F0FE083BFE95024F4B588655EEB558635E771486F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830395, "uuid": "0cb123e8-72bf-4fae-b3d4-16e43f883f77", "value": "768:PTXWxEDVawX119+/vIP4eKRv93mORaXYKH7fNKc8QyaaKarwk608Ub8TOACq0+:TlRbl19+/DhT5PKZn8QygasH6AlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830395, "uuid": "cb9d28eb-9969-4032-a04f-d56e212149ed", "value": 52268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830395, "uuid": "03d59503-9a10-4bd2-b3c6-b7e9a23ec497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830395, "uuid": "b9ea7779-0684-42ab-8db7-b1a9b4b9ddf5", "value": "3atoNational.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309d365c-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860113, "uuid": "974d946d-5800-49d9-af67-b370e2eed2bf", "comment": "Malware payload", "value": "9ef845add689fc71cae33686139efbb0", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860113, "uuid": "46071618-a72f-4471-a2ee-e5b85412ad60", "comment": "Malware payload", "value": "40ea161cc38d2849964d2a3c047b4dcc161242f5e7ffab40667a7d02160a49df", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860113, "uuid": "1a0c0b6d-a354-4448-8cda-628814f63b7f", "comment": "Malware payload", "value": "ed9a73f4f1f8bb43a110697d9eab9c386a568f0c", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860113, "uuid": "d23457dd-f800-4f59-91eb-f33d2b18223e", "comment": "Malware payload", "value": "d86744ef39669a34551ec9c2465ed7cbe3911f45625e05e57733f67a9a5be6fbdd2a967df757e0ce4d8078c8ba26a8f4", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860113, "uuid": "f51a2bc6-846f-441c-bd05-3e88d89ee92e", "value": "T1B7E023FB092DDE8DC04C854F1964D65A5A5D51C5771701DD6C6311E4073377093B7237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860113, "uuid": "3f827583-7aa8-4cfd-8910-01cad3ac660e", "value": "6:48xJL8WTJFzc8+QSLCwPZ78nIdXZduDEx4xh9MHjlQG1vxUnXlMuk2dJB+O7o/d/:4aI6IlF8Qaw0MH1UnXlMOd6s3AD4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860113, "uuid": "83f47c8d-e4ee-4ddf-98dc-f872b0b23306", "value": 436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860113, "uuid": "0ffb8ef5-cadb-4e3e-b7e6-a2187180b4b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860113, "uuid": "d57cdaed-46cf-4e3d-a8e4-ff1465d0542a", "value": "40ea161cc38d2849964d2a3c047b4dcc161242f5e7ffab40667a7d02160a49df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c09c6b2-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741872990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872990, "uuid": "30f745c8-e05d-4b18-894f-cb55cfb4bfb4", "comment": "Malware payload (AsyncRAT)", "value": "8d33cd1bf51961998c5e8f1bf41f5171", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872990, "uuid": "2cff8759-9f6c-4f71-a554-b0a43666bae2", "comment": "Malware payload (AsyncRAT)", "value": "41d04ea19537e23491e376aef33540a8ce538c54f05fe7cc2e50bfb11cd8ba4e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872990, "uuid": "37481882-d670-4912-9735-5f44eabde342", "comment": "Malware payload (AsyncRAT)", "value": "d2f38357156dae7fdb7d30c31d70615699682ae0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872990, "uuid": "a3fc3805-6c92-4b0d-aa9c-f1ea3fa112e6", "comment": "Malware payload (AsyncRAT)", "value": "e7cab349622db58bd9bb2840c231ecfbe84dfe8fc39b475da33f7380274b4888b84465817fb23fb57be3fa6b8421349d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872990, "uuid": "7c026aeb-e1b6-4ff2-bd44-873fba016ef8", "value": "T115232B003BE9813BF27E4F78A9F26105467AF2736603D6491CC452DB5723FC69A42AED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872990, "uuid": "df3494ea-370e-4872-a600-4566f4239510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872990, "uuid": "999173a3-218f-4ccd-add6-6a9d914ff299", "value": "768:yuwvNT8E2mLWU3FvZmo2q7QFpPklON8APInzjb5PgX3ieky4MdN/r9BDZqx:yuwvNT8xk2/7kwN8ln3buXSTbudrTdqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872990, "uuid": "6717f064-df1b-4797-a837-88fa8da62a7f", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872990, "uuid": "4f763e41-a1b8-445d-aa0c-10cd43799dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872990, "uuid": "105e0a20-de15-4140-ade7-ee2d7afe11f6", "value": "velocity.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe60cc0-ffb0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741832087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832087, "uuid": "f39b6315-53c5-495c-8bd9-9b4744516fe3", "comment": "Malware payload", "value": "a0e1f4fcf152d5bebfef9b15ca567225", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832087, "uuid": "07936633-0309-4bd1-8840-ef8456747133", "comment": "Malware payload", "value": "41de37ce1356ee95e7c33890f7f40dac7272832034691481a59354013ac51164", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832087, "uuid": "31d89af2-1a73-4794-85f3-1a33506d51c5", "comment": "Malware payload", "value": "fb68596a06795c56472c63959c14bee35bd7e175", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832087, "uuid": "9546aaaa-2537-437e-8dea-1a16902aad04", "comment": "Malware payload", "value": "37e982b5a4e7ed9b3bcbe0a45966d03098ef546d966b99d5310da85d8b2176dd49c804710df044748baccc9e7838ba59", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832087, "uuid": "b8ce1adb-7a9f-49ee-a8a6-cbd0d13babaa", "value": "T19B530298AAFCB99EC499327CBCF987A8A0C6E8BD1363157D113C0075059A67E3C61F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832087, "uuid": "8aa835d2-266c-476b-b99d-d5bb37373d69", "value": "1536:RVxH12o9jWR1ye6bPw1BpJdxGrV0bHDoPGqPwFgQBoh/ltlGe9olV:/xHQo9qR5ew1Bbdkr38eQah/ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741832087, "uuid": "9e6b1f10-021f-44ab-8405-a471df27acb9", "value": 66545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741832087, "uuid": "5d7dee26-ff14-42b2-9e3d-f343a6bb38e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832087, "uuid": "a99b8c5e-5e16-44fa-a221-45c02f06b30a", "value": "Mapeel.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b392a0c8-002e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741886102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886102, "uuid": "387b760c-b80a-4760-833a-7253c56b5d3d", "comment": "Malware payload (Formbook)", "value": "7f8787ada55c9605a03c2ade237f0711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886102, "uuid": "4f1ac7a6-b235-4747-a840-d4805b1d3f3a", "comment": "Malware payload (Formbook)", "value": "426fdebd49de919757b274d61c0fd9282106b35b0c1d557c2a888319f004ed37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886102, "uuid": "ab280ce4-1dc7-4f4d-87a9-af1032fd2d89", "comment": "Malware payload (Formbook)", "value": "3e6c9b06f36b93a3d9d1836822c074910a3a76cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886102, "uuid": "c15f103c-1134-4d9d-bfd8-bae3e3c11c95", "comment": "Malware payload (Formbook)", "value": "9a6b3ee13e6a5652697ad53db79c8830ba2d786c0949523c280124af8ab034a002d1900abc00e23410e07529bcb2f315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886102, "uuid": "b2239fa1-a95d-4734-a454-9dc9a8cebc6f", "value": "T1A3035B043B910326E6FE6FB069B371420674F6139A13E75E0CD8899B2F67BC18A517F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886102, "uuid": "f1b5166c-0867-4a59-b839-8d14d13ad395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886102, "uuid": "acd4660f-a5de-42d3-b8db-637bc9426138", "value": "768:rUOI3X6mQWKMmZOODXFyp9ORL86YOjh7PyNG+:A1L/OTF09Mg6YOjFZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741886102, "uuid": "63db2353-9f60-4fd6-9970-4dc90b0ed53a", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741886102, "uuid": "767b49bb-6b2e-448f-a48b-f74e73e565ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886102, "uuid": "dbb46353-f2dc-4a05-b2c3-08b3c72f88c9", "value": "RAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7284b4c8-0003-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741867525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867525, "uuid": "a360a613-bc3f-4734-b57b-eacf5cc7ff18", "comment": "Malware payload (RemcosRAT)", "value": "b3a4f534d879266608a6e0d370344fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867525, "uuid": "47792a67-4b7d-4b73-a530-6c527063b30b", "comment": "Malware payload (RemcosRAT)", "value": "43753d7fe1487c758cfebd575c0818b13ef5c3c278a0fa9539e04fe1a86553eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867525, "uuid": "5c34497f-8eac-4f99-8fcd-d74b64c565eb", "comment": "Malware payload (RemcosRAT)", "value": "ec792154e1d3ae828ae35e964a8f8f6306e47fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867525, "uuid": "97bf396f-34d9-4812-906f-90b8bb171662", "comment": "Malware payload (RemcosRAT)", "value": "7e409a701c8e1e82ce3ef86103fe1cbb384e330431328a502a283633d9b847d05973dce7d698b193ba11adb6c3c10d70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867525, "uuid": "d40ad714-9cbe-49ca-a2fd-7bf43e792c52", "value": "T18BE401153B35F507E214A1749B51E6B82B78AE29182B8B0BF7E13FDF7A287439C19314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867525, "uuid": "46348277-0fdc-4692-9293-648ce9bd0dc9", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867525, "uuid": "e4c7fd4d-f630-44d8-b055-4eb4afc419b8", "value": "12288:Acpp+js+MnU4IIMZ2JjbQ9CdTCriV0Rc7ym+dPNAMLK:Acpp+YVbjMvCdGeV+cGm+bbLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741867525, "uuid": "fb934c3f-3b74-4378-9af4-53f694402ede", "value": 686161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741867525, "uuid": "34862f79-9fad-4d3b-bca1-328c7a2adfa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867525, "uuid": "70ebb06b-6b0c-4165-80d5-66ee4a9908cb", "value": "RFQ NO. SEST-13405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd7e674-0021-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741880372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880372, "uuid": "5aab0bb4-004f-4393-93c5-7abc1ae32120", "comment": "Malware payload", "value": "21ddf39d881651d299fa7d3b58626f45", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880372, "uuid": "29f39492-7f5e-4e58-a93c-62a2a861d63d", "comment": "Malware payload", "value": "43b26608b844f3e807ae70523b0b6ed188874572bd57d696f4e71a4166f1202f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880372, "uuid": "dfc1c0da-7f63-43f5-887a-637245d8acd2", "comment": "Malware payload", "value": "d836f960bbafe10adea69fe0145d1327458c6ebe", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880372, "uuid": "f1813c82-f6e7-4207-a4d5-167aa8f31779", "comment": "Malware payload", "value": "8d6b63f2e09b3848ce0d06ea4413190d275abc61e89e91c4c3ce23976a9d30dff961d6bb3821d52df850d721a2b60be4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880372, "uuid": "93db8057-58e5-4680-97e8-0843965f76f2", "value": "T100C53D9BB78847F852589BED8307348A5391913B5FBF128C55E1844FB92EE23B234D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880372, "uuid": "2746f694-add6-4dcb-97b5-e97a02c014ef", "value": "6144:JI3Yjgd/vd/sd/e1O2VfevpSmub73uojnqB3cwMk5gRKK3Tveg1sejuwipd/Ad/n:cd62ZOeNdiyl0LBUhU7eflAGNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741880372, "uuid": "c3c049c8-0748-427b-bdcf-0997267fc0ab", "value": 2643757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741880372, "uuid": "2a0ce316-3f80-4c2c-bfbc-065db8e033bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880372, "uuid": "430505d7-63cb-49e5-84de-97c3869dc253", "value": "f40b7a79ed8433ee4d221f3553f422e9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded980cc-fff7-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741862553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862553, "uuid": "3971cfc1-423a-4035-9642-e37bf8be041c", "comment": "Malware payload", "value": "49cd76b2753fceca64c184e9294175a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862553, "uuid": "d6b524cf-74c9-48d3-843b-69eee92a90eb", "comment": "Malware payload", "value": "43efcf9110e7f03d63a055ad58ae8ee233310975cbb6e1f83a809f637b2ee02a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862553, "uuid": "98b14948-b95e-4496-b333-ad0bb839b047", "comment": "Malware payload", "value": "27c82796b1b802d823defab3c74d5232790318f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862553, "uuid": "67fdfce4-73d1-433b-b39d-f2f8d05defbe", "comment": "Malware payload", "value": "55d0c4d46c3ede1fa2f1b7bb1d0d373f2c2af6ae0a6336b1fb41f4648a49654e348cc948910598e38d48cc560fb15b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862553, "uuid": "6d0c3b73-be92-42d7-befa-f4fccf96874b", "value": "T11ED5C011E2E201A8C16BA1B8E83F875BC570B0192761D2CF33D84A752FA75D09E7E7E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862553, "uuid": "a81ac7db-74f4-4fd9-b7a8-512117b6b151", "value": "673df9b23dc2960d2bc7da9b2d2b9a07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862553, "uuid": "631eb561-8893-48fc-a9db-010f85e51178", "value": "49152:7jQMkJQFlfQ/GKh1m6IFzYdk3b1PBiI1S3XQnusFtAAAttWpbxhn0nWSfjGsPxsV:7EMkiiSxFzYdk3b1PBiIU3XQpFtAAywT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862553, "uuid": "0f18aeb1-3898-4779-ab88-139b23f3d0bd", "value": 2933248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862553, "uuid": "7457b650-cecf-4347-9442-00fe9664e093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862553, "uuid": "84160c65-aba1-4447-8a06-e80d556aa6f4", "value": "Trace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db11a47-ffa5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741827090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827090, "uuid": "0232e9a0-d4ad-4088-a824-74d90de991e4", "comment": "Malware payload (Prometei)", "value": "94afa2d71a36e05c1bfdda2b8fd4312b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827090, "uuid": "71d62f74-16ae-4d7b-9350-2b31180fab4c", "comment": "Malware payload (Prometei)", "value": "4440db764deae1363d4aa34fd2aecb2e7cd6eb647d6221d3e3e3e10143f99d23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827090, "uuid": "05cf3faf-c881-4134-8f46-beb4b3bcc2eb", "comment": "Malware payload (Prometei)", "value": "a98d79024e46d032dd9c31117c602d6bd0cfae47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827090, "uuid": "2ba65574-ac87-4da4-9153-37776aab937b", "comment": "Malware payload (Prometei)", "value": "19bacc89572f5dca570a1927a9ad6a5b5f11473ae1367bbc161301d266d8db14dc8fa456d023f118802f73bc9914bb72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827090, "uuid": "777fc660-9a64-4d63-9468-ddf420c6e236", "value": "T1579423F8C83D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827090, "uuid": "89261414-35a1-4380-bf87-9909287b404e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgV:25WOSACZSV6eKRH5EPiamb4DsDwwcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741827090, "uuid": "200ab71c-cdc5-4702-80b9-efaaf8db7a12", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741827090, "uuid": "c6463112-417a-461c-bb1e-5679a30cf40d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827090, "uuid": "c3dedf0d-17cb-40eb-9126-d5acf8b58b4c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d1d139-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849626, "uuid": "1ebb2c9b-8124-42fd-aa60-5a13b117bc37", "comment": "Malware payload (Mirai)", "value": "c502c13e7afd7f091e1ac68669afe4e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849626, "uuid": "19c3bbca-d943-44bc-9518-8d4a906c8a9e", "comment": "Malware payload (Mirai)", "value": "444149d2a724aa80a3607adba44c2f33e5e6b6649f2adffcae3f0d4ae5a45a3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849626, "uuid": "3794c2df-71bb-4485-a154-a25fce5f0bf2", "comment": "Malware payload (Mirai)", "value": "8611c331c9e9fbc1f0656e3ad55716a481fd9eb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849626, "uuid": "43a82e1a-036d-48fb-9134-dcea8c0cba2d", "comment": "Malware payload (Mirai)", "value": "5bd44c89f626dba83839172e6772c64330ae9d60a2af678d54102cfc5a4af15123ac920f6822afaed84d76a14fc584dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849626, "uuid": "1c327290-9c17-4bad-b566-364fbd13848a", "value": "T1A2C2D0E07726FE31C420AC3DE52A4D4A3951067C91FF393664258D398EC1A9B67F84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849626, "uuid": "76e8d5ce-7065-4318-9c5d-35f7c944a94d", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrgz9q3UELue:OKy4qfqoeJdXWggyLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849626, "uuid": "cf0c43ae-8503-4d75-9fe0-f4aa2b50d2be", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849626, "uuid": "46abd891-bf37-4bd0-afd8-4db967fbbfa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849626, "uuid": "1c8f320c-64e8-4323-9a7c-c8c5627d83dd", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877ad745-fff4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741861118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861118, "uuid": "123bdd39-a075-428d-90c5-b71f89b25481", "comment": "Malware payload", "value": "f71d8db7fda7659718330efcbd0776f0", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861118, "uuid": "04cef68c-3b26-4b0f-bafd-0d4ca3394477", "comment": "Malware payload", "value": "447433baf4fabb5b4271e16fc35c8b26b794759789b1abf37d3e3087046ad058", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861118, "uuid": "f7002878-2cc1-4895-b733-0cbf3694010d", "comment": "Malware payload", "value": "3647c15e9b4d500ed2944e82285dd597c5c8f25d", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861118, "uuid": "b3bd73b8-e746-4222-9fba-cf41e654040d", "comment": "Malware payload", "value": "010070002482fe81102b55f6b26d50bbe098438607d193425216e333bc322dc8a5c1ac69da4e167315327e60523b2e0a", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861118, "uuid": "d0e6c026-8c01-4b83-845c-ba1d83dc5199", "value": "T1D0F0C0D1CBB3312D7B300B81504264A8FB53C2870746045976DE87205F3FCB4A2546F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861118, "uuid": "a4b029ba-1265-4121-8503-e6d615dfcf0c", "value": "12:b/WF5RmFS4SkFBKOKzWv28hywRbHvC6GCWoClZvFF/XfMALWsWv:LTS4Sk2KThRRbHv4YKjNXfVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861118, "uuid": "b46ac3a8-9a5c-412f-93c9-2ecf13f2651e", "value": 549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861118, "uuid": "5f4e23cf-cffc-498a-a365-ebf6d12fbac8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861118, "uuid": "1835199f-2a4d-40e8-aa51-01056e85e372", "value": "447433baf4fabb5b4271e16fc35c8b26b794759789b1abf37d3e3087046ad058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0438889d-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (PovertyStealer)", "timestamp": 1741879366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879366, "uuid": "38fb7edd-08f4-41f9-b3f6-90c0548b288b", "comment": "Malware payload (PovertyStealer)", "value": "c3ed584247dd414bd9d9b0ae76ed283e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879366, "uuid": "5e69a9c0-4fae-4d40-ae6b-6a9be9389a25", "comment": "Malware payload (PovertyStealer)", "value": "448c63095e85a73417068e6efe7f2060a8d52f15f904a9ebab89748d717241ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879366, "uuid": "5801c52a-d211-4f5f-80b2-ded90bc5fbc7", "comment": "Malware payload (PovertyStealer)", "value": "8031d42ba060bb194315f1df1e937536f57557d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879366, "uuid": "d0c20c33-b6a7-406c-9a08-d7c73ea9f051", "comment": "Malware payload (PovertyStealer)", "value": "60e88f11276549984e8a06f346e26603de15d08030878ca43ea42d53918078bba33648d9dbbad82998c8513efa0a0d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879366, "uuid": "23d3efea-ff08-447b-89c5-3e4e8f61ab91", "value": "T190949D46BC92D0A3ED1628B25D29E7C50C6B6B244F3085FB7ED89D646FB36E14932313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879366, "uuid": "f8153342-214a-43db-8d1e-123bf2503597", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879366, "uuid": "3cc4bf07-6497-4405-9574-eeb4562bab94", "value": "12288:aIJQ/s2kiatVPnIpbWiJ621POPAANU/rJ:nBnIpnJhdQAANerJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879366, "uuid": "9284e912-5a39-45e4-b792-c4d8706a89cb", "value": 446784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879366, "uuid": "89a49f78-8b2c-4ec4-8016-638d4c444ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879366, "uuid": "dc35d751-bda5-4b1a-acc8-86dc623b4d51", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118c6230-fff3-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860490, "uuid": "6066f421-bb08-49f6-89d9-e139968cbca2", "comment": "Malware payload", "value": "24eae2bb569d97018d343fff50112dab", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860490, "uuid": "454062e7-1e1e-4962-b596-6de860c22181", "comment": "Malware payload", "value": "45383c88da59fcf6a69a84536b0488f4b7a8910a3ff76bf47424e21973c17dca", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860490, "uuid": "1c68ecbf-3b6e-4dbe-9437-0c46fc3cadb8", "comment": "Malware payload", "value": "d0362adb0cc9140859e14cd129cfe605105a5cef", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860490, "uuid": "7328a388-9069-4277-911c-e51ad7d11f06", "comment": "Malware payload", "value": "e347bb36344fa62e8fb48dae960367f227af9b4a9f39460bb4e0bc065ade0116df5636c1d4c8781f363107f6d73f0ef5", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860490, "uuid": "b300766a-6fd6-4723-a4a7-05ace19cf84f", "value": "T1FD927654CCEE297292F2C19C9933C103E644A6171F21AA63F7FC92542F78472C6B2B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860490, "uuid": "7e1a6e03-730a-454e-8114-3e725b42886d", "value": "384:6zkX8EI/PEJ895GMx96eH65ulgG76OzcGsypO:nMEwEY5GMxF2EgYdsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860490, "uuid": "960b471f-5725-44d6-9dc7-c684f625979c", "value": 19882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860490, "uuid": "dc68bae1-0e84-4655-9ac1-2143274bdf38", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860490, "uuid": "535ad9c8-505e-43a5-b253-07488d8ba8c6", "value": "45383c88da59fcf6a69a84536b0488f4b7a8910a3ff76bf47424e21973c17dca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243ba552-0030-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741886721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886721, "uuid": "58596a76-637b-4cf2-878d-a36f20acbbe7", "comment": "Malware payload", "value": "e638569d34af2d47d59cfd4cd7ff3d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886721, "uuid": "5106281d-9749-48a5-a8ea-eb5b37f9de4b", "comment": "Malware payload", "value": "4579fba6ad66a179b9a563083e5e404c57e424cd417e4b9df3e434b2ac2462e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886721, "uuid": "f1a5df50-5512-4075-ad8a-066dbb904b74", "comment": "Malware payload", "value": "513eb2eff65c0d7d0474d32a550aa6d53f5f7fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886721, "uuid": "c6e85afd-f324-4b7b-aaba-ecc3b56d6c74", "comment": "Malware payload", "value": "6cab1f21168115ca368013949a83037c18fce901c4dbe13328c313b64017d9a38c35db48a673891d6a598deca32d634d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886721, "uuid": "9dfb4979-79c3-42c7-b1c1-779a5339c2c4", "value": "T1D1373365855530F9F8A7097682A6811FEEF5BD640750C4EBC7994B3A2F130F0BA34BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886721, "uuid": "a5b549c4-0f1d-4270-8776-524b30a9a166", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886721, "uuid": "58ffc17d-36fc-4a09-ba05-7dd7565f7e1e", "value": "393216:iBVlj87dr9aUO0BmS5XMCHWUjzhEITENCAAL98Plyuir2FFWPHbwodaI89wKuWwa:+Vl8ZrsAmkXMb8zhPA5lyue2FFyHbwD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741886721, "uuid": "15cbd3f1-c9a1-4b3a-9439-2321477beac1", "value": 24233923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741886721, "uuid": "3983351c-a476-4e5e-9f93-c97f1e3f424b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886721, "uuid": "f1074a0d-11b4-44ce-932b-da9584316459", "value": "trioxidium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d12b28-0024-11f0-ad17-42010a9c0004", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1741881650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881650, "uuid": "566dfcb5-e4a9-4037-8c78-34aba1759ef6", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3669ae98595491c2086a340bdbdf1f5a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881650, "uuid": "095029b0-3dee-411d-9daa-5855c865c6e1", "comment": "Malware payload (CoinMiner.XMRig)", "value": "458b9ff1fe0f3f07462e818a3ff4c7bb2eee438a3b4587a260821a11fd3ffd66", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881650, "uuid": "ae1faa6e-9906-462a-bd13-5c5237dbbcf9", "comment": "Malware payload (CoinMiner.XMRig)", "value": "5ac444e53d4afe4f6974b20e77803e6bc95d65a8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881650, "uuid": "bbd6ca31-48e3-41c1-8495-67a9bb355d89", "comment": "Malware payload (CoinMiner.XMRig)", "value": "1ebf3d950a725cac8ed56fa58f17aba1a6eabac6e64f8bf2aba1214657c0cee6d7d87cfc6be9775b655554cd51bab8a3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881650, "uuid": "63d31dfc-a6d8-49e6-bc81-6ade55389afd", "value": "T1783723207989C436F9AE0170393D9F7A953E78610B7085EB63DC9E6D5E30AC19B31B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881650, "uuid": "66fc5c6c-ce1d-4a18-a343-a40bfe3d22b6", "value": "393216:rr+07grC8c76SP7/HMSxpcBG9KmctRTIKqLwki9Unp8DsjBg:rr+6BDjj/DpcY9gRsXi96p8gjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881650, "uuid": "c7d2c351-c3c2-4e1f-8378-003ccdb2a3c5", "value": 23547904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881650, "uuid": "426ebb1b-dd00-4feb-9a8c-86afe5c48f4e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881650, "uuid": "e1a3fb0a-dbf6-4cc4-9cdf-01de06f47152", "value": "458b9ff1fe0f3f07462e818a3ff4c7bb2eee438a3b4587a260821a11fd3ffd66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6310ae88-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860198, "uuid": "f78570a3-afca-4ec8-86b7-5df78b7e87d6", "comment": "Malware payload", "value": "a2d853247d939106231314bc5b233bda", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860198, "uuid": "7fa57650-c178-4790-adc2-5f90ef39a9cb", "comment": "Malware payload", "value": "46087c924131351976831d38a4f8a2beb722eac0b47026bb0961f01caf7a50f9", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860198, "uuid": "745ec4ca-0728-40ab-b4fa-f6fc709c0f61", "comment": "Malware payload", "value": "b3a683e5c18aaa741aee2fb35ec7fb3e0ad91f66", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860198, "uuid": "5321e909-ce53-4982-a7b2-cb16285360a0", "comment": "Malware payload", "value": "abe7a32391a11c25649010f3b8b5773af22ac6c9a4c9319dc3bfed2c464de0e5527f77ef728b8af524cff4519ae1c70d", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860198, "uuid": "68c13b45-7a22-4b91-86b2-577a92644541", "value": "T17B21CC82CC7C4876F6B2C2589C43E12472563513230A6139FE6CDDE97F8B16492BC8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860198, "uuid": "8fe14e46-4097-44f6-8cf4-916c79159e3a", "value": "24:9hQsKG9IcJeHVjugLdrmqtnHnifxL51z/qbkQJQa5Ze0uuSpZuSbEpNY:7hKmk1agRrPnHn8xbObkQJQwnz5P4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860198, "uuid": "31bfa0f0-9ca1-4f31-9c4a-789fa478ea45", "value": 1317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860198, "uuid": "668a1c0b-d427-4a47-bc0a-df88763a5b92", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860198, "uuid": "2a38514f-9200-4a77-a587-b77dd4f8d933", "value": "46087c924131351976831d38a4f8a2beb722eac0b47026bb0961f01caf7a50f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31db1c6-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864171, "uuid": "285ae6c1-a888-4da1-be8c-8f063b906372", "comment": "Malware payload (Mirai)", "value": "732fb4fe25414ec0f1fd0f4b45fcdcee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864171, "uuid": "5c4b9b0b-0787-4f33-8155-760f4c5bab04", "comment": "Malware payload (Mirai)", "value": "46136713cc7beead86b82785bd37a0aa7adeea3dfaa3c5b777a558d09554b6a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864171, "uuid": "29672920-392d-4ac5-93c3-b1100da4116e", "comment": "Malware payload (Mirai)", "value": "76cb1fb3086faf73d640739f42dee034162f4e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864171, "uuid": "a3458781-d6ce-4412-9fc4-4d830e905aa9", "comment": "Malware payload (Mirai)", "value": "2430d31333db4d102d9faf01d2ff5fc7a85711d754ee7a94ef42cf03ccd927ed1a63749b6d4afc924ec0291331618703", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864171, "uuid": "9096d134-cffe-4bbb-adbd-85184431382f", "value": "T13F33F17D5A014CF9E15DC93E99F0EBA5AF134A7A1D07DC68800FD846DC86498381FBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864171, "uuid": "5b80fc4c-fcb6-472e-8658-e4ad9adea0b0", "value": "1536:Xh2Bjp30ieWtiG6AautCS1aR5A25NwG4NsVJuu:R2NZLxtiGgYLsr3VQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864171, "uuid": "f3b3d857-0a39-4bec-a340-49011898230f", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864171, "uuid": "eaba7cef-dafc-4d76-8377-f92478f9ab3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864171, "uuid": "46746cc6-ab10-46cc-8c9c-cfe4fde66380", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f53848-ffaf-11ef-ad17-42010a9c0004", "comment": "Malware payload (BruteRatel)", "timestamp": 1741831638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831638, "uuid": "3e3b96a7-f131-4426-bf92-90e49d0494a2", "comment": "Malware payload (BruteRatel)", "value": "dd1686af7c0178fb6f333f94b3d7de5b", "object_relation": "md5", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831638, "uuid": "65255c61-5f8d-4f59-a519-35757e644ebf", "comment": "Malware payload (BruteRatel)", "value": "4749186ec02e1600ae8b8031478d7ce7074e96cf70de008ef0037f2d63e93647", "object_relation": "sha256", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831638, "uuid": "d265cffc-77e2-4b72-8535-59d2c3fcf387", "comment": "Malware payload (BruteRatel)", "value": "6712f52409f26caca85e2dac568c556b5abffb74", "object_relation": "sha1", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831638, "uuid": "004d6dd5-9081-4fd5-a4f6-37ebd6966b83", "comment": "Malware payload (BruteRatel)", "value": "68c9fa07bd90c2860a4b4d3def9362e983ba5933ea682bc67a41ae4bd1921870331fe04039bdb1755a9e47a1176e5d4d", "object_relation": "sha3-384", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831638, "uuid": "302eb53d-2a6f-43ca-be4d-591ba5a011a2", "value": "T190541287E551C0C8CCF7C83052EAF5B3BC383B5B06309AAA9A58E5342B513E57B6D359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831638, "uuid": "513d3354-a311-452e-a2dc-5d174e416f98", "value": "ecb712bfe0d1558ffce8f8c2df526278", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831638, "uuid": "5398ab88-e9a7-4f90-8812-586a9ede409b", "value": "6144:+q2UhPqeabCJNzgNm/qVoe93Zi861RyyZMAyqK2kY:DBhJNzOOQJi86Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741831638, "uuid": "8f3f2955-e035-4818-b892-44a7fbb48948", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741831638, "uuid": "1d347b2e-0f7c-4826-9f91-4d707bed334b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831638, "uuid": "52b19235-ef41-4621-82a3-c616f19cd5e4", "value": "badger_x64_stealth_rtl.bin.packed.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752fa7b7-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741825009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825009, "uuid": "28b10f9c-15fa-4c94-95f5-06c4aca8ae0d", "comment": "Malware payload (RemcosRAT)", "value": "50d53b600dca6399ef8e9ed198449a85", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825009, "uuid": "1dc0d03f-6a9a-44df-af1e-a5b40718feaf", "comment": "Malware payload (RemcosRAT)", "value": "474f1c4b6cacca4f2c6acabdd80ea7a6b3df97e31f3086f0ca822834710536b2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825009, "uuid": "d3dcdd14-a636-4f71-b2a5-1d9a7a0f46e1", "comment": "Malware payload (RemcosRAT)", "value": "9d579ed23ecc64954206e27e67a824a626f4370d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825009, "uuid": "9a31d044-c263-42b1-9b18-b5cbfde3bbde", "comment": "Malware payload (RemcosRAT)", "value": "ffc758da058480e4c9646da43488a3f82da3afb8b734b24cad0ac855334a048e971fb04cdb029441073b4cf82b28970f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825009, "uuid": "856c8a60-bac1-40fc-8a3b-9a6d19e6aad0", "value": "T1F76285646F1EFC749B50E0F294CDC0E6CC2D6BC500A02687F04C18F65B61AB8F4E91D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825009, "uuid": "8b55f043-3167-4cd3-9aaf-7e0f6505c13b", "value": "48:3m2Ml7mF2MlJzm7McozX+EyHCx7pyZULQ9RrZi42Ml52MlKma2MlnPG:pMpMwsl86OVQDMWMzMN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825009, "uuid": "8844d8d1-893f-4436-ba29-81c890c89a81", "value": 15034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825009, "uuid": "dc2db639-d9e2-498e-8603-e6f4113033f6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825009, "uuid": "f48abf98-e27c-4803-8c6e-412d46b1eab7", "value": "pleasemakebestthingsentiretimetogivebestof.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b1ca57-fff7-11ef-ad17-42010a9c0004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1741862452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862452, "uuid": "1e5f5547-77fe-4e5b-92cf-fc261e4316df", "comment": "Malware payload (VIPKeylogger)", "value": "bf51bf79a5fbc66902a8b62cabe50f57", "object_relation": "md5", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862452, "uuid": "84473d04-fe01-49d0-a7f3-7909f84363fb", "comment": "Malware payload (VIPKeylogger)", "value": "478c6171817035d5cf8828d6d75ed0ce79017f260f7cfff8687adf7d11ae44e8", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862452, "uuid": "cc871663-f77f-4212-9e18-1a80b7091aac", "comment": "Malware payload (VIPKeylogger)", "value": "82025d383b5a06714a6544d2ad13f14bacf38c6c", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862452, "uuid": "9dff1858-a9e4-4863-9baf-2b1d40c3c25e", "comment": "Malware payload (VIPKeylogger)", "value": "e18d453dc353cdb38805d1d290f176f8a6168132639de5f2c1def4f99c1da89395d36ab999996d09403f33fede562a67", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862452, "uuid": "3e6e6269-2a63-48e7-bdc4-35a22a7f3eb1", "value": "T11A04125C4D9D6E989FF204A650DB71B21F753D0DB0685EF32932EB83AAD9B090035BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862452, "uuid": "2024d2e3-682c-484e-86db-b9809ed23ef4", "value": "3072:UF1KDsesp5YjBTo1eonvU3E/zK7a5lgBDlZOvEK1aUKkZTjjM:nsx5YjBTo1ey9/mayBZ21HjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862452, "uuid": "106c5a94-c46a-46aa-a3f7-ff313d1f9af0", "value": 184464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862452, "uuid": "2fb74bc4-1fd3-458b-915a-a41102d0cc21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862452, "uuid": "3fee66e4-5962-40b7-862c-69283890e52a", "value": "SOA Since OCT DEC 241738316681530012900.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad7f09a-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825019, "uuid": "01f2c764-ed9c-4b0d-8160-601af6789aad", "comment": "Malware payload (Mirai)", "value": "e9fc37bece51722f5f01a51e87c7e59e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825019, "uuid": "5f021acb-d1eb-45c4-b426-c9b06e111407", "comment": "Malware payload (Mirai)", "value": "47b69e95df3820c448dc75fe83b756a46be860386584afdd54c75dcf2ec713c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825019, "uuid": "8fe0d55f-9d69-4216-b5a3-b058a21e209c", "comment": "Malware payload (Mirai)", "value": "d8f76d11aeb1f45a0a2b5ad83edf786bffbf8ee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825019, "uuid": "84e3a247-54d2-4df5-b694-4651e4285927", "comment": "Malware payload (Mirai)", "value": "9d5da5d00d8efa34e5e9d3146f8732666fccb96d2aaed21a9aaaadcab7d865d64f52485e6556ec675a46a3f3248943b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825019, "uuid": "b3f44006-5d82-4e4b-869f-77d90a5ba0d6", "value": "T1C8433A787605B26CE9F54078F04324E62C220B9833DCF6D361F345B5BE74649BA5AE2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825019, "uuid": "09dadcfc-2213-4967-8a4d-b38ef02b7035", "value": "768:SAhdtkXUooIPCco3X2vzPEYeCHPoa2xN1EThGhyRhtImaaeplYOZD10UN7:zGkoTPFAWjSiThGhyRMbrYOh10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825019, "uuid": "442bf622-2171-4786-a9fa-739b718bc8b1", "value": 60084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825019, "uuid": "a9acda1f-f20c-4f6d-97e8-9bef78eb68c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825019, "uuid": "831f78d4-cd93-4c1b-a31a-5a4dc3bf7243", "value": "FederalarcAgent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7e90ec-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1741824998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824998, "uuid": "fd3c31d9-a646-4f05-8ff7-a2b6588218d7", "comment": "Malware payload (Hajime)", "value": "fbc2d08bd03adeac9b5679d1a575459d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824998, "uuid": "32e2c17d-4def-495c-84e0-9b66a6bbcff4", "comment": "Malware payload (Hajime)", "value": "48663db0ebda46d5388ef11669f4c12da221efc84a7a58024aaa461cfa04326e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824998, "uuid": "56ba3dda-8f92-4fba-8ed8-a298bd3d65e2", "comment": "Malware payload (Hajime)", "value": "560a4a3d569cc74a9ce5534a4d1721e5e05155cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824998, "uuid": "9bd0ebfb-9096-4abe-ac94-e48b62baef4d", "comment": "Malware payload (Hajime)", "value": "f74629a5893d3e8ea3c53aeb45fc104f9d3cab7a070cb8dc22936cf3131de483f1290296f0c9ad82c9a2f3bb5b9f0155", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824998, "uuid": "993265ba-40f1-44d2-92a8-25f4d4d344da", "value": "T1FA831229135524E5D62280F1D7FD1F84AE591F698EE2EC15BC11BC99DE333AD2CC2A18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824998, "uuid": "0dcf14cd-109c-478b-97ec-efbb42b0fe20", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+u8:yYI0ARqw1qAEv7UIFM8oJorFquyjkRk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824998, "uuid": "c3444367-ef1b-406b-a972-ee3848dee925", "value": 82128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824998, "uuid": "bb338698-a640-4087-ac54-e657ef2a1c22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824998, "uuid": "104b11fe-46bb-4cda-bd02-3238c62af001", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041fd044-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830403, "uuid": "c304cb68-98b0-42ff-a089-d8bc4d5c4e31", "comment": "Malware payload (Mirai)", "value": "76e300db1f5c3e6ab9376ff88b05c14c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830403, "uuid": "5ae3754f-a02a-4f2c-875a-52855574af6b", "comment": "Malware payload (Mirai)", "value": "487c14ae49f60965ee327203c8379e7fafcb55d576c367f6cac6e40399c8f611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830403, "uuid": "84a60d1a-c067-452d-b3d0-cc0b66095a56", "comment": "Malware payload (Mirai)", "value": "604137eedb0e479270c67be0bc79b4f52bb05b97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830403, "uuid": "9ab1d789-98a2-487f-9332-7379f3eef469", "comment": "Malware payload (Mirai)", "value": "ed1d1951c0f8ba93eaf59b609f55f4e9e46b150bbf89cf1c7c35655bffe79cc7d7c5e37bdad296e33da8374bd6cefdc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830403, "uuid": "7f9cddba-2581-4dba-afb6-ccf2fb0bebb1", "value": "T1CE333ACAB6029E7CF89BD6BE80234E09F63066415093173677ABFDD37E321649D12E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830403, "uuid": "3e4c4460-bc32-4413-8e57-879130d106f5", "value": "768:oleimrwVywaJXV8dQbLqxYKhLRDDJKh/2072NOJiPxw92Ptt38+L:GjmmywoOJe/2028iPxw0Ptd88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830403, "uuid": "71f06b1a-2047-4970-a7aa-f227c38796f9", "value": 53160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830403, "uuid": "bf8d6c7b-0df7-48af-9465-13bd82c40631", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830403, "uuid": "6c476543-8902-479c-bc8d-75e70b6096cf", "value": "3atoNational.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c6df58-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848715, "uuid": "fa243f3e-3ee5-4600-8e0e-35e25f9b4f73", "comment": "Malware payload (Mirai)", "value": "7be102612d9dd3e41e355af2bbea1ee9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848715, "uuid": "22debbae-0c8d-4713-9178-bb680ffb8ec0", "comment": "Malware payload (Mirai)", "value": "488cbf76213faa8ce06749982c82ee9da6fdcb91c40f2fb7c2beaa366055a389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848715, "uuid": "dc39c7f5-5f90-4208-8703-1c355b88a709", "comment": "Malware payload (Mirai)", "value": "045952d279f5bd9e2fd75751655aeddcf2edec2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848715, "uuid": "3ac3b4df-efec-4788-9d11-c108b4c9db2e", "comment": "Malware payload (Mirai)", "value": "3f621643f7be7fdbc2bff73fa9073cca530e8b32318daf4b6981f9b7fd2fa6d191c736099f6f29f38a39f50e4aec2b16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848715, "uuid": "3a3d2e2b-0023-4bb2-b5a8-f40262903134", "value": "T187738F31D41D9AA0C1DA01B4E8E9CE380F13F1C993A71DB66BE24AF2584BD68F515FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848715, "uuid": "77a8b918-0a3d-43c1-8481-e22ee2151fe5", "value": "1536:6/cHqzLpakTnjX7lKwtFf6AsgjtYfBzNj1EVfCNS:6kHutfTT7AG6lgSfBzNj1EVfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848715, "uuid": "aebabb08-dceb-4826-ad70-87b23f840f6d", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848715, "uuid": "b419debd-7f9f-49e1-95f8-5dab154c2f13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848715, "uuid": "c0edf6e9-f51d-4571-b0bb-8ff83ca732b2", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a392194-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741879376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879376, "uuid": "1362c8d4-b1cd-45d0-bd39-1cde34359dae", "comment": "Malware payload (RemcosRAT)", "value": "d249e2b6f10508da70305bb27bbf43e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879376, "uuid": "00672afc-602a-4a4b-aebb-3344a346c7a0", "comment": "Malware payload (RemcosRAT)", "value": "489a4758ea8e46736dc0f67da790eeba6d5244de889dcee5ff49dcd6e9929736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879376, "uuid": "b8864fc6-ae71-4dcb-947b-6551446d6de2", "comment": "Malware payload (RemcosRAT)", "value": "9a9948c0c7d4d90b2ac21925ac73372ac265fb99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879376, "uuid": "8c876104-33ac-40fa-8c72-c0d941cf5925", "comment": "Malware payload (RemcosRAT)", "value": "221085509b4421fffeff0b43963ef0ceb5da0990caa8f5d0c03e1ddecb050d0064fddcdbd22e23abcd6c5c7a31d14ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879376, "uuid": "008c2e48-b2f7-47ad-8b1c-179197c4deef", "value": "T129B4BF01B9E2C172D57654300D2AE776DEBCBD2028358D7BB3D60D57FE30190AA39AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879376, "uuid": "9521337a-3cdf-4703-af3f-6f4afcb561be", "value": "41e05d591d7d93bdd5bc6d5da04da74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879376, "uuid": "094fb21b-bdcb-4eff-a27b-8b660e342983", "value": "6144:nIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6oJ:n200OFp+G0imvHn3Cp6qyBP+YdsvZGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879376, "uuid": "457adc3d-fae1-4abb-b0dc-ef7903369e29", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879376, "uuid": "646274b8-f2f6-47c4-a3ef-e5180f963233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879376, "uuid": "0bcbd2b4-1ec0-4f8a-89f4-a959db67b822", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a15d960-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860236, "uuid": "fc874f9d-e009-4739-95a2-f9a49c6e5d54", "comment": "Malware payload", "value": "241d01f08172a117268eb0f223348e47", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860236, "uuid": "d74f68a5-1e95-44a3-9dff-9f030755b73f", "comment": "Malware payload", "value": "48fa4d2a7fa3aba03305ee0a6edd5d8e8e3fb2e978436f23419f83204a42e6e5", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860236, "uuid": "55ce650b-0a08-4b83-904a-c66a01782099", "comment": "Malware payload", "value": "2cc2c4a6e55db1cdb96e15a29eaec90f1a3b04e9", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860236, "uuid": "5ed6c64e-44f1-446c-b934-401e60c7ab74", "comment": "Malware payload", "value": "a4f5cdd339892e9b009e7a9699785698cb2f17ae680d120265461ac7c24affee787c27769fab10543c878a75567cef28", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860236, "uuid": "6d2cd2e2-8e21-4c53-bd0a-df25da1e274a", "value": "T1A411BD52ACBA10D867330A4116036580D23621872B27990E3B3CEBB49F785D161B23BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860236, "uuid": "713d861a-cfcc-44b7-ba67-24a9ff6cd2ef", "value": "24:L9wtb6sZhfxi8QflaefAZzOlqe/AYiZWfkb00:Zwd6ahfYxflaAAROlqVYi2kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860236, "uuid": "84ae2886-c537-4a86-b6d8-cba91c0d96d2", "value": 987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860236, "uuid": "5b5c137b-d9ee-47f4-8b5a-da6b21d3a532", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860236, "uuid": "918e08cd-1087-4d05-8b46-df81224e0c29", "value": "48fa4d2a7fa3aba03305ee0a6edd5d8e8e3fb2e978436f23419f83204a42e6e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a51c94-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825017, "uuid": "a12faa88-9766-4a43-95b4-8cd9687b2b30", "comment": "Malware payload (Mirai)", "value": "2f7b5d6f509e2d81355e7db481be1007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825017, "uuid": "7ed8a86e-7129-43ea-bb06-4d7098cf3fa6", "comment": "Malware payload (Mirai)", "value": "498f091dcb415aafc587b7a81ab9b291c1c49cfc97d9b80422a4dc762bb1cbf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825017, "uuid": "2a5ef416-90ff-4d74-ba69-0220c23a0039", "comment": "Malware payload (Mirai)", "value": "d29f27c7435efdf2b48b3c97f6e657a7d6731d30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825017, "uuid": "858ad0f9-f87e-4ddd-ab3e-64dcdb30d765", "comment": "Malware payload (Mirai)", "value": "96b95b7504571aa0b32d1693fb08bd39d79794b060f0e2369b2c9096c4366b6f54b601f1e0269fde580a246178230fe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825017, "uuid": "f11bb476-3716-450b-9056-2e5008f2ce78", "value": "T16CF2E179A8F84C51DEFB90F61CDDEFC013A449CD39A896E29298CAB27106F11B564DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825017, "uuid": "2f5facf8-e379-4861-834a-6bb62dc38a3e", "value": "768:WWkw0aCi/RvFoW7/I2JIT9nizh1JEL3U5JP5LfipmnANz5kb4uVcqgw0retn:791cRnizh1JEL32JxLahyb4u+qgw0rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825017, "uuid": "a58aa9e2-fb26-4ee2-86c2-1b19a2e67b61", "value": 36772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825017, "uuid": "13ef67ac-56a6-4037-bb07-3e1acff90568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825017, "uuid": "4e0de42c-7ec8-46f7-bb9b-86c50458d2eb", "value": "FederalppcAgent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02992894-005a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904703, "uuid": "33940394-f204-479b-b745-fe30e1b194f6", "comment": "Malware payload", "value": "96a01d8c3c51c7eea516ff9c7f0f1f6e", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904703, "uuid": "c4e3bc6e-a2e5-4274-84d8-55440297260e", "comment": "Malware payload", "value": "49996ff62ed4a427c0123a7087e806c8227f0bae7eaef1772b1fe630c06d02a7", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904703, "uuid": "19701c30-444a-45bd-9839-c24011db7534", "comment": "Malware payload", "value": "2219205b1435896fe2e0aa11de4f1d3706a5e291", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904703, "uuid": "acff7ec6-4142-4faf-b99e-4a911601ebdf", "comment": "Malware payload", "value": "98010efcaa0ab2a530df0e7308b9d18168c7ae482feec0fa9ac37b733fd86f6851dd5dd9c434735040c7d11698183647", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904703, "uuid": "6d5f107c-d5aa-46b9-aad8-1271d1a425af", "value": "T1349502129E71DA6ADEDD23F618220F40BBF54B9F4215F7430BFC60F68A8774A52A4943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904703, "uuid": "308e2580-06a8-47fc-8aac-0b7abed09b27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904703, "uuid": "0e362187-0f5b-419e-ad6d-a0fe1f9343f7", "value": "49152:x/acHU0diEXHOJjx4AQBxSJ43jScahXL/a3:x/jZwEXuJjrQ/SfXL/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904703, "uuid": "8d909ab6-d785-49aa-80d2-72da6472b55a", "value": 1926792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904703, "uuid": "718665dd-ccb3-4f44-8d33-1e543ce88d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904703, "uuid": "b15c3da2-be9a-4ae9-b213-7d7198dcb6df", "value": "Vision Wallet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc60570f-ffea-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741856911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856911, "uuid": "09293173-3739-4f92-aa48-c0eec0b69150", "comment": "Malware payload", "value": "0fe07cc29ce9462b1359cd61b92037ed", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856911, "uuid": "1dfddfdf-130b-4c3f-9ef0-1cb18534c8e7", "comment": "Malware payload", "value": "49c969c75afcdb451d80513de956acaacbc2abf44279040cabc1c390800dcde8", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856911, "uuid": "c94b7f76-e642-4519-89b3-bf60290d4193", "comment": "Malware payload", "value": "1516fbab22b56c35cd7f6c6ccbec7bb56a21ed76", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856911, "uuid": "01053a3c-9bf6-4113-8da6-52946099daf3", "comment": "Malware payload", "value": "0d08b126b92797edbe75c3cb059e05d6191b03e371a45cf68950a409a58177a88107482215a9685bfcf1f50e6184e27b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856911, "uuid": "ef25ec0e-9f0e-46ba-87b7-abc3d178b465", "value": "T1ED24AC936B8D01D5ABAA3B05048D3A1F14CB94CC2EF1CCF29DE7B83433AD915A9571B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856911, "uuid": "1a1c2257-6635-4d1b-9ec4-99e714b7aebd", "value": "6144:ej4ZMysaPZkBstwXy3du4558tvpGKpdYhub:t8VylGpGKH4ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856911, "uuid": "6c923c71-8ba2-446f-a452-64e5f949e138", "value": 223322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856911, "uuid": "f4fb80e6-0c0d-4c49-81f0-d98873d9f08e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856911, "uuid": "fce19bc1-bd75-40dd-ac98-159e728a6eb4", "value": "02.08.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c4a849-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741873199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873199, "uuid": "a48a707f-2b51-4204-b4fc-469abc246857", "comment": "Malware payload (LummaStealer)", "value": "a381c8fda83e98d25b7bc0dc8d2f6113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873199, "uuid": "3ddbbaa8-8619-40de-9609-6449f0f26163", "comment": "Malware payload (LummaStealer)", "value": "4a1ec80d6a3a9c63458730e025b12a050f7d73fb60eaaa39df3ac858e54280ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873199, "uuid": "c8b7b043-3df9-4b90-adb4-4181f8b3f8d9", "comment": "Malware payload (LummaStealer)", "value": "f51a6b364d11047cbe38d70ad6179565ff69971e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873199, "uuid": "39db1398-9243-426e-876a-6a465f34f13b", "comment": "Malware payload (LummaStealer)", "value": "863d8034c92c383b0a459258d0552c283fea50c192845769b5d7fcbc0f7a4f9b39af6f52238e5708aed60bcdbe0df950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873199, "uuid": "139cdd20-062b-4410-924d-30dc957a663e", "value": "T12455330A450AA60AC9632F72076DC16D6213EEFDD24743577CC3DACA7428F587861EEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873199, "uuid": "679fde88-53b3-41ad-a53c-ac25614ecaad", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873199, "uuid": "2a070989-c2c0-4ccf-8f32-96588cd52696", "value": "24576:2vLt1x6Q9bf1GdofRx9XPdtIxvKD1sKZQG8xXn2C3GRVh8vB:Is+1GdofRfTSK2zZ22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741873199, "uuid": "58a927ca-e343-49cd-9739-6d95cf04c03e", "value": 1317888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741873199, "uuid": "4dab2156-c2e7-4dc9-8ce2-7c710edf0d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873199, "uuid": "13ad6af1-7e4f-4e09-be5a-69f139d3270d", "value": "kmtsefjtjha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212bc5d3-ffe2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741853215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853215, "uuid": "3c0115e7-bd14-4aeb-a7c8-9a0938f8b2cb", "comment": "Malware payload", "value": "e0bc0dc84045b9c6c1096a26f4c49f88", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853215, "uuid": "338439e4-2bf2-4642-8547-1a83bc839488", "comment": "Malware payload", "value": "4ab7615461dbd560a2229a1759b06037efeb6325aca8638238b51ecb5da17b70", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853215, "uuid": "a8318ae0-ec00-4444-939c-0dcbf396b91a", "comment": "Malware payload", "value": "872df428d68c69e1229a1ffab45b7defe85729ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853215, "uuid": "1d18cc8a-c68d-4520-8339-85a9616f9a0b", "comment": "Malware payload", "value": "219e81a1985c3c223317d4193753d3705737d7acf717f9d943f5bc3c703139ca60230456a9a29336acb43a42aaa15ecf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853215, "uuid": "3764d6bb-0536-4910-97b8-8026dd9d8574", "value": "T1E0D0A75DFD8308F6A03ECC6BB7E73CA5210F121655066A0C52C64116A4B4C90A4C19B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853215, "uuid": "955a6a1d-86de-4c50-939c-3e15b269bf7b", "value": "6:/VJqq2VYtBLdY7YCo3FsDKVKhO/+vOZQiOe1IKBKW:/VJH2CpY7YWWghxPiP8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741853215, "uuid": "c6bb0cb1-840e-4038-9bea-2687fa80dec0", "value": 231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741853215, "uuid": "1eddffa8-fe89-4d71-85c8-76a73737078a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853215, "uuid": "7cbe7ad6-b53f-483a-8648-128fc488a391", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ce51f2-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741825010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825010, "uuid": "a5ffe111-b8d5-4915-9033-d496e96f5804", "comment": "Malware payload (MassLogger)", "value": "7c7b7736fd7286e02a2d2b8fa534c43b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825010, "uuid": "43997d27-52e1-4d8b-a424-6b462064c8cc", "comment": "Malware payload (MassLogger)", "value": "4ad94e45fdf797bcd666aa0de12c32a3f59d46103b7053d8fb94428a59478481", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825010, "uuid": "4fcb4355-4f6e-48f7-bebe-7c49cebff434", "comment": "Malware payload (MassLogger)", "value": "ba864f100c8ff38d4ca4b344050760863a33a24d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825010, "uuid": "5565532d-e1a1-42b3-be88-cc81e2c4d6d7", "comment": "Malware payload (MassLogger)", "value": "2756f1019c983c433d326a5d1eae5c7d1cf0051497c00104896120009b81678fe7445954d3e83e7a6e85dfded302e7e1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825010, "uuid": "381ffa1d-2a27-45a3-8fa2-c4c3bb0aa248", "value": "T14462642A1C19AC4CC322CD00B5DCA4E71AADE37E91555491F19E9C1B23B0C6EA8EC7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825010, "uuid": "6cb4ec9a-82fc-4ce8-bf9c-d2fd63d57c48", "value": "48:3ymOYNcEmOGT6Nco4bgzntij99DdPGAOrphMRrmO3rmO2QwSKNcYQmO/G:CmOucEmObcB0zofxGr9wmO7mOIcRmOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825010, "uuid": "7f2b34ea-4a08-41c8-8dd0-bbd0c22bf3dc", "value": 14878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825010, "uuid": "fb2932a5-a80a-4332-adfb-34f7ba941c73", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825010, "uuid": "0f2b6ea8-c7c4-44d5-84ac-48ece3d1e343", "value": "wecreatebestthingsentirelifeforgivenyou.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6204ba50-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741882959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882959, "uuid": "0571e948-823a-4bdb-bb1e-9960d20bc67c", "comment": "Malware payload", "value": "459697ba8c760c82c9d2c84e2ebedd8a", "object_relation": "md5", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882959, "uuid": "6f9564fa-84eb-4ff4-92a2-1b5b6b0cc112", "comment": "Malware payload", "value": "4b4c1064e3994b59904749fb706c8dfdcc6a50c203694bb45a6d1b4ce11795b3", "object_relation": "sha256", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882959, "uuid": "6bedad16-d7e7-4ae0-8521-cd0dbdee1183", "comment": "Malware payload", "value": "e7f531016d07ca6c8332e9a4071725a21837be40", "object_relation": "sha1", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882959, "uuid": "72e785d1-8eb7-4024-812c-9fcb68d5b956", "comment": "Malware payload", "value": "0cc0c16b2b86bebb5b248fa644997f5f4e374506324839766ca312b6dc4b111f1495061448d479c0f24e79c5592a6ca9", "object_relation": "sha3-384", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882959, "uuid": "4f4e8f57-4ec3-41ba-96f0-7b418ac6c08c", "value": "T1A0273363585A69DAC072A435947EA34478B8CA6B3BE3A7531014EE77D1F3460CED8F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882959, "uuid": "33602af6-89f3-40d4-b911-ee35e47deda2", "value": "393216:3xMU8OOsJA35z7A79L+eA31mbgafiubcEZrbRT9i/zVN2I+TXOlyKpPbNiRSKcsQ:32oJA35z7c54FmbBffcGrLi/zVN2Ik+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741882959, "uuid": "643e6681-73b4-4891-9982-df43402fff5c", "value": 21850990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741882959, "uuid": "044415d0-832d-4554-a140-67a6459a087f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882959, "uuid": "188b3693-b0a9-45e1-b6a6-a03459a67942", "value": "a.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c49af42-ffbb-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741836430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836430, "uuid": "54dffde0-484b-4385-af31-fa0df6e8fc4a", "comment": "Malware payload (LummaStealer)", "value": "5af2a694fc02e5eada800c78bf4939db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836430, "uuid": "b8c1639c-5fd3-4278-b311-41f77268286c", "comment": "Malware payload (LummaStealer)", "value": "4b8c8a5014c50cc7aec2bf38e474caf10c7c2ef652aec253e67e4a5c1e7b59d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836430, "uuid": "aa6668e9-1fef-474b-b5ff-2d1adfdcec08", "comment": "Malware payload (LummaStealer)", "value": "876249734a971ebec3cc38b9d68b0b3527b8e126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836430, "uuid": "24c7f9fd-572e-410d-af0d-9b8ff00408f3", "comment": "Malware payload (LummaStealer)", "value": "46e44ffaf25d95b42b6fe03781bbd2de7b651fd7ea5381df60a2735dffd39b63872a4f85d532c7cf02e08de7d8fde15a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836430, "uuid": "b42219bd-1819-4be9-ab8e-0335af879292", "value": "T1BAF4D046BCA2D0B3ED1628B11D28E7D54D6B6A244F20C4FB7ED89D646FB36E14932313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836430, "uuid": "c2784b2d-89ed-4588-9f39-acb081e689e4", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836430, "uuid": "7029d9e3-6966-451a-8f9c-f45a56ed3e0e", "value": "12288:mIJQ/s2kiatVPnIpbWiJ621POPAANU/vFwdOalD2jZVlLHr1h+Pgze/51NXL7E7H:bBnIpnJhdQAANekvDI/vGGeDJmDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741836430, "uuid": "64db0c88-e3d9-479b-ade3-fcee815b9f51", "value": 779584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741836430, "uuid": "da48c83b-4e13-414e-9c62-0c4c88edf8a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836430, "uuid": "c86ea0f4-3530-423b-bc73-3d3e29265c47", "value": "ModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a5df97-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741873219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873219, "uuid": "876d3b03-4f7b-43f4-bac8-251cf3e606f3", "comment": "Malware payload (LummaStealer)", "value": "b145d8cdf76ef5fe1b151fb42ee5fcc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873219, "uuid": "e5a6cebe-f198-4541-a699-b2f21a89d72a", "comment": "Malware payload (LummaStealer)", "value": "4c13ebe1361e08fad18d8bb5ee8377d0518ce03a2592b5784e023703d2e3ba9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873219, "uuid": "86fab9af-d954-496d-9323-a2a6a6fa6d6a", "comment": "Malware payload (LummaStealer)", "value": "cf94af9e8c0e3d6203b3bde36396a4adade7bd90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873219, "uuid": "6fa4b6ac-4978-49d1-80da-1d37eb6c3d3e", "comment": "Malware payload (LummaStealer)", "value": "d7a88c0ea7077b46ae7877d5afa07dd30e683d3e29f13bb855849f973ca53f1bfe8dd291f19e6a34bbf76abcc5a4320d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873219, "uuid": "f438d141-e126-4fc7-99c3-80d9d5441c65", "value": "T14B55332B73E70CE3D8BEC87AE5609A5412741B9BDB4AF5A85D485C7C98257CE18333B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873219, "uuid": "cc49cd4d-8828-42da-a9a1-a1239518f260", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873219, "uuid": "1ffe11f0-c172-4d8d-939a-2747880500c0", "value": "24576:uPoUeGkMK+1OtjY7c3XKW1tbdhgfOGuLBxm3lx5nGpPruIarKw+mAcumfD0Oq2l5:uQNPjptLKYXcNuLOjkiKw4cuw0O/l1O8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741873219, "uuid": "bc9ef943-68cb-4fd0-afa4-427b8e09cd5d", "value": 1315328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741873219, "uuid": "e058f2bb-25cb-4f7b-8585-be5dc549fdf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873219, "uuid": "edec1e6c-98da-47c5-90e8-5d914522e58c", "value": "nyojpsdfkawed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2458ff02-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (DiscordRAT)", "timestamp": 1741872977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872977, "uuid": "133928b4-c84c-491d-b13e-8079af092364", "comment": "Malware payload (DiscordRAT)", "value": "88ddbc67e050ec95878efa4386608626", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872977, "uuid": "5cd1a64c-7292-4127-b364-067900ad4488", "comment": "Malware payload (DiscordRAT)", "value": "4c55b60b85820f9dcefb9998eea8152026496c3648973b5f1c85f05fb09d7e1f", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872977, "uuid": "d34171c4-2cef-49da-a50b-41b7c88a315d", "comment": "Malware payload (DiscordRAT)", "value": "f1f74058eeb5d8504fb879a7ae4505acee718fe2", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872977, "uuid": "376148b9-8890-4022-8108-9f86adea9e6d", "comment": "Malware payload (DiscordRAT)", "value": "706e7688472000daf9f752ca3e7eb3c75d6fee8c9f21e4f5f8febf7e0bbdc89855c3604ffacd357d9b7dcf81b6938d86", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872977, "uuid": "993abe0e-d3e8-4456-b212-8ec80cee2ebe", "value": "T18F73B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872977, "uuid": "f209ac67-47cc-482d-9fbe-f41fc9e64910", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+uPIC:5Zv5PDwbjNrmAE+KIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872977, "uuid": "b6f9e281-e95f-4596-904b-436ca01c296e", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872977, "uuid": "d66dc146-7757-4c74-a03d-547ce553125d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872977, "uuid": "8fc4a6a9-6409-4b22-b150-c11210c13a72", "value": "nude.jpg.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b580add1-fff7-11ef-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741862483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862483, "uuid": "3bc2b587-f1fa-41c2-9b98-197a33b11446", "comment": "Malware payload (AsyncRAT)", "value": "15aeb31c2188fdc36850d3c9cf7eb7ec", "object_relation": "md5", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862483, "uuid": "b136810c-bdba-4aa4-8f71-02cc032e6374", "comment": "Malware payload (AsyncRAT)", "value": "4ca19bb2477c35639dd181d56d5d51319d6bc9d4e14b92264a5cbf000b2fe42f", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862483, "uuid": "f32a24c2-7687-4d01-b106-865a92869401", "comment": "Malware payload (AsyncRAT)", "value": "3b7d7a3c809ba827742acec23bbd970c32cc921b", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862483, "uuid": "26eccffe-94b8-4f2c-8161-175766ff656e", "comment": "Malware payload (AsyncRAT)", "value": "52eddfdf780567b5fa09e6d9bd8a303a140fa0740b11dd55496348f9711c2a04c300cd34e18b3c29362f75a978f889b6", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862483, "uuid": "ed112363-705c-45de-ac50-f33ddc826221", "value": "T1AAE23A4877D44712DAEEAFB12DF362061670D517E813EF6E0CE485EA2B67AC047407EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862483, "uuid": "30a93a91-c7c9-428f-95af-31471ca2e654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862483, "uuid": "a1944ba4-347f-4c96-af50-c39058f39c89", "value": "384:dEbmX5Qa+vN1h1+X3v6JFjL+gy3Tm2eaFObpzRApkFTBLTsOZwpGd2v99Ikuis6g:OVa+vNtg+PBy3Tw42pzVFE9jPOjhnbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862483, "uuid": "17932faa-17b2-412d-989a-a49ad1f85158", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862483, "uuid": "c8e6bbe7-93d8-41f4-bb36-40fd39764b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862483, "uuid": "ab66e168-ccd9-4ddf-9ad8-7b5237dbf47f", "value": "clouds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b260920b-ffbb-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741836708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836708, "uuid": "608b28cb-285d-41b4-ba01-f47280e5b59f", "comment": "Malware payload", "value": "cdc62f9a3ce4092bfb803dcaa35fb3d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836708, "uuid": "a32a6c22-fba5-4f94-8809-29b7d6429fef", "comment": "Malware payload", "value": "4d712120b5e81eb096dbf121c39232db2dc527513779c6a9727844886a910223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836708, "uuid": "cabbb874-8fe9-4ef4-aa84-7ca74d5988bc", "comment": "Malware payload", "value": "313c9c7f1964118b27cd249a2e86073388cb4aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836708, "uuid": "0981759a-b7da-456f-b929-1d381384c71e", "comment": "Malware payload", "value": "4f059998cb08539bbbaf677ef5415c5f435300afe130891ee2ee11fa393bf82ace5d59bc2b8b6f3b9b6bdb8c46f465ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836708, "uuid": "d6ceee96-870d-4e5d-84a4-b934508b15b7", "value": "T18FA6233BB268653ED8AA0B3205B39350597BBF65B81A8C1F0BF0190DDF768611E3F615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836708, "uuid": "a4d4db55-eeda-44df-a145-335103e7a533", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836708, "uuid": "9e47d1a9-8c49-4bf2-bd92-bf9dc5e5c26f", "value": "196608:L7B/ZFYKbLm58vDMzmLK35d+s99EbrZUivZyH7gH7o6Ge:L7B/HYKbievDm35d+qibeskHMH7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741836708, "uuid": "8f5a2cfa-1a9b-4da9-a2b5-0b5bd9bba84b", "value": 9927575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741836708, "uuid": "7f582f18-bc42-432b-be19-98ee8e33332b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836708, "uuid": "d83c12fa-1d32-4e27-b264-c507ef74cb23", "value": "HitmanPro pre-patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8ffad9-ffa7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741828001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828001, "uuid": "8a7ba4e0-fa4f-4aab-af7f-25f71124505e", "comment": "Malware payload (Mirai)", "value": "f3e9f35bda6b6de57cba0576053d848f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828001, "uuid": "9bb1df5f-22bc-4389-9973-3bdfb24aa1a8", "comment": "Malware payload (Mirai)", "value": "4d82795ca78160e7f5a62ef6d116aa236f9cef71ad31032cfc0d3c4134a66e6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828001, "uuid": "cdfbfc1f-5590-40e2-81d0-3edd6f72c661", "comment": "Malware payload (Mirai)", "value": "42eeb5ee78c759fabce48c72a522ec3ccbdd1047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828001, "uuid": "f9ba83b1-940b-4378-a00f-a8e755983e2c", "comment": "Malware payload (Mirai)", "value": "699dd5173605a58bc22298e70deccf79938cb61633c26683c221c2683b90cc54916d809bceda3b46bdd1997962183520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828001, "uuid": "74a62941-45e6-4128-a272-5768e6a814d8", "value": "T16A6381197F650FF7ECAFCD374AE9174620CD641A21A87B397A34D818B20B64B05E3879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828001, "uuid": "797e289a-2f12-48ef-873e-fd3a840e3e05", "value": "1536:EJ7dZCypJ9KoNPsOQJpLSXaNgQdsWWj4MLZLd6s:4ZZCypJ9BsOy44u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741828001, "uuid": "29281644-10b2-483e-a47c-10342c3c6d55", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741828001, "uuid": "851b8aa2-55aa-4a48-86bf-f5fe93728193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828001, "uuid": "f6acbed5-7bf6-4f53-a9ea-03459b175d0f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c490ced5-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849624, "uuid": "baff09b0-385b-40eb-9149-14263112282c", "comment": "Malware payload (Mirai)", "value": "f718d94d087a7ddff444730c6aafaca4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849624, "uuid": "0ef258fe-5d7c-4a94-8213-f2206c14c9c0", "comment": "Malware payload (Mirai)", "value": "4e12935faa06eafdc477fae55c95fd1470cfdfc6bdc384966ce50f7208a784a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849624, "uuid": "2b16d23e-9174-4012-82df-46f0877e952a", "comment": "Malware payload (Mirai)", "value": "f40701810c0636c5a6f69c5a2193778baa8248e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849624, "uuid": "bd01bc8b-037a-432c-9cc5-5123081e613a", "comment": "Malware payload (Mirai)", "value": "efe84052d4607d5d4aa95986028fa3423b39ad1afd3e7676534a6cd63a008c4dca86e44aec4da780c77922c3253b50a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849624, "uuid": "ae3661d2-c9ae-4ac4-a224-8aa68667d58a", "value": "T11E82DF30519B74F9CBE14431EAAECEC6A71A0BF9D0FC36D21758BB78894650611F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849624, "uuid": "b50f417e-5688-48a0-b4b7-76f33ac04e75", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMarBFhymdGUop5h5lo:6/V0P6+kom0tVAoNvm+to1rBFs3UoznK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849624, "uuid": "d53c1a8a-9986-448b-b3d0-de1d5b69cc8c", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849624, "uuid": "e6319c39-bf1a-40af-856d-b62b9b853cc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849624, "uuid": "260627f6-496d-4bbd-a116-4f6ce1d29983", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636f10d9-fffa-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741863634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741863634, "uuid": "102aafc8-bcf8-4336-a1f5-859791792028", "comment": "Malware payload", "value": "37d495e3c9d74a5d5644707a43dfba93", "object_relation": "md5", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741863634, "uuid": "e6363ced-ff17-4961-81fc-5acf16103730", "comment": "Malware payload", "value": "4ee3269aa3da1b148a7e8348684b306d8f227ec8685ebe4546228e0fb518c81c", "object_relation": "sha256", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741863634, "uuid": "0f9a2aed-dd0f-4a29-88be-79c1e2a2f6bc", "comment": "Malware payload", "value": "057d89e2099049d715f01934b5fe47296129eceb", "object_relation": "sha1", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741863634, "uuid": "e8ed45cf-f5c6-469f-bf43-7cb8a65520f5", "comment": "Malware payload", "value": "1dc6dc314b56ea0d0622173de4545502a4a6e6df83b957c95c12cc51e27834273dbad12adb5b86d843628ce0b97f1980", "object_relation": "sha3-384", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741863634, "uuid": "101adfe0-7ab7-42ab-88b0-a0c6560bc6a8", "value": "T136E72256E2B900DAE7BAC0F885575F17F6B53845133097DB61E08A692F23BE86E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741863634, "uuid": "7f7cd6b3-96fa-4ad1-b2fe-af0c790aee27", "value": "4b1892ce4fbcfcf064c6f69d693fc6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741863634, "uuid": "4ce2e3e6-f068-459b-9140-304fddcd0543", "value": "1572864:5m8y6UeC2tOFPfL7LTm3aB91/n5sdmqJBNHxhzihaSK:5m8y6OtFLnT0aBrOdmqBHbwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741863634, "uuid": "405cd4bb-aa12-48bc-8341-124e51fc7d35", "value": 69436280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741863634, "uuid": "f82d0428-783b-4e91-8ddd-671aa2d2020b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741863634, "uuid": "a8cd58e4-e84c-486f-be4b-9588f1f43040", "value": "NexVoo-Setup0.14.6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2d4f35-fff4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741861048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861048, "uuid": "e215dda1-d8ef-4db5-823a-d21da8f61e33", "comment": "Malware payload", "value": "71ce395e8bb531ec3623b94387de8392", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861048, "uuid": "ea1f5979-9922-435a-b3cb-8064d5781d29", "comment": "Malware payload", "value": "500c9ec95e931f6df9418b709379df4f83519a76fbbab4bb86db36a35a62cb42", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861048, "uuid": "ab19d53d-2b79-4709-9a76-0e795b6c5d91", "comment": "Malware payload", "value": "a63ad4c104c79f400867e0ee73a50b3619bb5a6a", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861048, "uuid": "e06eef91-13e4-4ea8-9219-68b0e54ee833", "comment": "Malware payload", "value": "e50fe4db74a00e1ac64dc8bab9be2ac48fa84873495a2553d938343a9e06749090f9ea11934f1c85d12b8116910e64f0", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861048, "uuid": "c2e26997-7d00-43aa-822e-68f736dce26a", "value": "T15A61FE82EDA91191D387E5954153A887621A3D131308083A7BFCBAC05F68A70F2F2FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861048, "uuid": "b3f3c110-9de6-432a-9f4b-9d414d326004", "value": "48:YGM0KkUDZVjfuEhWhIR1xOdfvaRNRDrJdRXMXK9+QEUN2B4eBjh:YGM0IjqlCDDrDRd3E82B4eBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861048, "uuid": "dac412c8-bd13-41e9-a739-5e1c7c9f2288", "value": 3202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861048, "uuid": "69f1053f-c68a-4fcf-b3ea-954594a8207f", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861048, "uuid": "feec4051-b190-424b-a047-55c5185d3892", "value": "500c9ec95e931f6df9418b709379df4f83519a76fbbab4bb86db36a35a62cb42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59db2405-ffd8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741849015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849015, "uuid": "f475cdc7-3e0b-433e-9d71-a09e4547d956", "comment": "Malware payload (Prometei)", "value": "fc8f91697b00eff11fbf69c6b2d9a674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849015, "uuid": "461a4dce-3b8d-4a0e-a223-60843838f5b7", "comment": "Malware payload (Prometei)", "value": "506ab617da7e2767d6b7c86213a681aacbe1314fdd110686a0d29eab5c240b2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849015, "uuid": "8ed90185-42f8-4e05-b42b-dc3bd88df106", "comment": "Malware payload (Prometei)", "value": "4b974fd4dec9d40f53af9ad977755a03f2e00b95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849015, "uuid": "55b83e3d-71e4-4309-9806-153a2dd38651", "comment": "Malware payload (Prometei)", "value": "c8fd57e1fdc35ea53b88ea90333bb7b4c9a1f48793cee2522eb20af5cb4ed15181ca95bba0fb64115a6ba2b03cf17279", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849015, "uuid": "6293daa1-f6c9-4245-873c-3c4f0c24021a", "value": "T16C155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849015, "uuid": "c9fc3110-224d-4b5e-add4-2097e490f1ad", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplY:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849015, "uuid": "bbbd46ec-0b10-46d9-814a-ee2286a24252", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849015, "uuid": "c2307c73-9298-40fa-b0fb-6b9b501366d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849015, "uuid": "2c3334f8-2e6e-41ef-8a0a-a083efad506e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db477176-0018-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741876720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876720, "uuid": "50ad70ec-1afb-4fff-a8b6-e3b7eed32d21", "comment": "Malware payload (AsyncRAT)", "value": "f77898f19384eb1dbe1ccc04941868b1", "object_relation": "md5", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876720, "uuid": "8c63f261-9513-4c0b-94e2-a347209f1318", "comment": "Malware payload (AsyncRAT)", "value": "514c8c5cd31361e2b9790843b4a99b8e06bb72238a46060292c9114b982482b3", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876720, "uuid": "67a23ee9-67c5-4937-8b7c-ca57d7870610", "comment": "Malware payload (AsyncRAT)", "value": "9d42c1c49fd8a63ab54b9c929ac6f4a626680047", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876720, "uuid": "1c27b487-eeb8-4737-9b30-eb76ac9b870f", "comment": "Malware payload (AsyncRAT)", "value": "67abba8dd6ceb28a53fcdf735b2a8a3d8258710265d0ebfc88f685190601573d3aa2a2eeb04393fb29766ca35f39bec2", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876720, "uuid": "6e2f12e8-a27f-4e49-b5f8-bd7336a144b7", "value": "T12743D073138602AFD1844FD0401B2A5F39B6D95E37683444DBF329AE7E2B9DFA434962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876720, "uuid": "93f00cf7-b62f-4085-858f-9b9a85fc189f", "value": "384:iqqL4RHnoOFF8d/cz+zMNCWlzXOmskyNjKQGK33HtZ0e:QkRHn9FGPn0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741876720, "uuid": "bf19a073-c4d4-4b5f-a019-93b36397b30d", "value": 56837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741876720, "uuid": "ab5b4fbd-9e55-4f9e-9a5f-009b0f175f34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876720, "uuid": "36851111-073a-4636-be7d-9727eac80349", "value": "a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74729dff-ffe2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741853355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853355, "uuid": "f590725f-22c6-4cf9-bdc4-a2fed72287ef", "comment": "Malware payload", "value": "271998018494403a9b5d0d4b01eb0c44", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853355, "uuid": "2af4c600-4e5d-4894-a7ec-5cc9521783a9", "comment": "Malware payload", "value": "5203f2667ab71d154499906d24f27f94e3ebdca4bba7fe55fe490b336bad8919", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853355, "uuid": "4160bee7-e79c-4958-95e8-af6e63844450", "comment": "Malware payload", "value": "c1ff775ce01d756e778513a5bd40ace004576ab1", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853355, "uuid": "a48904be-a4ba-4224-8625-af2eb6b8d4d6", "comment": "Malware payload", "value": "e8d9788d2aa5bf5a3e9378a45c37be2a6a0eb54401098412e280f635e72cdde629ae62b5770eaf8cd97eecbc2a4c979e", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853355, "uuid": "3ca5c692-e4c3-4ec1-a3da-890fcb915bc7", "value": "T137C379851EDD2C9015AD7097C24B289AB6939E03CC61E8B1D35D03A2D331F467EA3DEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853355, "uuid": "708355a3-eb2a-4884-8226-b729ac7eb5d8", "value": "3072:TuSRpwhDx2Mw9yY7eHnQqV/xkXfKB5Hm/1esutQyD4s:3wxhweHNVxkXfKB5HsXYQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741853355, "uuid": "2742eefb-7717-48ca-a48d-5bf6d1f0138d", "value": 119183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741853355, "uuid": "dfc6487c-8b26-4513-a156-3ea3a48117af", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853355, "uuid": "6f8ca6ff-3d99-4e0f-a24f-3886a1850d7a", "value": "5203f2667ab71d154499906d24f27f94e3ebdca4bba7fe55fe490b336bad8919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2638527a-0051-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741900898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900898, "uuid": "22ed79d3-8e89-49a3-a76b-f56c66d2934e", "comment": "Malware payload", "value": "197a511efac9c171f1a50077e9ae4a32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900898, "uuid": "a0367b8c-3cf3-468a-a160-05cc4bc54ebb", "comment": "Malware payload", "value": "5223ad3b31ff6fa8fd9dda7f98144b13cfc08f44a068c6a9e63664634534bb9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900898, "uuid": "653fda79-5920-402d-a374-a83d3cf4e3ff", "comment": "Malware payload", "value": "4c6880674211b0e8351aed5d4af21cc567928511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900898, "uuid": "6e48bed0-6487-4c36-8716-cc6a64c63a06", "comment": "Malware payload", "value": "ae6d37c86cfa018437efebf1db1feeb97f0fc2ab2528eb60c9530e5490a9288de90a0521463919c786f9e00b1a49bfb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900898, "uuid": "b4351e07-6ad5-45a2-a6ff-7dcb7b165a90", "value": "T1ACF523A57A90C255C97A0930DD3AD0F825293E29DD7AC20B71EA3F5F75F23CB2314A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900898, "uuid": "c0387005-f37e-4b8b-bfa7-9d63a18fbc36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900898, "uuid": "c9b707b2-4c39-4327-92e8-a8848fecae4f", "value": "98304:PRnLxCdeGeguBMFkqXf0FkXw0lxY7/FyAO3haMLV9SsfnM+g:5LxrG9uOFkSIkjl+/ApRL+sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741900898, "uuid": "fdc68cd2-8444-4698-8bc9-9121c17049e0", "value": 3470336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741900898, "uuid": "c5f79241-a2bd-46d0-9bf2-8f37f3119799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900898, "uuid": "2f4608eb-8b63-487a-bf75-a4af28017743", "value": "SubzB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ca9fb7-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883615, "uuid": "c1b6163e-79dd-42ef-b972-24f7a6001d48", "comment": "Malware payload", "value": "4d17970b01df1eb0abeb0552e011113e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883615, "uuid": "9698f431-9c9a-4837-94c7-f187e38688af", "comment": "Malware payload", "value": "528c903f90d53a412c23044a213f2bea279c6d4599cff664fbc2b2ee14a67109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883615, "uuid": "be9d6078-16cf-46c8-9c43-0e13bea256f0", "comment": "Malware payload", "value": "f542eb2d1548721ed7892ee93a189da6a3fa1c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883615, "uuid": "f948920e-25e7-475a-984b-24e459bad700", "comment": "Malware payload", "value": "279445e9554180e1ca451dfdb428e5e1f87817e771efea7859f86d4a33436ad62660eb638bd59e223feba59825191023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883615, "uuid": "269ce8b6-de09-4cd1-8310-72f806916845", "value": "T145A5D023F2CBE03EE05D0B3B15B2A15494FB6A616922AE5396ECB4ECCF351501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883615, "uuid": "390683a7-d839-41a1-820d-20b42e02addd", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883615, "uuid": "c4622bf9-d0fc-42ff-9ebc-2d481188093f", "value": "49152:7wREDDMoU9z39oxPaS3ftiaOXziJD+QzMm1RBoBVtYHqge:7wRElU9T9oJx3FMi9+Q4m1PQKq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883615, "uuid": "19082c65-56cd-4c8c-8b80-cce27e0d907c", "value": 2241176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883615, "uuid": "0d7ac111-dce9-4762-9949-fa65c1a61e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883615, "uuid": "38f363c5-a93e-4e9d-bd1d-c3697b0c3f59", "value": "pdpsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7dbf00-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860405, "uuid": "46a678af-c338-4fac-9e1d-580b53bce9de", "comment": "Malware payload", "value": "d9a053e54be4003cc28b41fe30790349", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860405, "uuid": "d56a5bbc-95ed-4d2b-a479-ca9eccb589ce", "comment": "Malware payload", "value": "52e0171d1e88c2e21a0309cb91e1261c8c7c1097d8066dcde486bc85316fd898", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860405, "uuid": "7ab01481-0de4-45ca-a656-52ce1849de54", "comment": "Malware payload", "value": "4a6c37e07b055a58e0d9535df4e6c92d7615dc5d", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860405, "uuid": "8cbb4853-4532-4156-bdf8-e78ea86417b4", "comment": "Malware payload", "value": "755782b9bb9e8150a9eda7f0f24fcd8f06400564cf908e412b3972b0902f0d29f8c50db2cdf706076cc3f4f91894223f", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860405, "uuid": "2616ca92-171b-47ac-a0b7-ddeed9573990", "value": "T1D441BA86B9FD6066C25BD02C1102E50390A97F43570D1A3E77BCB6A4AF34370F0E6AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860405, "uuid": "ac74b4ac-ff3d-41d0-8481-e8dbdf631713", "value": "48:2hpKMtHoYD8iQE+hB1YNoRbBtQzI9Ob96/UPDqPib+V:2hpdFB4bUkwR6/eLb+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860405, "uuid": "93ad5daf-9780-4728-b047-0370289022f9", "value": 2438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860405, "uuid": "21f2eb4e-ccdf-4ebd-9f31-366f74bd9e8a", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860405, "uuid": "f92a18f6-d1e2-4fc7-a850-753d050a2ec1", "value": "52e0171d1e88c2e21a0309cb91e1261c8c7c1097d8066dcde486bc85316fd898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd8e69c-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883539, "uuid": "43eb476a-9bbe-41b9-a00d-b9d4bf51536c", "comment": "Malware payload", "value": "aa59af46859b0c4642139a1fc1566247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883539, "uuid": "4f4850ac-9694-4356-b416-0b3f4e1f8c93", "comment": "Malware payload", "value": "5360e393ed2ef7e9817d66ba1742544f9b4fed418b7216c7ea4dc5ed9bd01be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883539, "uuid": "c80b2968-0971-4837-a05d-3ab1c5d84610", "comment": "Malware payload", "value": "8bbb45da9facef885984caedbdee5cdbfda114fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883539, "uuid": "35081a51-030e-43ab-96eb-a5bcc20e7922", "comment": "Malware payload", "value": "1d0e5cf229996bf3c1e529357299b687b6b9ac807b3626a1e6d1e9850157fd12df9d44495566dc46dd30068e5ff2c086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883539, "uuid": "b74f2e5b-d093-49ee-a8e9-f17b7abc2f4f", "value": "T1AEA5D023F2CBE03EE05E1B3B05B2A15494FB6A616422BD5796ECB4ACCF351601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883539, "uuid": "4cb86590-0d31-46d7-a488-cbb87e024678", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883539, "uuid": "3e9e6bca-314d-4f75-8162-4d8e02bdd8a8", "value": "49152:FwREDDM8FJCZxrUIp1xcB3ftiaOXziJD+QzMm1RBoBVtYHqgl:FwRErTyBvcB3FMi9+Q4m1PQKqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883539, "uuid": "fe9450eb-86ec-46a6-870d-05591a853fb2", "value": 2241304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883539, "uuid": "58599886-6e49-4f7f-bb94-0ad8295fc77d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883539, "uuid": "f8c600ca-85eb-4139-82ff-f258d7abd654", "value": "pbtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25eb255-fffd-11ef-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741865109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865109, "uuid": "28b08a0c-cda4-4346-b131-0c7e23759c2b", "comment": "Malware payload (AsyncRAT)", "value": "ff7ed8e6f30e2d7f44f5414f9465d413", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865109, "uuid": "06dd8846-7fbb-4c35-8f3b-1c3700b1b6c7", "comment": "Malware payload (AsyncRAT)", "value": "536c0da703e83f003d6a8902a4d7a9c75a0ef93cb6809349729dd733813b0c99", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865109, "uuid": "87a4e6eb-3856-4a63-a19a-01f3e661787d", "comment": "Malware payload (AsyncRAT)", "value": "12be6d26f6f4385213a0a9557b35e1f4171f23aa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865109, "uuid": "31e3b9f9-6fd0-4e57-aac0-a6996cd075d6", "comment": "Malware payload (AsyncRAT)", "value": "591a34efdf2b6e3661258eaab29f001eca45e8518d3642b29b347039ef5ccc29a44b453d15fa90670c15405a666bb576", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865109, "uuid": "ccc57fa4-1e1d-4092-8e67-e79365ab7d96", "value": "T15DE39F9877D54415FBFF9A7828EA73159A3AFE93ED03A10F01D432CE29336894D81866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865109, "uuid": "9c3423f2-08e1-4f19-b3da-6d7c90dffb6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865109, "uuid": "f9d52389-e003-42c2-9a5a-1d4771d34206", "value": "3072:40PB6TYWbi0EsjQo5O3ttZj7Iq+gJTefW:4065blEsMvznh+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741865109, "uuid": "85c6ca98-a95a-4aec-9ecc-5f4e589ab108", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741865109, "uuid": "414d47ec-a6bc-4bc0-94cd-cf10e2c46a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865109, "uuid": "31546dc2-d7a6-4f2f-8d4c-339f0a66461e", "value": "Steam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4511dd-0044-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895455, "uuid": "13e6324b-3cbd-495a-ab82-5120d620b2fb", "comment": "Malware payload", "value": "caaab77ac57b387f885f888d26a0b556", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895455, "uuid": "8d4572ee-cab8-4359-92c1-3008620fbfea", "comment": "Malware payload", "value": "53e36c39d524a1e994dad8a43d7dfcd15154dbc2ce52f3b41fca8d484acbd62b", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895455, "uuid": "d245bfdc-b83c-4515-a755-6df7339daf81", "comment": "Malware payload", "value": "e6c3bd54898ee80fa45a3bd3cd2ebc8ae738f535", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895455, "uuid": "b39f58fb-1774-49b0-84e1-0c257004c2f5", "comment": "Malware payload", "value": "ebafc68c551c8c06791869f322cb10d64459eda7fcb7af5c4f83eda174de318fb55841b3c14860e5dee2ae6d18fbb3f8", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895455, "uuid": "fde454d5-615b-42c9-a5c6-97f1256cca4d", "value": "T1AC518564EA0BD9295AF3A3AA6C43E658FB1A4567A1251844F5DCD2B41F3001D832DF0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895455, "uuid": "8985e164-0478-43de-be01-9b4c795f6d4b", "value": "48:9OuISSTvkK2cITQjv9Zx71KU6tVWl1O/DhDqqdryN2MANlaN:4hLzJR67Wl1YbQANl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895455, "uuid": "21e2e93a-f304-432f-9226-f18ef45950af", "value": 3047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895455, "uuid": "7140d470-8866-4fea-ab25-63ed9c18c15d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895455, "uuid": "c06e6a99-c4a3-4da8-8c81-59e95286e397", "value": "FHm8PLpZ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3da9d60-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883150, "uuid": "4154bed5-9cb2-4196-ad4b-6385dc22a0e5", "comment": "Malware payload", "value": "7267c5ffae5d5595ee360ca9637a1b59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883150, "uuid": "b6913504-2592-438d-b026-89d5adc3a64e", "comment": "Malware payload", "value": "53eab8ddd907cfb2c7042add86f372829e6d1a1235eb00fe95a8061e5b8fe21b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883150, "uuid": "267ee7e6-2de6-452a-8faf-72a7bb8b4e2a", "comment": "Malware payload", "value": "803db607659c172dddac9fbda30ec8fb1ff30386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883150, "uuid": "eb6d68f9-5df7-4619-9fdf-76a73ad6799b", "comment": "Malware payload", "value": "d8be2ab68f3147e5e9d6e61bca8de04c72e20c67bbd19c1c309359c022cf3e9423228e81973acc5a8956fdb1c7505b8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883150, "uuid": "6d5f4d41-95ca-4256-95c3-39a8141e58e6", "value": "T1F635121133B96605EAFF28B6996183D45F3267C7CA61EF0E9D40159C14E23908FE73AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883150, "uuid": "fec2f84b-153f-416b-8c3e-8907f1921d92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883150, "uuid": "9279d6f7-9a77-4264-bb2a-356d4b0ee778", "value": "24576:I/DsWdhvOuLEKtXTdENvJyYP/m9WIuEmr4EyaTznDoabn8Ss:I/VdhmuLE2TkgEXr4g0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883150, "uuid": "d3cc569e-162c-4cf9-b194-e026c2c14e8f", "value": 1150744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883150, "uuid": "70331212-c475-4a97-9a25-a5f33b10f7f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883150, "uuid": "9dc32ee7-7792-4a30-b0be-21d7112fe746", "value": "PDFizer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2c985d-ffa7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741828002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828002, "uuid": "98933eb6-2cb4-4e77-8357-c3b1a3c7df33", "comment": "Malware payload (Mirai)", "value": "349cedbdfa385b3671a95670d596852d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828002, "uuid": "e8207c69-af3c-4a4a-b4cb-9959370189e7", "comment": "Malware payload (Mirai)", "value": "5598a0318cd8efff91dc5a14cbcd3aa8c5bbac9da692f4e8bbf5a782beb8e34f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828002, "uuid": "207052a7-b3b6-4691-ad40-bbade8416201", "comment": "Malware payload (Mirai)", "value": "57af579b1f0856f107c1ce975bbc9abbbc262631", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828002, "uuid": "53b45188-b2af-4cc8-bbec-2f20684e7a99", "comment": "Malware payload (Mirai)", "value": "2254af814c4b26986c61ad95cb58e47988233c7e2b671111e2b6d6751016030510a9663ca8ba03685e5fb5776c2834f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828002, "uuid": "5058d11a-9127-4ec9-8f83-389af7b9e45e", "value": "T131234BC9A587DAF8FC160B742173EF325BB6F93F1018DE87C7A599339942602D10A1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828002, "uuid": "e0bc7156-777c-48f2-a0f7-53c41b583469", "value": "768:13sPWVrWy7PBIe9iFokjl3dMhc0otXztFxK0Pjdww5TKILFdYiG6tlM:DD9IciFokjl3dMO0itrK+jdz5TTLbrGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741828002, "uuid": "212757fd-4402-4460-87a8-01326cc7a5d0", "value": 47056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741828002, "uuid": "96407cb4-9dd2-4a90-ac02-d40191f17185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828002, "uuid": "62c8f00c-aab8-4e03-a4e0-100f7cc1534a", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba64ec2-0024-11f0-ad17-42010a9c0004", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1741881660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881660, "uuid": "ad8838b7-5b8d-464e-a538-da94d48ec5ae", "comment": "Malware payload (CoinMiner.XMRig)", "value": "7dcbcf3edf437044c980631e7693841f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881660, "uuid": "434be66f-d2d5-4e10-841d-b4dc1d4d4c78", "comment": "Malware payload (CoinMiner.XMRig)", "value": "55c3f9c587e15ce7f24553ec5c672edcd24ee9bc4d899920c6731b90043242c2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881660, "uuid": "baee302a-4c7f-4273-a101-14967e94850f", "comment": "Malware payload (CoinMiner.XMRig)", "value": "12afeef62ef4f035ae453dda916644e600016b42", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881660, "uuid": "d28ae828-0d21-46a1-a424-e762be24bb7f", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3ecd711e93b3e629645bdffcddc34a0b3426a2d6e95cb94063e2d74da25068b974fa6813e4c4755de732e306a9b13297", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881660, "uuid": "0a824318-d96d-41c0-aa4a-caa38b2c53e0", "value": "T17B3723207989C436F9AE0170393D9F7A953E78610B7085EB63DC9E6D5E30AC19B31B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881660, "uuid": "89047a72-ee31-4d7c-ae64-7a2490aabe68", "value": "393216:rr+07gr/8cf6SP7/HMSxvcBG9KmctRTIKqLwki9Unp8DsjBW:rr+64DHj/DvcY9gRsXi96p8gjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881660, "uuid": "7f350cda-f9ac-479d-be97-459173a05a50", "value": 23547904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881660, "uuid": "6ff169f6-611e-49ba-bd28-e24f64ad91af", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881660, "uuid": "6fc5a8d3-947a-4e35-a20b-24a90197038f", "value": "55c3f9c587e15ce7f24553ec5c672edcd24ee9bc4d899920c6731b90043242c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cd6c53-ffdc-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741850725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850725, "uuid": "37fc42f6-e743-43e9-ac9e-2b722d8cc0da", "comment": "Malware payload", "value": "228dd0c2e6287547e26ffbd973a40f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850725, "uuid": "2a0cc9b0-5753-4fd9-8d73-ff6b8457d092", "comment": "Malware payload", "value": "55f041bf4e78e9bfa6d4ee68be40e496ce3a1353e1ca4306598589e19802522c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850725, "uuid": "d45fdf80-c904-4b97-96be-b8854faa0346", "comment": "Malware payload", "value": "3fb89787cb97d902780da080545584d97fb1c2eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741850725, "uuid": "2702da04-5c88-4496-b646-c45280c5fe82", "comment": "Malware payload", "value": "d2bc3763c615d2cf771622e6f59c598a1dba96faf71cb9e758d55fdd1eb4a77580623c22e60279bebb3da01477c9cb87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850725, "uuid": "d8c3f441-4d39-4dda-b09f-0553d6f1d804", "value": "T12D767F1077D0C035E26236799A7DE7BA9169BD214F3481CB66A03B2F1E309D2DE353A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850725, "uuid": "a482b9af-326c-4b4c-a670-a632952b7592", "value": "0479f44df47cfa2ef1ccc4416a538663", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850725, "uuid": "c873baf2-32e7-4ca8-9c01-0c367b9100ad", "value": "98304:mIbAJX7ika2LxIeEEZCTcFmOVCPqSOAE6VcstHSCV28iIA6yZKyl7SLjD:mIbuWxeeHSCV28iIHGdSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741850725, "uuid": "8cce33dc-d4ae-4dc6-905b-553888b37288", "value": 7146224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741850725, "uuid": "8bc4ab25-8345-433b-8fa8-881d9eaf0131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741850725, "uuid": "0ec1821f-9d67-4280-8468-9e791d5cd9ef", "value": "32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2ce325-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855596, "uuid": "2ede72ee-cca7-4665-84a0-29ebbd60af9a", "comment": "Malware payload (Meterpreter)", "value": "8615ae9d31c9f986d79b9f9ab8b25ed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855596, "uuid": "5bffce41-d41d-4725-8737-267290e407e4", "comment": "Malware payload (Meterpreter)", "value": "56bfd939cc96e073fab263387b3088b200e63e6f61dba88f3cddc21e63a67cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855596, "uuid": "f0706072-b403-4a39-8ac4-683bb5b08822", "comment": "Malware payload (Meterpreter)", "value": "e6e2dcdb1b4114c2701ae41d548b20a0eedb06ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855596, "uuid": "5ce21d26-2c87-44eb-921e-8378bcfc0e0b", "comment": "Malware payload (Meterpreter)", "value": "61f167d4881b33071f7617ec18edab49abeff6de119d75e59e6155416a2f3d7b602900c6b6e99ae928b5132d5b4f6ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855596, "uuid": "9bf66f0e-e3ee-422b-9367-d0c00b3bcb40", "value": "T1E5245C5632A410BAE973913CC6934A1BE7B2B45A03B197CF03A443BEAF1B7D1653D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855596, "uuid": "8ab9152c-6918-48ae-a8c2-dc0885b81fe4", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855596, "uuid": "0e244c46-c18c-4d30-834d-835499e0271f", "value": "3072:yzbPxvf4OWGKQ2x66J5MhlzBzWTFkWUdunnf29bSgyEM4/TGX6KjdwVoRR0+dm8c:yzpQhQpY5QBSTO1un+9bXyEhOjGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855596, "uuid": "cc114e79-7b5d-49f5-bcfc-75e5f87eecc8", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855596, "uuid": "57d7ff4c-6c99-4332-9bfb-4905c23471bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855596, "uuid": "7dcef665-d7b9-4f1b-a2f6-bf48930426a9", "value": "msfnonstaged.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70725ceb-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825001, "uuid": "b95f3631-6da0-4c73-a75b-0324ff61bd27", "comment": "Malware payload (Prometei)", "value": "c03710ca88c111d9f8beddb98ec9c205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825001, "uuid": "99179479-538f-465b-a61f-3dfc7b1b1243", "comment": "Malware payload (Prometei)", "value": "56d3ac231940d32123d4e4a209820393e45492875aefc968649e7e7695f20260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825001, "uuid": "da1a8cd7-0749-4ed0-a2a3-d775f0ad581b", "comment": "Malware payload (Prometei)", "value": "49a8ffad10dc85961231411dd860a5ef37e3565c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825001, "uuid": "384df6c6-e993-4850-ac22-ae8fe6fda2ab", "comment": "Malware payload (Prometei)", "value": "e9c1bf65ce24a836039e6930c00ad5aad407e872dcfd86155163d930235aad0b91ac7d4aaa8165ad20d727a1ec1f2f6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825001, "uuid": "2f1855e4-a207-4c6a-82b9-c5dc70e70edd", "value": "T1169423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825001, "uuid": "ede1d283-7acd-4fc5-ac8b-692b54f25b5c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgb:25WOSACZSV6eKRH5EPiamb4DsDwwcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825001, "uuid": "4f54d819-6ab4-4c08-8376-a02711266426", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825001, "uuid": "e1e7c0fd-3f7b-4f69-9eb8-1b3c6595bf51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825001, "uuid": "4155774a-2a94-4b15-9041-37702c8e4612", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6846a84-fff7-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741862458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862458, "uuid": "51500a1c-6e4b-44b9-b27e-9f1b688209ef", "comment": "Malware payload (XWorm)", "value": "5ecb67798e6b29fcf46b1754ea2d6ab6", "object_relation": "md5", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862458, "uuid": "7c04cf19-27c3-4d71-9adc-28ea43457e9c", "comment": "Malware payload (XWorm)", "value": "56f304f2e560f09da015a9f0744e3a0825f420e092ebf7d4605b81b56054bba5", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862458, "uuid": "98762792-5328-42cf-b81f-efdb30f1cf9e", "comment": "Malware payload (XWorm)", "value": "7e9158396e324b076f2f908fa0a94fce41d2cad1", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862458, "uuid": "d6b4ad72-1698-46be-a049-dd553b6e6504", "comment": "Malware payload (XWorm)", "value": "34db8b4fd07c039d297982e344627b62f2cf49c2db9495e941d3b0f9557ec1c248eaa48299e6d4ac5604f08e27df0114", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862458, "uuid": "689e1496-38ab-4294-96f1-bee894f08745", "value": "T17C53E63ECAFAFCC8036B70D4965D3B8A116D0BD3BA752B9CF9C218A51814644EF77258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862458, "uuid": "66bbedd1-5627-462a-8478-6eb5996b441e", "value": "1536:YxqKMWZkbmEKUgXEXzICKUnFe8WtzafqMvvyRCugr8Bh+kRwI9:Yxq1nHfg8WZa5v6pH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862458, "uuid": "60a91204-6ffc-423b-aaa2-e2f22d51b748", "value": 63508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862458, "uuid": "fde0df4b-eaf1-47d3-a507-b5b0105be701", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862458, "uuid": "00a96a2f-1c11-4281-bc8a-9204009a563b", "value": "bybit.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8e2e02-ffd8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741849016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849016, "uuid": "58dc8fee-1196-4f5a-8661-4a158bcb12be", "comment": "Malware payload (Prometei)", "value": "343e8d5169ba47f81852fae163b78edd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849016, "uuid": "1ace3776-482d-463a-a705-679e39cc1b04", "comment": "Malware payload (Prometei)", "value": "56f91843cb7b05a1a0c892d0912459603718964b656b23332af446d0b416d3d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849016, "uuid": "05da8ad9-28f4-4905-ab5d-847c6d1c4076", "comment": "Malware payload (Prometei)", "value": "7b9772349b433a1b35b39d2f8481a271f74d8031", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849016, "uuid": "0b1ed246-6084-4733-b378-5483ad312f71", "comment": "Malware payload (Prometei)", "value": "2f3334869c9b7f944fceedbb1f95ea1ea9e3c064c20f75958d29df9561012ed6266a259eecb6ba18da7b824d5a3da9e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849016, "uuid": "03634eee-387f-44ce-ad14-354d40e4628d", "value": "T122155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849016, "uuid": "09c96da4-6b8e-464a-af52-3842f2bb84e1", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplQ:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849016, "uuid": "a7f2a647-6b6b-4361-9df6-dc8c4d9f5e9d", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849016, "uuid": "5d7560be-11e8-42c5-a504-d13124b0becd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849016, "uuid": "b17ceecf-bf85-44dc-9cbe-5a35402627b2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc61edcf-ffe8-11ef-ad17-42010a9c0004", "comment": "Malware payload (KdotStealer)", "timestamp": 1741856079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856079, "uuid": "a0438d53-cdf4-408f-9a67-43b27271b565", "comment": "Malware payload (KdotStealer)", "value": "a1a017296dc4e6e7df926d71d1e83ccf", "object_relation": "md5", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "KdotStealer", "colour": "#EEA4A2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856079, "uuid": "0ed6a1d4-7335-4b25-87a8-34d0ca415552", "comment": "Malware payload (KdotStealer)", "value": "570740377e128977f67d39cea718bb4b5d3f4a4de5efbd0b6ca7d20f46ef0f41", "object_relation": "sha256", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "KdotStealer", "colour": "#EEA4A2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856079, "uuid": "de956744-182a-408c-8eb4-f12b495aa2d6", "comment": "Malware payload (KdotStealer)", "value": "5aa23932d96f2571c6044a2baaec0d2d340339f7", "object_relation": "sha1", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "KdotStealer", "colour": "#EEA4A2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856079, "uuid": "99625353-d339-4578-b813-d0bf6797d4bb", "comment": "Malware payload (KdotStealer)", "value": "57105ffb459fcd32482d207c7b4ad1ba6f6d0c6e267e46dc1a66ed434db33491e83d5ab08dab44b05a99a5ff9d0f4e7d", "object_relation": "sha3-384", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "KdotStealer", "colour": "#EEA4A2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856079, "uuid": "0b6e6ebb-9618-4f5f-93ac-c80c9fc9c215", "value": "T1E66729731253BDEE3E7A2C84D4083A445C9D795B9268D288FF8C31BA62EB154CD7C9B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856079, "uuid": "de60a0f7-0d24-4869-806a-6f7587228108", "value": "49152:iUcYrgdbLYHRH3Nbw7bX7nZ0DMofIU2bm29eJIknr7PnkbkxSZsN1CqfjS8NuYWC:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856079, "uuid": "db977430-ff9d-483d-9c42-30d8110df8f6", "value": 31353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856079, "uuid": "8a3fddc8-de4c-4063-8cd5-99e376350ea7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856079, "uuid": "22a65f95-cb61-4804-94ef-da4de5bcc234", "value": "payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab3807a-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883457, "uuid": "bb114b98-099a-425b-9d25-23ffcfee247f", "comment": "Malware payload", "value": "211dbea4367062e49c1b2ef84e5d95a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883457, "uuid": "9e182baa-dab1-4228-aa49-b23151a87bcb", "comment": "Malware payload", "value": "576989f70cfd99472415bbc1c602f0e20a57ef2a5249546d48520b83f731a28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883457, "uuid": "03bc1d57-6c11-4196-8694-7d940bbc315d", "comment": "Malware payload", "value": "dadcd2006e3bf34c537787eea657cac423f59637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883457, "uuid": "9db46520-7abb-4c41-83aa-5432774ee814", "comment": "Malware payload", "value": "d87a844a8b427789bc08dde38e2145f897c9eabe60940e7f68abb23e4849a63f0e3fcaf2b2172bfbefc22856b7d5e535", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883457, "uuid": "3b57290d-d186-453c-88a6-12fc674721da", "value": "T124A5D023F2CBE03EE05D1B3B05B2A25494FB6A616822AD5786ECB4ECCF751501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883457, "uuid": "ea1e72a7-6787-4c52-a65c-fbe9d5c87860", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883457, "uuid": "420fbd8e-3c86-45d6-ab2f-1f376ba3f263", "value": "49152:3wREDDMIJxyqJuL3ftiaOXziJD+QzMm1RBoBVtYHqgp:3wRE/Jx4L3FMi9+Q4m1PQKqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883457, "uuid": "9d2df1f2-48cb-46d0-a4ab-4419cebfd601", "value": 2241792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883457, "uuid": "2bb05c34-0c1b-4726-ab02-3b5a5f952d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883457, "uuid": "e0bf758f-c347-4652-a927-a581f33599ec", "value": "ybtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fbc3be-ffd0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741845707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741845707, "uuid": "6ad411c1-fad6-4ff9-a7a0-440c04d46714", "comment": "Malware payload (Prometei)", "value": "da2f6b7e67c3d0cdbb72741e1bcb5fa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741845707, "uuid": "48dc9072-9206-44d8-9bc7-a8e25bce9d6e", "comment": "Malware payload (Prometei)", "value": "5770081fd17c442159f641bbdca3e37f17325b0f7fe0682bd4ae84061d5dd030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741845707, "uuid": "d844a684-ca59-4e03-9fd6-68305c9c7c47", "comment": "Malware payload (Prometei)", "value": "de6cd201af289e73165ff377ecd33adaee52f6cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741845707, "uuid": "e335aaf0-53c3-4d45-b129-d5805e9dafba", "comment": "Malware payload (Prometei)", "value": "ce3578469d1324b8fb327ceba7737298b0eb7d0e393b9f7c0491ca56ad7da52d377b90e5e399c3130da1bd022dd19906", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741845707, "uuid": "9266f8ca-63fe-450c-82b0-f67624178ce7", "value": "T1B1155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741845707, "uuid": "38414486-e7ca-418d-8813-2845117a84a3", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl+:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741845707, "uuid": "2a78f5fc-5c61-4358-83e5-df3cd5bd5afd", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741845707, "uuid": "56839d81-2852-4482-b0b9-a756dd8d4bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741845707, "uuid": "7ad122ef-fb97-4507-8a57-f725c24d21fc", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15895ce1-0023-11f0-ad17-42010a9c0004", "comment": "Malware payload (Copybara)", "timestamp": 1741881113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881113, "uuid": "753ab3de-6a88-42d9-8737-bdf24564c4e7", "comment": "Malware payload (Copybara)", "value": "7e4e7044d2b349a7dca44bcbbd51c3cb", "object_relation": "md5", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881113, "uuid": "3c0faddd-5276-4656-b903-b0aa87e74342", "comment": "Malware payload (Copybara)", "value": "57c6896ef32e6e1989b69abc7c8cf179173b8b3a061f363b3b7a6421e87778eb", "object_relation": "sha256", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881113, "uuid": "ddce9da5-1fcc-41ad-9403-240baa6eb8c1", "comment": "Malware payload (Copybara)", "value": "5ae671f7a3898d72725e8e88e07f83a7d56b38c1", "object_relation": "sha1", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881113, "uuid": "44b08421-7c95-4b25-af3a-23ea795683ff", "comment": "Malware payload (Copybara)", "value": "4db4dad618a4c8ef938de11f754c8c80d2b6efcb90f75e9905ccb4a87eab945d1d7dc9bc4293913717bbd6028adb7e68", "object_relation": "sha3-384", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881113, "uuid": "7e038654-fbd5-4718-9e63-2073f7ec8643", "value": "T111C63367DB58E54FD4FB5B3A0839416A0CB29933CBD3C30BE8B16638199B2D48B45BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881113, "uuid": "39d80499-f16d-4184-8699-259a14a3b9c3", "value": "196608:40mZUMxhHPyFd/x24MocFIzkHBMcLpuLqp8IwcFyWSa+bt3Cr3TiQ8o9rNoXdA0/:4pUMxt6Fd/x24dcOAdumqYZST3CXgarc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881113, "uuid": "f15e9e77-4d7a-4241-823e-28e4a3547a1b", "value": 12126088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881113, "uuid": "9e2b8948-aaef-403b-ac4a-04b8bfc29c70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881113, "uuid": "4f3704d5-987b-4b67-b3c9-6a968a0924fe", "value": "57c6896ef32e6e1989b69abc7c8cf179173b8b3a061f363b3b7a6421e87778eb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6053035b-0057-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741903572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903572, "uuid": "5e099935-50df-4a2f-8879-6c6493b33e10", "comment": "Malware payload", "value": "e341d2cb7f1b907d12c85557f7b797ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903572, "uuid": "d4cd4a5b-4432-47fa-8e7f-c3d1d8f0b2bb", "comment": "Malware payload", "value": "57d5c2569a10c07529ed7fb18699095a53d9be342f612b8230e39a48312a6281", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903572, "uuid": "c17f297b-510f-4b66-b6e0-16f7229486c2", "comment": "Malware payload", "value": "28b6a72672848e8ee7bbe00c839e899160fed839", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741903572, "uuid": "0fd699e9-1248-4c41-a340-0c0ac214c36d", "comment": "Malware payload", "value": "e0031afcc6d4f6595cda6ccea5c17fda56b67e5c1ec22c82a31984ba9adbe06e6c0882bebd2e9646aa148ceb89a6bd09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903572, "uuid": "e4c72a93-b78e-46c6-b6b1-fb00a29ff320", "value": "T1A274237E8B808151E4C9909CF120169DCA271BEA352538F5E5E379BFDCC5E4EA8D3B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903572, "uuid": "74cf305e-64d1-40eb-bf25-fd2b05579927", "value": "6144:wpV2WkkQPkKrdMHE8yLPleNaW/51o8Zyr0jzd0fhk1ls4F1Pe8P5xtrQvn:lkgkKxMU9IaG51o8Zyr0jzdkk1l51PBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741903572, "uuid": "6bcee27d-53c1-48ef-9998-f2b6200d13f9", "value": 356066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741903572, "uuid": "5095bada-6eb5-4c45-aec1-8d31a7eacdff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741903572, "uuid": "3eeacc1c-8ee9-4bca-bec2-40ac712fbe0d", "value": "Software.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c464e4-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824982, "uuid": "f1025c76-9acf-4744-93dd-6031ec82393f", "comment": "Malware payload (Prometei)", "value": "0332f433f140365a19ee05ebdc34ef80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824982, "uuid": "c519c7b7-7cf7-4f25-96cf-79239a7b9462", "comment": "Malware payload (Prometei)", "value": "5821b1a48870fa96efa0ff8f5df1da528bf3b5b6aa1a3f279d60cacd6075f2c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824982, "uuid": "8770e434-5805-4b45-8725-cf52fe4ab280", "comment": "Malware payload (Prometei)", "value": "b6512b431d26c930e9bb5e8bfaad443a37e65914", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824982, "uuid": "ffa5708a-643b-422f-affc-abe36007871c", "comment": "Malware payload (Prometei)", "value": "7769232a87d55ed30d20ce0cb7864cc15b7d814ccd421a9f96c2f8042e3cd6750b87de6788a99621cf2158e3ae87641c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824982, "uuid": "3bec1de7-95bd-4fb9-9807-8c2773474416", "value": "T12F9423F8C87D2E3098169B3CBB1A826CF0A15772D9562B7EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824982, "uuid": "5e234eff-c97b-4d3f-ba19-b2bfab2cb320", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgn:25WOSACZSV6eKRH5EPiamb4DsDwwcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824982, "uuid": "488341f7-0ada-4d34-a3a6-2ff948ea9966", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824982, "uuid": "0f14ae38-d86e-4d61-8196-59f30a6cbc87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824982, "uuid": "c1fe3fd6-1724-4c14-813b-fc1e75dda115", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c666f6b-ffda-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741849878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849878, "uuid": "a0deb51f-9103-44bf-a069-5b42c6de49c7", "comment": "Malware payload", "value": "a352aed691a1d9619dc3e6613fcb0614", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849878, "uuid": "a9364f6e-fa1f-4a31-9668-b67f0eac83d9", "comment": "Malware payload", "value": "583302fe4ba95fdaad189f335b44c9d95cc146f672a63161320caea0bd647457", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849878, "uuid": "b14dd3a8-23d2-44bb-a56e-b7c77136d037", "comment": "Malware payload", "value": "7da8baafbb118a05764372bd543731a676ec8f61", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849878, "uuid": "dbde9d11-4a04-4506-a86e-9e02da2d2513", "comment": "Malware payload", "value": "ec91ef82d3ea9d31c021abfc92ca65143efa48fced090909ccf766b5d9cab4ad619b55069a1e109f3e5b70d26d31e24c", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849878, "uuid": "293d9d1c-4837-43c4-80d8-ba6b9b092a9c", "value": "T18DB3FA71A790257A237B43BDE557FA0465698A23DB0E23E5F0FEC15C85C9BA310B270E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849878, "uuid": "41c4053e-a2c7-4932-a0c1-8bfb7fce8388", "value": "1536:DKWHXap8pzoRTj63AtKMWsPW1fM1f1Rdc:Dlqkzh3AtKMWsPw69nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849878, "uuid": "68102162-1d3d-422e-8f57-1dcac810b3a8", "value": 108895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849878, "uuid": "86e452d7-1333-4ab5-ac4f-079e2faee556", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849878, "uuid": "5659ce40-0139-4f5c-9c80-e49b10f7a232", "value": "583302fe4ba95fdaad189f335b44c9d95cc146f672a63161320caea0bd647457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64d65dc-0044-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895637, "uuid": "ca08b13b-74c7-4e46-808d-2a08c1f2f4d1", "comment": "Malware payload", "value": "8e6e0c5a5847177f1105a67f75a2d05e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895637, "uuid": "bbe41e8e-be01-47bb-b511-eabb310464fb", "comment": "Malware payload", "value": "585ab6c1cdaa65c9d08decf4e1ab1cf9327f00e18d13e85e338268ccc3587aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895637, "uuid": "5b2c3d9b-579f-4a92-ae7b-bb7b616ab1df", "comment": "Malware payload", "value": "b47636a46a964595ef771df32f215693396af7ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895637, "uuid": "6a8aebde-af2a-429c-badb-97311d3907f8", "comment": "Malware payload", "value": "b136bac22db9924742c78accaf79e13d428c287668934a348d2ad5c9d639ee1a638b05136773900b3cbd270e592fc06c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895637, "uuid": "6d41ad82-5cc2-4905-a4c5-261fcba61dfb", "value": "T120571221768AC82BD56605B01B2CAAAF912CBD250B7148C7B3DC7D6B2B745D30633E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895637, "uuid": "2ca85a71-868d-41ce-9905-fec19fe2980d", "value": "262f7b623746b414d0e9c48c1d61145e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895637, "uuid": "a31ede0c-3268-47c8-9f2b-e1c1f90553d3", "value": "786432:7Fxb8yuOgTwJszi6kPgsZF2cpZd4yQjluNtQ+2drTgYee:7Fxb8yuOg0WRkBNpkxEU+2NgYee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895637, "uuid": "9abade83-69dd-409f-9d51-fa7d7b715c74", "value": 28905032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895637, "uuid": "3e4907a7-5316-4144-987d-0501ec2072ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895637, "uuid": "988d9080-f109-4e18-b39e-f78bf8fe985a", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ee30e9-0017-11f0-ad17-42010a9c0004", "comment": "Malware payload (CoinMiner)", "timestamp": 1741876314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876314, "uuid": "0278f7ee-4551-4a67-9250-610c78f78383", "comment": "Malware payload (CoinMiner)", "value": "0125f9fc8b095b3d9b949dbc646630ac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876314, "uuid": "df9a1ab7-5626-48c5-811f-aac9e262a546", "comment": "Malware payload (CoinMiner)", "value": "596b5c77e69fa9f0004cf5daaae2ac3b925b5b4eddc4fa9620d29d330569b70e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876314, "uuid": "137cfebc-8085-40f3-8d01-d4daa71d155b", "comment": "Malware payload (CoinMiner)", "value": "562873c2d78612f42132227d3f49cc381c3c0bd5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876314, "uuid": "add68a74-ab76-4949-aacb-fb50af8b1c3c", "comment": "Malware payload (CoinMiner)", "value": "ef816d103a5997e65a4bb074e11622d1889b38a78b878b7f401d7ef59997d66511a836ab02ad6ef913590c8c5c7703cc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876314, "uuid": "667c800a-8f55-46eb-a88c-d111c657b366", "value": "T151663309B06AC5B2F6E5E3B4E437846AF47E3F32B8053859C1D96C157EE78167E02B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876314, "uuid": "99c4edf3-a24a-41b4-932f-6dd9e491214f", "value": "7f830c1be2775636f0aaf6ee74829bf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876314, "uuid": "7d55349e-e0ec-4a97-a764-74a5ca4934af", "value": "196608:VgcHTgclqE+T9GoZ+JnKl3tcZXQvTz1nKzWsf:VTr9zKl3WZ8TBsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741876314, "uuid": "68da6d10-b9db-4777-9a7f-a3c517b411bf", "value": 6840832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741876314, "uuid": "7a3ea285-c7f5-470c-8c6a-7f983e2b70f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876314, "uuid": "2a199ceb-40d7-40b7-abeb-5fc5cdb554e7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.9380.2672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7490179d-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825008, "uuid": "631acc4a-06b1-46d2-8752-bfe5dadd196b", "comment": "Malware payload (Prometei)", "value": "3ce5927c457ae07ab83af8aff271c70d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825008, "uuid": "0e1aa417-8eea-44e0-8475-7f3d4004aa84", "comment": "Malware payload (Prometei)", "value": "59791f8a3da1b26a54c39eb8101174cd2966e6adabf4ec3c1a8c2db0658ab95d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825008, "uuid": "6ef76b9f-2211-4565-8dbb-5af3d03fe5d0", "comment": "Malware payload (Prometei)", "value": "284d5bc231c966837307ebdbb11064f77f75dd9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825008, "uuid": "a17b2c52-f80a-45b9-9cb2-fed806e887e9", "comment": "Malware payload (Prometei)", "value": "bdd70fdf57274634e98c6a0ef4e54b45f9e2b3b8e878b0fc514d623f3752b76087b23c24f06c6b783447cab863fad571", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825008, "uuid": "5078e282-d443-4b13-8409-34393186ed7c", "value": "T1019423F8C87D2E30D8169B3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825008, "uuid": "5bfce9dd-f50f-4227-8e35-8cafd3d0c9b0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgU:25WOSACZSV6eKRH5EPiamb4DsDwwcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825008, "uuid": "1b4357a2-25f4-4dc7-aac7-a890e109bf45", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825008, "uuid": "62650d84-0adc-40fd-bf45-6dcece2ea25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825008, "uuid": "0c1e6d35-8194-4bac-a66f-2691fc8f370d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1d7442-ffaf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741831304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831304, "uuid": "37a11ab1-bf16-469c-a7c4-a363afcfd482", "comment": "Malware payload (Prometei)", "value": "1be9a06d7a13e05ac799b584a6f5f928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831304, "uuid": "99622fb5-7edf-4a58-9819-7eef4d2c549e", "comment": "Malware payload (Prometei)", "value": "599780904c0f76f0ab7f539181f9fa09557cf06f5d665775d91a5d3bda013fe5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831304, "uuid": "f8d76d7f-2d9f-43f1-940a-b935c37e5029", "comment": "Malware payload (Prometei)", "value": "d6e3010bbe53551264610e7f6e4338a0bc4500b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831304, "uuid": "7ea1cf2d-b6c4-4a5a-a1a3-afb968ab53f9", "comment": "Malware payload (Prometei)", "value": "152087fa28add5c29932d6e2cf2a1db73988f66dd477e595c46c5a0e0beee85443492e8a6deca2030a00f0f710f8832c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831304, "uuid": "5bc4ad89-63cc-4748-9e70-647514d90517", "value": "T181155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831304, "uuid": "cb1aa4f2-62c0-4cfe-81c9-f06771210137", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplT:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741831304, "uuid": "11218fb1-7df4-4926-a186-1d31a394b164", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741831304, "uuid": "dc18c528-82e2-4a0d-83ad-9646f5c47c66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831304, "uuid": "824467d1-0f22-4b7c-b09d-4636d5e04dc4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50b9b79-ffc5-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741841088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741841088, "uuid": "78e8b4b8-ccdf-49af-a213-2070935ac549", "comment": "Malware payload (LummaStealer)", "value": "65605c7d9ca4721aff5da72539b00729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741841088, "uuid": "c8f59523-ad73-46fe-a9b6-979d039b6ceb", "comment": "Malware payload (LummaStealer)", "value": "59f38b0c6535a71432a891ff97dd309d19e5ed3c068b3fed91045d1293a72c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741841088, "uuid": "c7f3215a-67df-4711-99b2-b7d3d43cf743", "comment": "Malware payload (LummaStealer)", "value": "9a566027023ba2d3dc5100a823812f7f87b99059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741841088, "uuid": "e8158d57-5243-4249-9268-ff3e17f50915", "comment": "Malware payload (LummaStealer)", "value": "160aad897ae53ff7a08dec4facb57a4bdff158396fc77756a967d219076b6bc3ccf4e8cd9a0b80fd0e1ef02886bc97b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741841088, "uuid": "e3bcf0e8-6a0e-45cd-9abb-7647e8a17bb5", "value": "T18955E03270C1C073FB8195B23598E37514ABF672DA2E4FC7A2B8E764904CAD117AA51F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741841088, "uuid": "8d3a60c0-76e5-4088-bfd5-690e330b430f", "value": "d462aa757f68629e41b3df6e6d4c6a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741841088, "uuid": "5009cd19-3c1a-47ee-be3d-c7230e9fd50f", "value": "24576:MAi/c6dNtEWZ4B+UsxoxbzmXyvlIWpfge1f/HNDR8qS7vlIWpfge1f/HNDR8qSkt:y0qNtnKB+UsxoxbzYi5po86r5po86E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741841088, "uuid": "03e0cf71-1794-4e2e-9033-c9c3de86608f", "value": 1387560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741841088, "uuid": "d7d1080c-d495-4747-a7ae-ad3e1fc1a996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741841088, "uuid": "458893b2-31db-454a-a42b-468cfdb04039", "value": "Kiddion's Modest Menu v.1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4695b736-ffc1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741839104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839104, "uuid": "723c2af6-44c8-41c0-8ddb-77633ca9f46e", "comment": "Malware payload (Prometei)", "value": "97fd917f3cd6cda225673488c00aa338", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839104, "uuid": "23a014ac-4312-4ce5-befc-45a084209c71", "comment": "Malware payload (Prometei)", "value": "5a30193ef6622bb67692affa18c0600003e5d734dfe14a960e70f81bc0f56976", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839104, "uuid": "1f6a0c4a-266f-40bb-8d11-bd8909f9e521", "comment": "Malware payload (Prometei)", "value": "5893b554b250329a263478330c7181efcb80d54a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839104, "uuid": "faaa9833-33fd-43b1-899e-87e4ebe587c9", "comment": "Malware payload (Prometei)", "value": "8cef1277ca4d5c3e4a87da9140bd1c5400e4397a9072472ef9b59b35477a7aa9eaec8bd17d4dbff345130a49665a8bf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839104, "uuid": "c21a5237-4a03-4ab9-8a5b-d4b2e3fa2dac", "value": "T1309423F8C87D2E30D8169B3CBB1A8268F0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839104, "uuid": "78167682-0a27-48c2-bbdc-1d138f885c86", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgL:25WOSACZSV6eKRH5EPiamb4DsDwwcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741839104, "uuid": "89ebe10f-5e32-44f4-ab65-49fccc2f68aa", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741839104, "uuid": "f6be2e28-09ad-4d90-94c1-7903b2963704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839104, "uuid": "fb3b1771-e24e-4d90-b995-6c7bb39a2ed2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171b5303-ffb6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741834300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834300, "uuid": "3e6e143e-b35a-4c6b-b840-6607a620d148", "comment": "Malware payload (Prometei)", "value": "72ad422e8e3acc947583574582762fe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834300, "uuid": "af25af8a-f90e-430f-9ab9-a6d66a650633", "comment": "Malware payload (Prometei)", "value": "5a68135f44d1ccfab9e1e0458205fb98cb3c76e2b4603b8946c71b1c8cf59d1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834300, "uuid": "aa53376d-2f5b-4348-b6a6-6cac682ff79d", "comment": "Malware payload (Prometei)", "value": "481a85560952bd615d06dd9bde433c3eb4a5a683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834300, "uuid": "48df70f2-8a59-474c-adf8-2bca92f3f064", "comment": "Malware payload (Prometei)", "value": "2b956c26775fa159d7a70a8c1abbc4d0a471cd2dae302540fd2e6240c80dbc305c24802cc7553ae04b8301ba83b0a9af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834300, "uuid": "3f7996a9-8c33-495c-be0f-31f8d9fb8946", "value": "T184155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834300, "uuid": "170fbfcd-a35f-4032-9282-5836b4d203df", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplk:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741834300, "uuid": "404545c8-2b0d-4f75-80c0-fb10c2ceaf7f", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741834300, "uuid": "c9f20225-611e-420f-90bf-97986a2c9497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834300, "uuid": "d66c6d2d-2eab-4ce1-95d1-7af73efe4619", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303cbdf8-001b-11f0-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1741877722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741877722, "uuid": "0576f438-c3ff-4969-ac1b-dd6968ceb01d", "comment": "Malware payload (RedLineStealer)", "value": "7685178d4a459b36e605853d3e08ab69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741877722, "uuid": "f8d22445-2bb0-493c-9332-379e47b1d20a", "comment": "Malware payload (RedLineStealer)", "value": "5b14caa155f6ea778f391015a79bce4fd03a387eef5d4c8fa5f962dfcb2953b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741877722, "uuid": "578d193d-1c0c-4941-80ba-e4a6fa642ae2", "comment": "Malware payload (RedLineStealer)", "value": "6bef7015cf72d88dbbfbc09350981ae4fd535a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741877722, "uuid": "89e28a49-00a4-4e24-8072-212983538cf4", "comment": "Malware payload (RedLineStealer)", "value": "537757da010c9bdf848534a897b701bbc240c0dcc96b237e9952cd925c9ebfe726bdba83c29470df9cde612eec2ea493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741877722, "uuid": "a2aff36a-3b89-4a37-b3ae-d1d6cbddbaf7", "value": "T1EDC49D81B359AD12DA6B06F6900518A01E71FF79E90BC71AAEC77FBF7EB23215111807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741877722, "uuid": "baf015e5-8db1-4423-bffd-c1fd23b616a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741877722, "uuid": "42fab4a9-4538-4c01-9948-0f5d9dd9bbd1", "value": "6144:YYqdc0NkzDVM/j6TIlA41w1cN3p0NIb88WsNMPaKFP3b2V122J0sL:Y9J8K7zMcN3CNIb88WsNMP5F1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741877722, "uuid": "13d48305-1d78-4000-90ca-fa3ee7d975f3", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741877722, "uuid": "3424b10c-49e7-4e05-b81b-7c08239d04fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741877722, "uuid": "31d7ff0c-74cf-4f18-9735-80976fcd1e14", "value": "7685178D4A459B36E605853D3E08AB69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e3e5f6-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824990, "uuid": "9952e471-1143-471f-afe0-eb74f51a8f68", "comment": "Malware payload (Prometei)", "value": "fdad47c73ea0e4e46417c0182cc24938", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824990, "uuid": "95abcc85-e7e9-437e-b372-c40471bb9ae7", "comment": "Malware payload (Prometei)", "value": "5bafb8d6db15444c1e4cf139619e5e8d9fbc0931e450e7312d4a39b7c15f6729", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824990, "uuid": "05913bae-bc33-49e4-811f-026e6f51a1cd", "comment": "Malware payload (Prometei)", "value": "80c09462b6b837e0eac39f814e2c5c36aa23774b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824990, "uuid": "ab3d04db-f1e3-42e0-854b-ab4165232088", "comment": "Malware payload (Prometei)", "value": "16159567d0ecefce80ee004d644753055120fc86ae29041839af0465030ca3be8f7f666e91a3e5ba8e48bb7dc229c847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824990, "uuid": "31d1bc51-4405-4ee1-aab9-b7a4a695ffd0", "value": "T116155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824990, "uuid": "ea7ee69c-c0f6-49f0-b60c-eea11fb73583", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplG:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824990, "uuid": "448870ea-c615-41ab-8848-1c531c014f2f", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824990, "uuid": "91e22e15-be8b-45da-a46a-fd15029aeb74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824990, "uuid": "a678b395-3094-4770-97c5-669a4cbd4054", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04385cff-0040-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741893539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741893539, "uuid": "041ed97c-1180-454a-8590-2b422266f8d3", "comment": "Malware payload (RemcosRAT)", "value": "d991048eb8a889fcac625b1cc39ee161", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741893539, "uuid": "1ddc8242-fd7b-4456-b673-b41c6025cbd8", "comment": "Malware payload (RemcosRAT)", "value": "5c0b548de0dd0dd6347486f125b9a106ab4573ac56ff339174627bde37e94f64", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741893539, "uuid": "1723ec08-79b0-42df-9f9a-3fffae5b04b0", "comment": "Malware payload (RemcosRAT)", "value": "3d1b5e2429fc1beec9ce6afd49ca1116d7d883e7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741893539, "uuid": "f261c5ee-aab4-47aa-8534-35f06714d25e", "comment": "Malware payload (RemcosRAT)", "value": "21af2f2f6c2779aff4a684b2f1b8937e48dc8b60869f589b725648fd8a29edd0ff5ea493713f5da9b8eacc2eacb300c5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741893539, "uuid": "f4737238-e1dc-4db6-ad47-249a84d214a8", "value": "T1935533375598D8B71DBE7E493EFA1948221A101296AD2494E43F8152B007B1BCBE7FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741893539, "uuid": "b071e884-e3d9-4913-9362-809666cb6ac7", "value": "24576:C2iS36KS1j5z5Hp9/lFAMmL7OkfzXJ5hFocV8UXDtpqVX:CTYqdb/c1LlrXJ5ccV8UTaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741893539, "uuid": "ee85324c-cdd0-4384-a796-0ce589e23d42", "value": 1287148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741893539, "uuid": "2afeebde-9980-44a3-b6ee-90cb4d67e57f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741893539, "uuid": "29e2eba5-49cf-4073-bcec-08bf1df1f299", "value": "Quotation.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa36ad7-0054-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741902543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741902543, "uuid": "d536f486-81ae-44c8-9823-c5d27c409bf0", "comment": "Malware payload (AsyncRAT)", "value": "e8a999894fa78db22e11e640d8cdf536", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741902543, "uuid": "9fd41d7a-deb5-49a2-9a36-17a0aea41974", "comment": "Malware payload (AsyncRAT)", "value": "5c1784638ce809c986f4deaad6ee2d1963c3b90ad7a46f21121f6dd312a14599", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741902543, "uuid": "81a46e90-5244-48ce-86fb-b66f6bc4e8ff", "comment": "Malware payload (AsyncRAT)", "value": "16b3a98a0fe8b57fcf9d03506d69bee25c4ec3bf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741902543, "uuid": "041ca4dc-834b-4ad8-bb05-b33250289568", "comment": "Malware payload (AsyncRAT)", "value": "e89e1c7c1c99b4d894e826f92e24d6cfba7d20788a80fde1ac0c9a9e24087d87080b7d3641ebd9f9ffe0eb25f3cad7f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741902543, "uuid": "b4b8ba5d-7342-454c-80b8-cbd741686916", "value": "T12D838D1877E84515F1FFABB119F53252D67AF723A803D61F38C5019A1A13E88CD41AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741902543, "uuid": "a214f3c6-2ec2-4d63-b399-ee116a349ff4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741902543, "uuid": "90090230-d3ca-4126-8b00-24441c134b2d", "value": "1536:5oYmJBZBGEFG07Ll0P2GKTl+RCRSLb7yqcexO2686axOXMWCaNA:5oYmdfF0Psl+RCOb7y+O06axO8WZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741902543, "uuid": "e7cc7504-6d6f-4bc8-88a1-94786f10005d", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741902543, "uuid": "772172f7-cb56-4ecc-8001-354d0fe3fd88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741902543, "uuid": "3945e8bf-dfb8-458e-9e39-5f1163f0fd7c", "value": "Output.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11b113d-ffe2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741853510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853510, "uuid": "90e32847-91e4-4ba9-8faf-d0b04542cb12", "comment": "Malware payload (Prometei)", "value": "f014ff7ed224ff0136cc970c635d3c11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853510, "uuid": "5354b65f-a2fc-4207-be16-d4b0b64fbb78", "comment": "Malware payload (Prometei)", "value": "5c1a57c1adcc709ec2868ba7ce9ed8559b079a9d8704041e9fe08c41f6f42dba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853510, "uuid": "9226db90-9230-4778-839c-7dbb09f9ba8d", "comment": "Malware payload (Prometei)", "value": "b681b219309598517cd91a6f983b10d95324219a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853510, "uuid": "d8975c9d-a25d-409e-b723-fd5a7cad3e26", "comment": "Malware payload (Prometei)", "value": "265f52898a85d1352b7aea0ee99181907d1e4f601e307909e88cb9ed4725aa9460f3754cbbd6fea15ee11725d15fddd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853510, "uuid": "e9c7c849-3728-44c7-a548-538d518f9962", "value": "T167155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853510, "uuid": "76807be4-2e96-4687-8165-0f28d25c651d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl3:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741853510, "uuid": "ba24f333-df12-47b1-a837-e54099c5cb56", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741853510, "uuid": "875c75cf-64af-4c4a-8b86-4e83c23fb260", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853510, "uuid": "0eb0bba8-c5fc-45b1-8d76-04100e92f76b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca523abe-ffee-11ef-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741858653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858653, "uuid": "cf2533ce-dce9-429f-9eab-e59aaeb6aaec", "comment": "Malware payload (AsyncRAT)", "value": "7ac07195f03358c51fbb2e422a8b5452", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858653, "uuid": "43a2d278-4636-4007-879a-95c390de8aa9", "comment": "Malware payload (AsyncRAT)", "value": "5d12f3d6b8c0418215b29ad3afb0a3448966a6eaeb02dca2e89d6bff5d8e2570", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858653, "uuid": "49abf61c-f869-44cf-93bb-c8f4c74b9a99", "comment": "Malware payload (AsyncRAT)", "value": "a4e0c6f0797f655c26d920cf8474e21815435455", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858653, "uuid": "506e5ef2-d8c6-41da-8f77-493fed782436", "comment": "Malware payload (AsyncRAT)", "value": "5254da848988d697bf04d7bbd28e852993158c5c9d553a5a98fb5cd751af530a14da4b851f0dd06ccbf2c9bdbfb9280f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858653, "uuid": "0fce2177-a8c3-442b-a8ab-da00dee9cba5", "value": "T160F2D09DD600A87CDAB3CBBA410021F6621D7661B48ED10F2CD4F26A1B06DCF93995BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858653, "uuid": "2fc51234-7a8d-4e96-a69e-ac39bf3e58c0", "value": "768:hETn4o5bHOKYdjaALFIOldjZ7aN9QnIpdCEuEC2t:hETNbBALFtldZ7aD5D79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741858653, "uuid": "79c70dac-6b69-4fe6-a829-0d4db400d94c", "value": 37160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741858653, "uuid": "b7babd10-b26e-4605-8119-7aa1f03bf01d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858653, "uuid": "0feb48f6-6353-49af-a923-d85132bba709", "value": "Document25.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04db3ac1-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741833411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833411, "uuid": "a584a920-aedd-40e1-b774-4067fcd76b04", "comment": "Malware payload (Mirai)", "value": "154c909be7f01ea4dd1995fa3d270452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833411, "uuid": "14be3188-f317-434e-b73c-eb8ac92aa9a8", "comment": "Malware payload (Mirai)", "value": "5d51b742e82af05afae6eb67bca7f207fd2f97691ab1ad97ad951a6eb375ac71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833411, "uuid": "b6bf7d90-f528-4e3c-82d6-4b9a9c20fca5", "comment": "Malware payload (Mirai)", "value": "b11d82bfb2171c1a9b074564f5f790e1f4956327", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833411, "uuid": "56887cae-92f4-4544-8d20-a756b60de521", "comment": "Malware payload (Mirai)", "value": "2f324dae02dd30c855a3e27473d54648f98d0a31a6ceffd0a85b02597fe6c3905db0ec4ef334a2aee74099ca377d2709", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833411, "uuid": "7113620a-debf-4bf7-9435-6c263dc27840", "value": "T1EB929648EA29277EC7E173FFDB8546CD333697C9A74B7A26C235895533C0358AA24720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833411, "uuid": "62e06409-aa67-4610-89b2-ebfde4dab31e", "value": "384:H3yNIUU8qXfm6mNNnnnnnv9t0idcnnnnnnnnnnnEB02qf+wfYV0ZW4cF75:H3d8qXihzBkf+wf5W4cF75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833411, "uuid": "a6b69747-fb4b-498e-9817-900a2122a0f1", "value": 19459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833411, "uuid": "310b85d7-0dfe-40c9-9c4f-55de6b12bdf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833411, "uuid": "07f43ba2-67e8-474c-93da-9ca8ced1461f", "value": "miori.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2eadb3-0063-11f0-ad17-42010a9c0004", "comment": "Malware payload (NanoCore)", "timestamp": 1741908932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908932, "uuid": "c18b92b6-1aac-4c6b-88ce-8baca4dc0816", "comment": "Malware payload (NanoCore)", "value": "706591d8ede7abaeeb1f65e0eb2ca71e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908932, "uuid": "f6902132-7389-4d21-9b0d-ff887fa35686", "comment": "Malware payload (NanoCore)", "value": "5d700fc9a4aa2e6fe9df0c256f429f8a2ff303b4edd3bf496b730439b15e2017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908932, "uuid": "ae125653-0232-4bdc-97f8-bf9a3930e22d", "comment": "Malware payload (NanoCore)", "value": "4856737286c3dcf0e532d7af9c1262af6b0332f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908932, "uuid": "d68cb565-3d57-4ab5-a0e4-fc513731ffbd", "comment": "Malware payload (NanoCore)", "value": "868bd81662f59d7abe066b25267f06eef2e218f5279d21bca0bdcb8299b2293a3a46df75d3d7c801beaed67082612b7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908932, "uuid": "ab33260c-3869-48af-bc18-f81b121cfed9", "value": "T1AB64BF3D37AD496FD2CD9C786C29622F677986D24883E3C52C641CF34761BD80A8B4E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908932, "uuid": "073dc605-999d-43f3-a4b9-eeebe1bd72ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908932, "uuid": "d143bfa9-ffe7-4974-b981-b8cecae80a43", "value": "6144:WLV6Bta6dtJmakIM5qUHHH+/ybfSXD1jq7s5:WLV6BtpmkubfSXD1q7s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741908932, "uuid": "1163981a-475a-4147-8437-911f576c5e22", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741908932, "uuid": "7740167e-7126-4887-a848-2995d6a58ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908932, "uuid": "9cb310a0-8151-44e3-8a01-ce25f6d527ad", "value": "smashcord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8610bf9-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849630, "uuid": "91e63465-0767-4e71-a63c-b51416f034ee", "comment": "Malware payload (Mirai)", "value": "ea159891be9c918490e1d4fc1748748f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849630, "uuid": "771d8001-d1a1-4a98-a7d4-fcc66c021271", "comment": "Malware payload (Mirai)", "value": "5d9a191534e9bb8ac30d92b2c7773e9e5bdb5d10f61a4534779063d50a71857a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849630, "uuid": "845b06df-5c02-428c-ac33-0e686ec6aa9f", "comment": "Malware payload (Mirai)", "value": "aa5c3d1225b0db52a2da6dce1bd1b51bee38380e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849630, "uuid": "be1167b4-6b21-4eb4-92ad-e3ef9b32eddd", "comment": "Malware payload (Mirai)", "value": "f3f444868b084c90859faf55db0c0af0b6110b15a381fe6293b9cdbf5be6f7989e6ff020da17efb5450355bf619a906b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849630, "uuid": "8c47aafd-1bc9-498e-a5b1-f87f7e1434ea", "value": "T19D330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849630, "uuid": "3bafc920-67fa-46b3-a608-1414a0d04b0d", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGg:r/hqaJMDg9eqK806MHdkfQX6HuCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849630, "uuid": "0d2a1a61-81fc-4ea2-9bf4-1287fed4ff45", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849630, "uuid": "cded91da-4ac4-4313-9e0a-059e3572b14a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849630, "uuid": "d0161257-dbee-4fde-91ef-f06a06015001", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9989198a-0031-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741887347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887347, "uuid": "28a72575-df4a-4bff-809c-39f04c3b392d", "comment": "Malware payload", "value": "bb155df46265fe5b24195aa91c787f6b", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887347, "uuid": "eec0be0c-13ba-417a-8d34-a6aa65c4784a", "comment": "Malware payload", "value": "5e008b9324225a8884b0680bf661cafa80bef830d79038d582d5f95a42eb2234", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887347, "uuid": "9bc7b84b-5373-44fb-8854-6367bb96fe8c", "comment": "Malware payload", "value": "db20af16cbe832e31fd13920e54754ce2dca2441", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887347, "uuid": "4916d90e-0077-4e1f-9296-835c3e843eda", "comment": "Malware payload", "value": "a0d1b43ef336e6926f6f3c96a8f7ab7970076f9131148eea83dc3b227a8f396c3e1fc6459806aeaac7b2df86a7ed2a91", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887347, "uuid": "d090c9d6-3536-4cb9-9a83-dae2ac46f52f", "value": "T1AC43AE81B24C4E82D4B115B02436E7B3962FBC626B6D714763C1123768E72EDAC3B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887347, "uuid": "090fd83c-8ad2-4d25-8eda-66071d2d0acf", "value": "fd6273296301fc70d9cf826830afdfad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887347, "uuid": "b502e96d-f73b-418d-acd7-432616ac3604", "value": "384:FhTvpMjaXjGCrtYkgkjAr+q+eHzzbD/Q5qjse0Vev6RTKXbLHvSs+FZ9U5bOmnCS:FrDY7BHbDYe+uXbTvShhcbbVbmn668", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741887347, "uuid": "c4253f66-d6ba-4d71-a4a2-f557ab7dc1bf", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741887347, "uuid": "b7b079a5-669f-4aa3-a4b7-c2cc295b3b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887347, "uuid": "4c18da4e-ddf5-4f42-8379-99f31e97d2d6", "value": "big buhh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cc8b44-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883610, "uuid": "cdaaa490-39cd-441f-8571-30e98026cf9c", "comment": "Malware payload", "value": "52fa87493f7f9c45cdf014fdba74eb8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883610, "uuid": "7f56db78-391b-43d8-992e-a2bd9bc2d4b1", "comment": "Malware payload", "value": "5eecc65f6d517d38624b80cdfd7481a610918c3371d4879d99cc0bb65e28abb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883610, "uuid": "6fdbe00b-2d9b-4107-85d7-805de9bd6ecc", "comment": "Malware payload", "value": "2c18304a282f0df8131d0c3a2096bc52e6279914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883610, "uuid": "8b0557d9-26b3-45ed-a566-3278ea06209d", "comment": "Malware payload", "value": "fdee47c8f6ed8e4631dec4224f07c6fb51c8b8b3ef39b26ebd27d25a314fe3d3a0e220e88dd944bdaf70126b46c1b665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883610, "uuid": "3954c47f-c949-476d-95c0-1ca999405783", "value": "T193A5D023F2CBE43EE05D0B3B05B2A15494FBAA616422AE5396ECB4ECCF751501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883610, "uuid": "cd798dc2-84b6-4b31-a303-13061168b976", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883610, "uuid": "8a8e23fc-c06c-4492-9bb4-caea8911cad9", "value": "49152:HwREDDMmJ9X0wSp7U43ftiaOXziJD+QzMm1RBoBVtYHqgp:HwRERy3FMi9+Q4m1PQKqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883610, "uuid": "8cb10b63-e2f8-450a-b872-4b60d15eff42", "value": 2241552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883610, "uuid": "cd25b653-08b4-4188-90be-498162b9665d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883610, "uuid": "cfe03da4-e1ce-4328-86f0-945970bab409", "value": "vdpsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cac9ebf-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825049, "uuid": "c1acf41b-f1d0-4639-9425-5a3c88dfc94b", "comment": "Malware payload (Prometei)", "value": "a48844c195569a015a5b04b3364eadbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825049, "uuid": "3ae2c768-2e21-4276-9f26-15208378cbc5", "comment": "Malware payload (Prometei)", "value": "5f305e274891fe6a66541d75f35a4791c09ed97c880eedd230830ebd65883a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825049, "uuid": "1a8bad15-5fba-4ed9-9f9c-d2870a5da08d", "comment": "Malware payload (Prometei)", "value": "3ac1d8decdf445db97da4dcb5f9843e44831ba4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825049, "uuid": "dd04cdc9-4e24-479a-b85e-ce10e116553d", "comment": "Malware payload (Prometei)", "value": "97cef36b4bfff12460d16bdbaef2f0433d383d634012e2862d9f6424c6302144c9e52431d0cef7662683fdfa26b02d83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825049, "uuid": "34b6566b-2378-493f-9ae1-242a13310af2", "value": "T1AB155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825049, "uuid": "0ea558ac-61a5-4429-b8fa-5edc50a78fc6", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplF:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825049, "uuid": "5a094ab0-f06b-4e9c-bb7a-6112789e0224", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825049, "uuid": "c7dd7a85-79d0-46b4-93d3-ef8cf77aa314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825049, "uuid": "011129ad-5bc6-4a3d-8783-6a488bb7e1df", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a815052c-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855589, "uuid": "b59aa131-86cb-4628-9b23-7555ef74c2e5", "comment": "Malware payload (Meterpreter)", "value": "a1877f2028a8ba445df29b05ea8b9f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855589, "uuid": "e087320a-5ae0-4f3a-9c66-26858acf8f93", "comment": "Malware payload (Meterpreter)", "value": "5f76070d94d5f4041627be546fea6c23ac19597ed098e1587c6792fdc93ecffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855589, "uuid": "27716a68-3ca5-419c-9b76-de7eedd941f0", "comment": "Malware payload (Meterpreter)", "value": "b6f56bccae2077bef52c83c42b546717484fbc09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855589, "uuid": "79092e48-0dba-4110-a933-786b0d159b0d", "comment": "Malware payload (Meterpreter)", "value": "b488e8d1493f75f4e9d6163002c44b7f8dcb23c32f4c76b905e8b4bd533111227d5409b09d5477555c980cfabf87f96f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855589, "uuid": "a844632e-a136-4c78-9af1-896f6dcecb5f", "value": "T14773AD82E9C41462D1A6213D2AB13BB6A875F1FA3716C18B368CD9F4EBD1D7072253C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855589, "uuid": "dd3d8367-caa7-4af0-99e7-c85652a8585d", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855589, "uuid": "621c906b-e6ca-465c-b3c9-e8bc62401204", "value": "1536:IhLoNyeE7pWL6/MDWg4E6ygsk89PeqfmMb+KR0Nc8QsJq39:cgydpWOkDVvF/Peque0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855589, "uuid": "4ac5549a-a5a9-450e-8749-aff735f4cd45", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855589, "uuid": "ef838779-c39e-49c1-9424-6a2805854348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855589, "uuid": "7f1a3a1a-236e-4860-b05c-e309c700b7a6", "value": "shell.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a87a098-0006-11f0-ad17-42010a9c0004", "comment": "Malware payload (Gamaredon)", "timestamp": 1741868639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741868639, "uuid": "087b9df0-0ea3-4b64-8493-8304b96b2a3a", "comment": "Malware payload (Gamaredon)", "value": "6a804279e538bab70c53382f65766ba2", "object_relation": "md5", "Tag": [ { "name": "cortanaupdater-com", "colour": "#9FC096", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741868639, "uuid": "ff238c78-7774-4865-8d5a-f49f1bde07e6", "comment": "Malware payload (Gamaredon)", "value": "609f3068e0e2c55691d69bf9809a862054e1f49b052df1077fe0613e5b190dda", "object_relation": "sha256", "Tag": [ { "name": "cortanaupdater-com", "colour": "#9FC096", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741868639, "uuid": "3c981eb2-46f3-4288-82ab-e7a5217f04c7", "comment": "Malware payload (Gamaredon)", "value": "ff050fd16c72555741fb5ffc9e5c66482ef0bce5", "object_relation": "sha1", "Tag": [ { "name": "cortanaupdater-com", "colour": "#9FC096", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741868639, "uuid": "113b7c59-235b-4742-9e74-7b59b52488b3", "comment": "Malware payload (Gamaredon)", "value": "97e92bc06c66904175956caf95418ed80feb789d6eac41626a183ca51106d44d9e85a2a99e5dde5805d11908f3a55697", "object_relation": "sha3-384", "Tag": [ { "name": "cortanaupdater-com", "colour": "#9FC096", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741868639, "uuid": "31500748-8d85-490d-91f6-bdeab809c79d", "value": "T13635F0C0EA8455B1DD59AB705A36CE305223BEBC6934995E26CD3E273FFB2D36026047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741868639, "uuid": "5ef11f7d-bd8d-4d6c-9054-604412951784", "value": "1d1577d864d2da06952f7affd8635371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741868639, "uuid": "bc05f57e-47b9-4794-9c67-be672926ca37", "value": "24576:QKWsY1qWIYGLAJQXuxvPBBDIRdBeM0pzXYx/ZLFM7pvk5U+:dFRvUJQXuxHBqRR8zX8nWvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741868639, "uuid": "1ac86466-629e-438b-9c77-467aedc02f19", "value": 1152664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741868639, "uuid": "c7dcd95c-7069-42e3-b613-16c85578ab38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741868639, "uuid": "b275a754-08ed-4284-bf34-bc22fdc76e8c", "value": "7ZSfxMod_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb7a9f1-ffaf-11ef-ad17-42010a9c0004", "comment": "Malware payload (Xorbot)", "timestamp": 1741831602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831602, "uuid": "f2ca86e7-d98d-41ce-b731-14de7de07668", "comment": "Malware payload (Xorbot)", "value": "8732b7413636548a4753e87e9bc2a364", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831602, "uuid": "cec01722-3890-4a68-a6cc-74e262eaf6eb", "comment": "Malware payload (Xorbot)", "value": "60ac549d814ada70e9097a69f70f3529a91b90c01c3ee02d2bda770c054c14e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831602, "uuid": "b27a8fec-2e77-4058-a093-f8ab792ce200", "comment": "Malware payload (Xorbot)", "value": "6b1e1c5342019f456f59212da2a1a2cd6917ae4d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741831602, "uuid": "8c075a63-fd71-4f96-a1ad-f23bc24dcb4f", "comment": "Malware payload (Xorbot)", "value": "630ab1e5e35e19c44094f5e9b341366f648da8ca30f0ad32ad1429e0135d7ad9b8a391cbdeac6302f70191bfcc819e84", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831602, "uuid": "9b99e59e-3f23-418a-9c70-cfa2c312e4f0", "value": "T114D0C9CA945159F099C0C9FD35E2B95064514299DCC18B158ADFBCE04848E8C3048E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831602, "uuid": "46816804-6257-4b01-9273-06d76933dc84", "value": "6:lOnFflHMDoVLUDVlJoVLUDVHoVLUDVlM9Kd:KMnRlJRTRlM9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741831602, "uuid": "0e07967e-d02a-4175-bc19-468dbabf3355", "value": 211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741831602, "uuid": "f36eef7f-2356-418d-a765-548e52fe8540", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741831602, "uuid": "15cba848-4f2c-4505-b033-a226d3f649d7", "value": ".shell", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d906ee-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741849626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849626, "uuid": "1ebf502b-4f97-4f46-a7da-78e19cafe1e6", "comment": "Malware payload (LummaStealer)", "value": "b262bb96b63ac01762d1baf06387290c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849626, "uuid": "8f1b38bd-5f2e-42d1-a6a2-aa8d6f2d29e1", "comment": "Malware payload (LummaStealer)", "value": "61c9c78577f6c4506828cb6cf9ce9b3f15592a1cc8d462151df8983c7aaa5846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849626, "uuid": "0ccc934c-a15f-4138-942c-24d769a3eb4d", "comment": "Malware payload (LummaStealer)", "value": "15e96782f20249b4ae1ce85a2081146ac0041691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849626, "uuid": "662606bd-d450-459e-8930-de79f14f8ee7", "comment": "Malware payload (LummaStealer)", "value": "46ec1f13305592a418b628f5e342c0d0c176f2860de41a573f95238f04728ed8794d102fc206e99b3d6569bfabcbfbe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849626, "uuid": "9518e1fa-c824-41f2-8757-8e1be036ae11", "value": "T124A512CABE35036CE81503796815B284FC7492A5985D07FD2DF8A8632BBC79D1AFF061", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849626, "uuid": "560b26e7-b22b-4ade-80b9-8ec9271e9f3f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849626, "uuid": "fba1b651-0864-4fb3-a942-d938521ddb56", "value": "49152:cxejPhNOD+Pgtr5faeEhNAvmqhAVLtfOzy5o+v:earOD+PgfaeEEexLZWy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849626, "uuid": "7fb63edc-fc02-47a9-bb0b-be491ecfad6a", "value": 2209792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849626, "uuid": "eb5589a5-532d-4673-a90f-ad825fa64c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849626, "uuid": "6f8ed71d-6ba5-4aa0-a5f3-611b07abd728", "value": "b262bb96b63ac01762d1baf06387290c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c19733-001d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Copybara)", "timestamp": 1741878806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878806, "uuid": "97d8dfdd-4514-4ce3-91a1-265b7acbc57b", "comment": "Malware payload (Copybara)", "value": "ecba48fcb93b970205f2453fc0825e69", "object_relation": "md5", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878806, "uuid": "79eb1ee0-40a6-4633-a574-95cce7e1bbc8", "comment": "Malware payload (Copybara)", "value": "61d3806415988b203fdb11594836203501b956c01b7c551e8dff307e2b46eb60", "object_relation": "sha256", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878806, "uuid": "6d67e041-891a-4d4b-b8e8-1f55272f4fe8", "comment": "Malware payload (Copybara)", "value": "02ac0c2ccb310dd680e19686ae871645f370ed64", "object_relation": "sha1", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878806, "uuid": "e96b98f1-197c-4346-92bc-5f48bbd4efc4", "comment": "Malware payload (Copybara)", "value": "1f4977ef3d88f042318c01e83213bfc27814800c066ad3a069083fe6901fb7cd6a748e44ce42f36fcf8d9905b3d7ccb4", "object_relation": "sha3-384", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878806, "uuid": "14f79f3d-b229-461c-9d9b-41d2f67fdcbe", "value": "T155C63317DBA5E94EF8F787360439471B597399338BD3C24BACB4A6BC049B1C88B819D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878806, "uuid": "8115543a-2d8f-4c0f-9975-232155e8913f", "value": "196608:PDNJJMOKUXwfHTArFxV4cLpuLqp8IwcFyWTmj30AaRE5u/+PHDFDGD7D3DC4DUD4:PDhMtvTkFvumqYZTmj3gREu/cpCfzVA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741878806, "uuid": "2a730bd3-42c9-4719-99e2-9d171a40cd02", "value": 12048264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741878806, "uuid": "92388f9f-f19a-4363-a9d9-03c05b35099f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878806, "uuid": "243b7385-23c5-40fe-9a19-748d31a0c95b", "value": "8327f_MyPoste.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b81b9fe-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869124, "uuid": "7cfb3be1-9388-40b8-9627-de4cd7161f5f", "comment": "Malware payload (LummaStealer)", "value": "fcebf765658ef7adabf6a5b1cc1384f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869124, "uuid": "16da3bd0-dd8a-4ae2-8864-39c29c1552c6", "comment": "Malware payload (LummaStealer)", "value": "62a29296217254a2236699307ebf64d245aeb14c38f85fc714e161d4f2961bf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869124, "uuid": "45556697-0843-421d-8d67-6cd7f3fcd78a", "comment": "Malware payload (LummaStealer)", "value": "705760f3154799ba9ce17f27dc22bcdc1f519526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869124, "uuid": "97c7d3f9-bfaa-4250-a4a6-64b4ddc70611", "comment": "Malware payload (LummaStealer)", "value": "6bde7e2acb44f4d32e687d255c82b0fcd8a5b8d2ef6881fb94d5ce20a0f263aa34edd42e317d5fd1080cab411a89d9c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869124, "uuid": "fd2842bc-679e-41c6-a169-52a5c760cc21", "value": "T15A55E07270C1C173FA81A5B23598E3B5046BF672DA2D4FC7E2B4E3755048AC11BAA52F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869124, "uuid": "8010e2af-613c-47e0-aad8-9d497ce43bb1", "value": "d462aa757f68629e41b3df6e6d4c6a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869124, "uuid": "aa6db7cf-32fa-4879-b3f3-ebe3e53317c9", "value": "24576:5Ai/c6dNtEWZ4B+UsxoxbzmXpnmxBA4CRLnm9INN3TnmxBA4CRLnm9INN3:X0qNtnKB+UsxoxbzYpmrQRCiNZTmrQRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869124, "uuid": "90ea5078-0053-48c3-8cab-3b4551328d35", "value": 1385984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869124, "uuid": "edd2ed4b-8915-4735-b6b6-ae093ebc640b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869124, "uuid": "82ba2e9b-5629-479c-bb21-a4d61c0873aa", "value": "setupx 2.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b520f6-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864173, "uuid": "0163aae7-7e9a-48f1-8ade-66c9eefe429b", "comment": "Malware payload (Mirai)", "value": "a2fa4b8e89b723930ec83e672e70b59c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864173, "uuid": "cf4ecedf-f7cd-4d2c-bc2f-38a60796ebe1", "comment": "Malware payload (Mirai)", "value": "63976bd81f971c49f7389c9cde8b6fa01b4e22b1342f23c386377f519b10e7e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864173, "uuid": "0a74a67c-79be-4b47-8b9d-f0f789bcacd2", "comment": "Malware payload (Mirai)", "value": "0feb67adf37261f79675cc21f763af37067911c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864173, "uuid": "c4c57c2c-411d-4b75-9417-534fe73679d3", "comment": "Malware payload (Mirai)", "value": "70589de8de6a37155536d34c5f4a4bea25ffacc74fc61416e221829d968b9c8ae609af1aa3083249bc12b0b9e6df8090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864173, "uuid": "213c62fd-e1fd-465c-a0fa-8298463cb0d2", "value": "T15643F18EF69A4496A69F3C3CD5ED596CCE38D5043B4B0A4432E0AE917F722835AACC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864173, "uuid": "918b218b-13ce-4aa5-a017-ffb8f029203e", "value": "768:5hsBIq5ekV07BWtKVH2AaAIBFyQ42/nWl9GfyFVPptnLfSUnC1nYYWv:5Smq5NKsBv/WhFRLqU8Y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864173, "uuid": "ceaa0165-ac4e-45f8-a841-cb295676e3d3", "value": 55820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864173, "uuid": "06d42c1a-ea73-4b80-ac48-2279e731c38c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864173, "uuid": "7b490386-dcb8-4d99-84d1-082af0a854c2", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8517436c-0031-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741887313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887313, "uuid": "86b5e56d-d527-4594-b494-2cc7d36b8ded", "comment": "Malware payload", "value": "bba7aae96853c6e2b18082d50ddeea6e", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887313, "uuid": "2d13357f-eb8a-4262-95b8-c11fb2c16266", "comment": "Malware payload", "value": "64d3b43c7a4f5a157c4b778699881153acf24e602f65d18f67316aab576cb3e0", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887313, "uuid": "7587befb-53ef-4032-84ee-abb67ce08342", "comment": "Malware payload", "value": "e4615e99ce411b1826b7b50f6cb517d1ee3bfdab", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887313, "uuid": "fc2ce4d1-76a2-40a7-a8e8-5c38c32d3adf", "comment": "Malware payload", "value": "e95f5e46c7fccdfb02b5669058580f4838314023a953cdbafcc1d3118984f8102076e4d5ba7b94032a9be54062fd98b6", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887313, "uuid": "5ddf5bed-28fc-4346-8f5c-560af39fb5d7", "value": "T14CC32AAFA31023A7C431543B7E1284710553BD7AD2E155E2C8DE3A3F645A0E28D7FADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887313, "uuid": "b8c0ab4d-a0bb-4a7d-a47b-bc40f562a629", "value": "ec9063b53b89448b0b306b9848fcf2b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887313, "uuid": "2aa21305-572a-4aad-8fec-cee0481e6634", "value": "3072:QF7MBfoWZQ1UOuCUMPAITP9+gtf8Al4A0kNnFv9lwLraf/6E0Xc:HBwWZQrUqlP9+qfX4NcFv9GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741887313, "uuid": "5260e620-dffc-4afa-9009-2ceb2a1a0430", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741887313, "uuid": "88b49bf0-9ab4-46c2-97cf-73fd27ee689b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887313, "uuid": "849e7c7b-1616-4caa-9be4-a30dae271de5", "value": "n17pro3426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e96db2-0044-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895528, "uuid": "f9734678-79f8-4c5f-a8f0-ace1e570d8ef", "comment": "Malware payload", "value": "ee10cbd9ff0594376173cbdbf734a80e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895528, "uuid": "de7cb01e-6523-481e-a084-ad40af677f0c", "comment": "Malware payload", "value": "650747561c18315dd365378e9db39854a7979e7596fed303e344ffb43c1e9e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895528, "uuid": "0590664a-f9db-41bb-9552-8802742e340c", "comment": "Malware payload", "value": "879675192977244964d47ab57dd9b02e8f78a05e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895528, "uuid": "205d2ffe-a659-41aa-a13d-ed88464ed0f8", "comment": "Malware payload", "value": "d7ef159e9a296f72e8007c64a614630a9663c08b084d5e9f110b13bdf5eae142463e7fb7afed74b094e9fe0119829537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895528, "uuid": "f8291782-c828-4b6d-a3d5-992194d00022", "value": "T1EE08337AEE248859DA025B7F52504CF9180BBED8660364C1D931AB3B3FE0AE49D4C777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895528, "uuid": "58435144-7f6f-4745-8a65-647864ba1be0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895528, "uuid": "e24eaa91-a725-4ad3-be02-05c519f84991", "value": "1572864:ar9mj0JXUSBEy/r0FxcP2w3sI8mOrvHoBAWeRJ0J6/K37nPeoTpxT3rClVo:8EYJXUe/r8xZw3sIuceP0UibHX3rC/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895528, "uuid": "67ffc450-8d3a-4305-8f5e-0210f208535c", "value": 78709432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895528, "uuid": "d7bf8bad-0248-4575-8cec-a8f3bc72a510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895528, "uuid": "af3efb03-9c5c-4e7a-aa85-632009a27eeb", "value": "TV_Installer_2.9.6_x64_v1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e692dd9b-0026-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741882752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882752, "uuid": "d1fc2874-d5d8-4aea-87cd-b6ab1f86f795", "comment": "Malware payload", "value": "a89b9bdf5f28f4380f383ee199401bdc", "object_relation": "md5", "Tag": [ { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882752, "uuid": "e5f27c45-985d-4e2a-b83d-7d6b328109e8", "comment": "Malware payload", "value": "653db3b63bb0e8c2db675cd047b737cefebb1c955bd99e7a93899e2144d34358", "object_relation": "sha256", "Tag": [ { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882752, "uuid": "aec10b6e-6a25-4971-8916-264eb07028d6", "comment": "Malware payload", "value": "5a3bd2f12875098bd06b9f5a5a9405d9cf3af837", "object_relation": "sha1", "Tag": [ { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882752, "uuid": "d9726fb9-3364-4b5d-8510-ae5f94484bde", "comment": "Malware payload", "value": "1092833650565274e9c20986066be702b3707d7a8b511b12d0900c487414aaa173e0e7873c907fc1c83d93365e37c61e", "object_relation": "sha3-384", "Tag": [ { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882752, "uuid": "53bffe70-150f-48a9-9a2e-a4789dc1f576", "value": "T1837423576FC018B71099EA7D8C86BC2F21B829186F70CD9EC0402B2E645FBD7EB75924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882752, "uuid": "f299375c-6b2e-4782-8edf-16894a79b3c8", "value": "6144:S41RFbEZWzJq1YRHHeFvNH3BEnB9JHwYojBz4FBe1qJlTblIL0J86t:SGFo2Jq1YZeXxqaLjBQBeYnT+4tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741882752, "uuid": "32eb80e0-495f-4953-9f41-2b119de8f026", "value": 338911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741882752, "uuid": "afd25fd9-e70e-4b1b-ad81-10cc218f5f72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882752, "uuid": "fe126761-fe09-4660-9522-d896c7887762", "value": "wine (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64e7e44-ffa6-11ef-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1741827696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827696, "uuid": "dcfd762a-a657-41db-b75c-bb36ca136945", "comment": "Malware payload (RedLineStealer)", "value": "22c00ccdbab18812616ca11596d01bad", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827696, "uuid": "67df3f4d-d5c9-4b69-a59c-c147a18b4222", "comment": "Malware payload (RedLineStealer)", "value": "66b2852e9c3b6f98df012b7812ad72e13f234a54b4c1ad7c42258b6e62b632bd", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827696, "uuid": "09c5205b-df17-41b9-89e8-9439c46564cb", "comment": "Malware payload (RedLineStealer)", "value": "1bb64a238aadeab6dd86231121b60d3d4ee086d5", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827696, "uuid": "3cf9b6e5-a290-49bc-864e-7c7370c6c1e4", "comment": "Malware payload (RedLineStealer)", "value": "80a28354e1c51c83482a050b397e3273524e31bca11de98bd5c5c4baafdcb97137c11c453959447004dd2f0546138914", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827696, "uuid": "ad4c1575-a13f-4a36-bef8-e95f04b419d8", "value": "T13585CF26FE43C532C026167B9D5292A01F297F2DAD259B0FE1E47DC8772538129FD2A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827696, "uuid": "e63bd5d4-1a76-47f8-8137-fd224079a999", "value": "24576:RyBq7qBk+f9REUZcizbVp/gVetb+8+FDEmGSm2kIGPWIuYBzby5LwBA/6bH+2TxN:Ryj5f8Ir+FDEQePBRBzb6M9ru2Wvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741827696, "uuid": "0f693e9c-639e-41a4-9848-051b609463cc", "value": 1870427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741827696, "uuid": "437cbe51-520f-46e8-98cd-48af534c03b4", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827696, "uuid": "b22abb4c-c745-4b3f-b38c-ff55fbb0615c", "value": "RFQ_HB648836_Enquiry.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074e5aeb-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830408, "uuid": "5f6aff10-b14e-490e-a7b6-4703c4519e7d", "comment": "Malware payload (Mirai)", "value": "f1d3a2d0f03d3512e5f3c0ad30705c1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830408, "uuid": "5d19a65b-dd73-4800-b82d-b7aae41ec2de", "comment": "Malware payload (Mirai)", "value": "670447a89175f5a92d9bad1a39c0bea67945086cd82a35d037454257fe442645", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830408, "uuid": "b5300748-49d2-4aaa-84e5-dec7ec7f6ed8", "comment": "Malware payload (Mirai)", "value": "c75d2887287e806c1900786859e0b862c0f1a7ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830408, "uuid": "f0cca16e-af8a-4deb-bf57-91c94183b87e", "comment": "Malware payload (Mirai)", "value": "ed2f5f67ad7fc0b9b6dd9e893988dc366c7b300d4c9da7cf6ef90b59d55909eb66ddf925b6e23837170d9929e76aead7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830408, "uuid": "8d378d26-9098-4625-b232-7e56f4a0ad2e", "value": "T155530985B8819A25C6C517BBFE1F008D3316A758E2DE73129D141F647BCBD5F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830408, "uuid": "c258414b-3462-4293-a845-8fd278931435", "value": "1536:4dnVEcrYETmsfkai7qZTYSAMJAv0LoIbiBZrUQi:tcUEKek97qGSXy9ZrUQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830408, "uuid": "cd334aba-5127-400f-b194-d247877a4e15", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830408, "uuid": "de718535-8850-47d5-a377-c5fda46b1450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830408, "uuid": "cdc4b518-a7fe-4d2a-83d7-2e6b512208dc", "value": "3atoNational.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21172754-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (StormKitty)", "timestamp": 1741879414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879414, "uuid": "f09dae46-01ba-483c-85f5-58900c5b444f", "comment": "Malware payload (StormKitty)", "value": "50caf3c7bb08195a9ea1b3b3d7bc0f02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879414, "uuid": "a2c14751-f68f-4089-8e14-700c97a00e16", "comment": "Malware payload (StormKitty)", "value": "6711b98d5d8e89a7c027f59c099de2f12bea05299e76dfd398ed6ae90a3fd714", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879414, "uuid": "c78fbbe1-ad27-4911-881f-e11f67c197a6", "comment": "Malware payload (StormKitty)", "value": "13f238f27f159b6895cb28cebbdb0855f0fe3855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879414, "uuid": "38bb2ffd-c88b-4e07-bc39-2e9a4c9ec9fb", "comment": "Malware payload (StormKitty)", "value": "20ba46f6cfbc12f0dbf66c16143044dee48f75ab919bc0bb5be3d3b9aa80c4ed5d3b32b1488c38d2ce7683adbdf1083e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879414, "uuid": "ca7ef548-e77e-44d3-a59f-13fce50b0dda", "value": "T1990633971BA64133C826CFF5F4B4FA26CC30DC0005B14EAFBF62F9596926A76816C61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879414, "uuid": "1636dfe6-0a97-4e9c-95a2-67661e3f7dbc", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879414, "uuid": "faae15a5-8624-4bcc-9252-43ba9e62af64", "value": "98304:UePnIk+fZcURguwJaPquzFJi0E3znjVxkC2b4Vbp:LfIzRtguwgqo5E33wIVbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879414, "uuid": "455572c1-96c4-4788-80c1-9a2a7378bfc5", "value": 3675430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879414, "uuid": "764f4f07-9ff1-4834-8a8c-9a77349989be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879414, "uuid": "56111e12-0020-4b59-8231-39a82909a195", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bd4a82-ffd2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741846614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846614, "uuid": "b4ef2cc4-1a50-449f-b6ab-5621e69febd6", "comment": "Malware payload (Prometei)", "value": "b63982371c25786d6aa0c10797dfd967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846614, "uuid": "9284a2cc-2323-4a88-b321-ffeb7058c95c", "comment": "Malware payload (Prometei)", "value": "677aa829181ccdaf55e286806ac1f39da57f0c1e1323b6fb40a03022020e9a77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846614, "uuid": "433126c6-8747-4c02-9ec7-08f4121350a6", "comment": "Malware payload (Prometei)", "value": "978cfaa83a0c72588ca9e1b13c31700246bf5b27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846614, "uuid": "f5ac6992-c21d-41ff-84c2-e492daa2fe3a", "comment": "Malware payload (Prometei)", "value": "3b0b8573e835903c213eda1e4f3475dd16da0ed59a669574e6197e26300e3cc7b102664e7d55b49da9402a1815d05eae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846614, "uuid": "b1611e71-3fe4-4a7e-87ae-d824c0667d5c", "value": "T12F9423F8C83D2E3098169F3CBB5A8268F0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846614, "uuid": "fd04d520-ecb2-4ce3-b8d0-2122d4f7e8ff", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg2:25WOSACZSV6eKRH5EPiamb4DsDwwcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741846614, "uuid": "0f67d395-84bf-46ac-897a-d05323be09f3", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741846614, "uuid": "20badd75-9048-4a46-a6d6-907cd45d9869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846614, "uuid": "f8a6aa6b-ef12-4e63-86ab-200d53767925", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a075d52-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741825044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825044, "uuid": "58b8ad18-93e9-40ea-b8bf-ecfa9c454c8d", "comment": "Malware payload", "value": "693381abf58fd29dc6d6542e08391014", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825044, "uuid": "a0d0887f-b9da-4e23-b20d-a4d00a05295a", "comment": "Malware payload", "value": "68408635538a8ae9e1b0c1882515b34ccb3a5fe5208364d6c7ffb91a4916b04f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825044, "uuid": "1ad911c8-ec81-4114-a0f4-e15c14d85737", "comment": "Malware payload", "value": "93766e2ea0dbc356f39553b85c9acd4dfd28cace", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825044, "uuid": "50621704-fc35-4439-b4bd-aa6ca83b5e20", "comment": "Malware payload", "value": "cbf26ce2492492228dc8eee7bdbede7f6f3abc17f0fb32f0d1b52118aac9fb386b635b9f10ec66e1281f5925bcee08bf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825044, "uuid": "fa8680f3-6503-4bec-ae47-e2809ea2b490", "value": "T153D02E4CFC0308BBF0348CFA66EB2484D60FA3082E0AA6CC4182102BE8F0C90A020863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825044, "uuid": "f6fe5793-cfd2-4207-bbcc-d0eafec6c434", "value": "6:/VJswFGYj2VYtBLdY7Y+A0IQXo3FsDKVKhOXqIKa03IKq1IEE1IKBKW:/VJH2CpY7Y+HXjWghsONI08W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825044, "uuid": "586efdef-13f5-4511-b4fa-ea35135e58f5", "value": 257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825044, "uuid": "f6be5b27-7f9a-4458-b496-2d5dfe801fb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825044, "uuid": "ce625d61-9111-4b18-923a-98758c5470f8", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a5a5df-ffb8-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741835206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741835206, "uuid": "82889e91-6938-4212-9c9c-6d82df5cab81", "comment": "Malware payload", "value": "fa0cb327013e2deec1c7d4a1ef2f1e66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741835206, "uuid": "8e0f0760-9ea0-4553-aa9d-35257559cb9d", "comment": "Malware payload", "value": "68f56a206a19e48f31450a62acfe54b661d30930e4c93cc9d5e117af71a6c502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741835206, "uuid": "25c87f2d-e6af-481d-98ec-1e0b779fd18d", "comment": "Malware payload", "value": "c2530e7843482225b2622684e727d7b2c2000adc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741835206, "uuid": "ca7bf9c0-1494-446f-94c6-75f23c5c4112", "comment": "Malware payload", "value": "c621bbf80d061f2c06711aee945b8fe4bedde900f8a3dd114ed6acdedba6f55ab8edb2dd8a100b80a665156b1b938382", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741835206, "uuid": "b0c73b1e-1fbc-4372-9e53-f646214a33a2", "value": "T19F5533E621E735EBE4741BF41BEDC4C3EB5A2568CA0D5E81A498D42CED90F09D3294CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741835206, "uuid": "d19ce156-d139-47fe-8b44-2455bdbf5ee5", "value": "24576:PvswhZT3/QJLfl1X+Q47tv7T6inGEDOdiru3eSlNFpLwdzCXhYsrC3vES:njEflQ/573nydbeONLwFCRTrgcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741835206, "uuid": "1bd79642-ac38-4798-8811-b50a5ece4f95", "value": 1299147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741835206, "uuid": "7d375bea-bbd1-4e88-9acc-9dee51bf5209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741835206, "uuid": "b5e77494-07ca-4a63-a87e-b024a1f0fbf4", "value": "miner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3e56ea-ffdf-11ef-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741851918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851918, "uuid": "7dfb640c-69f1-4524-9685-ba6346e0940b", "comment": "Malware payload (DCRat)", "value": "f9ca2bade33b28000e77741f0d396c7f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851918, "uuid": "c8d072a9-b8de-4b09-91dd-1b34487605ec", "comment": "Malware payload (DCRat)", "value": "693cf45b243073eeb5479f4b29ff36c417b858b042363cf1a53d7623504a6d29", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851918, "uuid": "ea7bb032-8481-4b1d-b965-a8b9fb9b1655", "comment": "Malware payload (DCRat)", "value": "e413ea01b87c377f919611b86c296e91527f3f3a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851918, "uuid": "fa4978b3-af6f-4baf-bf14-fb4e36aa0710", "comment": "Malware payload (DCRat)", "value": "f7fee27d99c5c3f2a9502137cb0f2fe2711dbd57e7799f5a29ef06eadb03ee637a172c129900aa92afc090a38ac9a6e9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851918, "uuid": "ede191b3-7a3d-4e48-9de3-c480d82f1b57", "value": "T171954C08BD50D811E81E2A73CAFB040447706D816F62D35B39A97BFD5B213B36C696BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851918, "uuid": "8a043408-92bc-4685-9500-5ece8434c521", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851918, "uuid": "8ee4dd2a-4b92-42ab-a73e-0943f216c3ff", "value": "24576:O2G/nvxW3Ww0tgh+npucyvzZ0xSgMDJyi0scQO9LPnl:ObA30ghBItscQOdnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741851918, "uuid": "9f8e4617-5507-4590-93ff-6dd927e9b4bd", "value": 1897984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741851918, "uuid": "6f00f3b6-c2d6-4f50-bab1-bc8a640ba690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851918, "uuid": "0fcca034-c44c-4647-9d14-e483de4f0280", "value": "f9ca2bade33b28000e77741f0d396c7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3412703-ffb8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741835502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741835502, "uuid": "2782ea83-bf85-40b7-8ed2-5c3cf1874f49", "comment": "Malware payload (Mirai)", "value": "686274c42b41e018b3a166e7fc8c2430", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741835502, "uuid": "6c11127d-3430-4acc-9b3f-bf0d4ad8bb04", "comment": "Malware payload (Mirai)", "value": "6989d27bf4cf8ca70d4f3c6da8d61bfbdfd880ce9fcb699960ef2b707fa50f95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741835502, "uuid": "576988ee-37e3-48ca-a420-de3343631227", "comment": "Malware payload (Mirai)", "value": "f7de86fdeef702457f8534fc535eee11262d4b40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741835502, "uuid": "81233269-2195-49b9-a78b-d53911e88485", "comment": "Malware payload (Mirai)", "value": "da9126d8606d9d2360d1dd5640975c38e739535a454acdcb16918de90a8e020badf4e6f0a406e0f358d2150a0a2437ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741835502, "uuid": "c4ef7aa2-7307-456e-8e4e-c6b02df9bb83", "value": "T1F203F1D11361178C8362DB793DBD701A8538111B32D51E002AD3964EE64B715987BEBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741835502, "uuid": "fa619fce-4a4a-4f35-bfb8-68afd9a5bbb2", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTK:87vbq1lGAXSEYQjbChaAU2yU23MW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741835502, "uuid": "39e5bb0c-a1f2-43d6-ba92-0591cfd7f8e5", "value": 39536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741835502, "uuid": "8273a3b3-b102-4b8f-9c4f-dece2c8c53bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741835502, "uuid": "0d224aed-94ff-4a9c-93ed-577dc19e199a", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5d1554-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1741879381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879381, "uuid": "27c69bb3-fd21-4364-9ff2-cd2656ce75bf", "comment": "Malware payload (DarkCloud)", "value": "f07b59eb2e079540ea519fdf9f03519c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879381, "uuid": "45a36606-6f24-4982-a0a3-3bf458987096", "comment": "Malware payload (DarkCloud)", "value": "69952617a3441306cc846eaa2de8202cf1f46f789b5732149333a341cd1c1042", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879381, "uuid": "05386cc4-ea85-42e8-b8ce-6961f2b45e47", "comment": "Malware payload (DarkCloud)", "value": "9d53f824cd40413d551f04fdf14bae782e1a41e8", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879381, "uuid": "fd62664d-c67c-46ee-ba4a-cdb8bd67fdcf", "comment": "Malware payload (DarkCloud)", "value": "5a4eed348625c408902d2d7236be17cb6789ca7e372e997777989d3e409b775e3c46712985b58c0bb382635088a76e72", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879381, "uuid": "412dc7b7-46be-4197-80ed-76469a3176f5", "value": "T11A845B2BF600742AF873C6B5A5E4A25BA8152DB61A80EC2BF3815F0936351D7B5F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879381, "uuid": "fd02752f-825f-4cb8-a193-71bc4f83a89d", "value": "fc9cf63b0ad8c5564dca39f1bb53e81e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879381, "uuid": "d8e66997-ad53-4529-99e9-7d27cb1acd52", "value": "6144:v1ZUqVGUrknevjrT2pQuoQzjZMyyF+atD2698d1/w5KA81IJ8GpF6nuTmOOU:v1ZUqHrknevjraLoqVMyyX4jjYKkJj6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879381, "uuid": "7181ff0a-c62a-445b-8d28-b660d295680d", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879381, "uuid": "e2d0c34d-bcff-421a-afc1-123ed6f92194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879381, "uuid": "6251eaa7-2b8f-4445-b080-97817843222d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e68d0c1-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869102, "uuid": "a2ea3286-7e8c-4f3d-96cf-abbb54ca5001", "comment": "Malware payload (LummaStealer)", "value": "7cca34211a07de077586747453674386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869102, "uuid": "b50c54c6-66f3-4f73-ae7d-d2826672ab01", "comment": "Malware payload (LummaStealer)", "value": "699c4fb429bc1751228bc9d115b65fb23b9ce2f4bf99f54bcb4e1da298616a86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869102, "uuid": "3c7f99fd-0d5b-4580-9661-8ed3f4b79756", "comment": "Malware payload (LummaStealer)", "value": "43b59f17aa625e8d63aa8c5191eaf2383b1f2bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869102, "uuid": "00106921-9aae-4563-9192-4134085fe41f", "comment": "Malware payload (LummaStealer)", "value": "25c18052de5931418e96211297c9aa76752be366c282a30ccb58b18f4023c801526ee65ac2a6c2fff711835bb23f1b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869102, "uuid": "c456569e-bab0-4574-95ef-7b1c9288ae97", "value": "T1A3648E15F7A814F9E9A7863CC9424506EB72BC5647A0E7CF13A04A963F237E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869102, "uuid": "917cceae-1fd7-4b8e-b1fd-7058837248fd", "value": "aa0c445e85975cbae61add563ea78554", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869102, "uuid": "a2f0ad89-2eb1-426e-a154-d9bbad35ae43", "value": "6144:Sc1jgmcuzFzc4e3pvjLJhagmfZDp/h2EO:SSc6FzIpvjLPdEsEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869102, "uuid": "7990dd15-8329-48b6-b19c-fac157a6a5cd", "value": 335400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869102, "uuid": "846a693a-c503-4a91-b086-23c8dfe7408f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869102, "uuid": "de18d42f-9220-4503-ac23-4a691d561535", "value": "Arly.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25c8b83-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883604, "uuid": "3bacc264-e399-4a30-9869-ecd153320666", "comment": "Malware payload", "value": "ea4a92886095629fee8b5c6c14fc1206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883604, "uuid": "a9b07b53-40d5-4f55-b66f-04a0ed268e56", "comment": "Malware payload", "value": "69a9667d782593b89dd24ea22c1eea54c6406402e3dbd311d15f0f608289ec16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883604, "uuid": "607de2e5-b6de-4c5e-8459-97cb8dc64438", "comment": "Malware payload", "value": "355c9c11cfa095b78d9a90a0a66423e2126ba852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883604, "uuid": "0492820f-22c3-4853-8798-b3f0bef67cd4", "comment": "Malware payload", "value": "d18dc7d0aee93618dba29e42e36fbfab6e4b13aadb5d7b0e274c0f47be20525b5cb49eca663231334ade1a862f4346cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883604, "uuid": "a6c60aa3-93f3-4b4a-a4c6-55e703b19f52", "value": "T15BA5D023F2CBE03EE05D1B3B05B2A25494FB6A616422AD5796ECB4ECCF351601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883604, "uuid": "71bace41-d418-4048-a06d-c0a949e8e246", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883604, "uuid": "35870a91-27ba-4d1c-bcb5-ae17f5e9a3c3", "value": "49152:8wREDDMxqdqwDjVtU3ftiaOXziJD+QzMm1RBoBVtYHqgs1:8wRETqwDjVtU3FMi9+Q4m1PQKqv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883604, "uuid": "af0662a9-f463-4966-820e-a696951524db", "value": 2241424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883604, "uuid": "eef62fdc-aa58-4f9f-a002-a304ac42df05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883604, "uuid": "a7c08b86-1731-4b52-8cb2-59ec541a4de2", "value": "vbtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdc01c0-0024-11f0-ad17-42010a9c0004", "comment": "Malware payload (RustyStealer)", "timestamp": 1741881714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881714, "uuid": "fad7cf6f-914b-456c-b2a1-992481fb35a0", "comment": "Malware payload (RustyStealer)", "value": "8bac97f83725909af898da39324c94df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881714, "uuid": "aa2a3c67-3282-4c07-a31e-cdeffce2536d", "comment": "Malware payload (RustyStealer)", "value": "6a61deb10a548e3867f0bbed199acf4b53c65b4878a17aca67e68d972fc3cb7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881714, "uuid": "959aedc2-88bb-4065-8083-a4b329e7b419", "comment": "Malware payload (RustyStealer)", "value": "f13e858511c3ec295ab846879380907f6136ee13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881714, "uuid": "50440c17-ec60-4a3a-8db8-7395756dc999", "comment": "Malware payload (RustyStealer)", "value": "ac3732cfa23d91668b1d0022ed3aca0bfc895ce25c1abdd30c5cfa1dd7bbd6d8fbac5cf8b457036b9ce885a2740c1807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881714, "uuid": "3d87be72-7eab-4383-b7f1-598ad66b1bdc", "value": "T12E562312E76851E9D43BC43485925761BC327C8D0B31A6EB5A90BB3D2D30EF09E7DBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881714, "uuid": "1c3852ed-01e8-4df1-9fb8-d73f06bb5faa", "value": "1c67262429862fc3e3f98c6276d28caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881714, "uuid": "756e5c39-2eea-491d-9b30-b84a3b53df6b", "value": "196608:R1qmrSHiLJWmjPm0+IjjTB0IqhfWEKayDaI6HMaJTtGbR:ScsMu0FjVwh+j1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881714, "uuid": "55bac77e-9129-4b52-911e-39c464f6d067", "value": 6411864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881714, "uuid": "df0228ba-56f5-4db9-a2eb-d8636222a1d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881714, "uuid": "955c13b9-03d9-409a-9c68-f44983c2cb41", "value": "6a61deb10a548e3867f0bbed199acf4b53c65b4878a17aca67e68d972fc3cb7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa13111-ffea-11ef-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741856702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856702, "uuid": "d8a51391-787f-4c5e-b124-d97fbbfb523a", "comment": "Malware payload (AsyncRAT)", "value": "e2a48ba3f50ff2036f5c52abeb898d3b", "object_relation": "md5", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856702, "uuid": "173feea3-abc0-44db-accb-f7a896fa886d", "comment": "Malware payload (AsyncRAT)", "value": "6b53d4019646dfa3290973d1ee09ecc61d7e2e8c0d30c3ec381c666697e0d775", "object_relation": "sha256", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856702, "uuid": "d99a1527-742e-4728-b763-6f8572ecac1c", "comment": "Malware payload (AsyncRAT)", "value": "814ea2f13be42b59097e60a1c009871b170a318c", "object_relation": "sha1", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856702, "uuid": "f6f98b87-0f26-4c68-a7b3-eb3e28ba2c1b", "comment": "Malware payload (AsyncRAT)", "value": "ab10d2fce085ec63c3c5e76c718d2fc734c02970f80ed5d1da4c210f05e3cb7c25fa4b339af8a3a80c7eb68bb4d7805e", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856702, "uuid": "3f25e24d-53b7-446a-84e1-0d101c9ed18e", "value": "T185F005239C5E09454BE0D2FB915244E0CC31D1BE9753CE1475C47E1C4CB55944C8058C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856702, "uuid": "d2f4881b-fb82-4e47-9b31-7f03aacb6318", "value": "12:9NPrSf0VKdJQvju1CzRRE4m3jGnW7ZMBFVmGC0l0zSIKsnyVMn2:9NPr5VK7QqEEqnW72FVmGC0lDsy+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856702, "uuid": "b1bd286b-ffd3-4dfa-98be-d7473991e165", "value": 566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856702, "uuid": "86131f5d-0283-434d-a0db-cfab17599f60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856702, "uuid": "28379e8f-0602-4816-965c-4c70cb22b470", "value": "b..ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6baf67a-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741855614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855614, "uuid": "c736ff73-7212-43b7-91d3-22dd3c12984f", "comment": "Malware payload (Prometei)", "value": "b1269227817f1e0b61e9a501b4980d4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855614, "uuid": "987e9ad3-572e-4832-9071-82aabeb43944", "comment": "Malware payload (Prometei)", "value": "6b5a23e411c25e6026dace4febb84f50dc51dfff4032eb5393ba2b9fa8035072", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855614, "uuid": "882a3bcf-f281-4191-849d-a776ba76e78f", "comment": "Malware payload (Prometei)", "value": "058644fd5f96a54282db6e42b256981d0f1992b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855614, "uuid": "d1004702-8d2a-49bf-8e0d-0099b2b3f129", "comment": "Malware payload (Prometei)", "value": "7c44626093dee22e15b2755cf5f7b14572d662b2199eca656c6903dca2a7fed3f836d275efc20dd6d22fd3475f1361e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855614, "uuid": "ab0a7296-b6c5-4a0e-a232-18a84223e1a1", "value": "T17E9423F8C83D2E3098169F3CBB5A8268F0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855614, "uuid": "b662c655-c974-4521-b6f3-0481813df30f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgO:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855614, "uuid": "6b6c5adc-a20b-4e4d-bf1d-4563448c3261", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855614, "uuid": "9f7fc4e0-ed67-475f-ad8c-9fd7cde70bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855614, "uuid": "7d1c9076-f426-4dda-aa72-18d1b46de042", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87887d90-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825040, "uuid": "a71479cf-6554-4d87-80a1-b9f7f8a40698", "comment": "Malware payload (Prometei)", "value": "55598133955eabf96792bd310b9e9749", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825040, "uuid": "e6ffc915-a0a9-42b5-920c-2f71474c1f14", "comment": "Malware payload (Prometei)", "value": "6b6800c7114967745b33f8ac5cd47173b49fcf1cb8e0aa6f7ecfc432900bd5ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825040, "uuid": "74371548-6a80-48ae-9041-6806970e6790", "comment": "Malware payload (Prometei)", "value": "8238bd53fba65ef4a173593a26e1e8c4109ee5b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825040, "uuid": "9db34d3a-0ac8-4459-9104-99ca66c45d57", "comment": "Malware payload (Prometei)", "value": "f7161b5ab09263bf1b839da2ffa544d803d174e120c908e34564ce184562f6a20233e98e02dcc43a844dab1b38540c51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825040, "uuid": "0a65f21c-aa17-42cd-9446-376c4db7dca7", "value": "T1E5155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825040, "uuid": "92232284-3cfd-4f3e-92ea-4803de744ecb", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplu:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825040, "uuid": "2ce14e48-7ae0-4a5e-8afd-b12b90b199e1", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825040, "uuid": "a9f6b582-7f7a-4407-b6da-a756694bec35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825040, "uuid": "dccd379a-9788-4b86-b2fd-a470351f0262", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d54857-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741872955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872955, "uuid": "7579bffe-5d94-47ee-893d-2fd6979635e1", "comment": "Malware payload (XWorm)", "value": "4d0cfa1f8924d1f7d555f20bc887ba35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872955, "uuid": "422ce010-88b5-4e6d-a676-9466929b9a2a", "comment": "Malware payload (XWorm)", "value": "6b87ed040becee277c259003348710f4d43498637e7310916b58f241724ace58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872955, "uuid": "d4d7bc35-8bf1-4528-ba04-5fb42b3844e9", "comment": "Malware payload (XWorm)", "value": "cf8cdff68dec362bed465378c14dc4facc1bc6af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872955, "uuid": "90070017-dcea-4344-a8f2-c3a803d3e374", "comment": "Malware payload (XWorm)", "value": "a831c32ffa6da098bd8a0db7449c770ab0dc7755f22d434842e13e8772f0a7440b4569a68adc34b85bcacd33a3be8c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872955, "uuid": "63333f6a-248b-4594-98c5-5a2fe039b1f0", "value": "T10894F51CB77AEC87E4AE9F713D92E372C87E3C134E618856B140BFAE563640587C8960", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872955, "uuid": "fcc7fbee-8698-4eaf-a2d0-d9ab261174fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872955, "uuid": "93282291-83ca-4300-adb1-842f6de54642", "value": "1536:WctbiNEUBTimSaiUbh6v7RUh6smNkOehUuJkccckccccck:TtboJiCiUbh6CAkOehlJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872955, "uuid": "c3d0a269-64dd-4bbc-8ef7-7c81f4607ff6", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872955, "uuid": "d917b647-b9bb-4424-b6a6-6574201d5cba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872955, "uuid": "3a5920a6-563f-46a9-a59f-45c4091f17e0", "value": "10000.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f4b011-ffde-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741851473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851473, "uuid": "7f295fe3-e210-4d6a-8ce0-d3d7984e853f", "comment": "Malware payload", "value": "3b4b763b741546c9a26de28c66be89d7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851473, "uuid": "a1cfc1be-ef86-4d7e-b765-d28de8d9f0a8", "comment": "Malware payload", "value": "6bb7b6e1ab946b42730d2b4597baba24643eecf9018498a017582d9595a6da50", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851473, "uuid": "3a861aab-66f3-4cbb-9d48-42f9aa1963d7", "comment": "Malware payload", "value": "35941673bc95e6b50a794cfdc52230997c8db3f3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851473, "uuid": "5f1f1469-5bb6-4fe5-8aed-8921ab899524", "comment": "Malware payload", "value": "1ef09317f9b34a5bc143cbd9afa94fd42972ccbadd3fa276843af05baf6287a7fb95eefff8ceef0656b11a6ab91f359f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851473, "uuid": "e9e783af-cc94-4627-b795-921275529235", "value": "T141712B4B4DDF9E24AD2F102569AAB301606D3CBF66639BF7283122B44C75E491960CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851473, "uuid": "ed069888-da8a-4d51-a3ec-227ab56c79fd", "value": "96:kPtYYPYEPx8tujvrGNyXXI6EO1vMYAcor4vvLrHeFzOK9FsDA:kZbPxCufcyXXCYAx43HekAsDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741851473, "uuid": "1100a111-edd5-4b9b-9fe3-5b5e918c4a9f", "value": 3519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741851473, "uuid": "5215a7ae-67ca-4997-aa10-8ded925c8ca3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851473, "uuid": "7371cc0f-acbd-46a8-8cf7-ddb1c45a91ac", "value": "\u7535\u5b50\u53d1\u796820399201011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec24d81-0064-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741909019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909019, "uuid": "66e0a8eb-49c4-400b-b792-84666f9eb5d8", "comment": "Malware payload", "value": "36d4e51484c9bc7e0c18696b19dafb0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909019, "uuid": "64461ccd-9f23-4763-9422-cc40594ab86b", "comment": "Malware payload", "value": "6c969e2cc64a88dabba6348a7c4bb864ebd76e67a02730394bd572030bf3aa9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909019, "uuid": "276e5e37-4bae-4427-a5bf-5b8182120c79", "comment": "Malware payload", "value": "8090d1b8896a0fc9277e2180ea9e47a3e499c2ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909019, "uuid": "f4883b1a-2f1a-48d0-a2b0-79b1ca743691", "comment": "Malware payload", "value": "01aa453d8d85166bd803807282a4f760fa06ca1b2b7a3722d49db0c94a71ea0c5d4792a2792b794548a23c10eb1e23be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909019, "uuid": "ab6a990d-b4d4-4ddc-9788-454430d524eb", "value": "T1EE8512680EEB8E9BC2516F7C0AF5F17C657D86103C2DC716EE2248E59B30EEC7A81585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909019, "uuid": "5dc17b73-f701-4d2a-8b1d-a46684c5cf02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909019, "uuid": "49986bed-38fb-40d2-86b4-3caf817c9a28", "value": "49152:hoa7MZ7WttcZB9j6dnT5+5Zoa7MZ7WttcZB9j6dnT5+5F7eU:hoaYWtmjj45+LoaYWtmjj45+OU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741909019, "uuid": "f8997e8a-4456-4bf7-9acc-31b73903c943", "value": 1713152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741909019, "uuid": "4a2e5990-5bcb-47b4-8def-456da1b0f7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909019, "uuid": "82d96435-49a3-4a2c-8e6e-7b62dd721164", "value": "Floyd_Booter_v1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9c821e-ffac-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741830390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830390, "uuid": "a6b3731f-e923-4609-97d3-52e524cb5f1c", "comment": "Malware payload (Prometei)", "value": "6556704692f0325e8b215236d1ae9ebb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830390, "uuid": "9baba8e5-f828-477f-8dff-c29c9efd6c4c", "comment": "Malware payload (Prometei)", "value": "6cc43963253738fae70b942546c1c82eed00de78ef6f660b06d089449e23d991", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830390, "uuid": "d18ba7eb-41df-407a-b063-a6b2f6b4563e", "comment": "Malware payload (Prometei)", "value": "19447e9c5086d87f4b4e480c360c421f901cf5bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830390, "uuid": "2a098948-1cd3-4e99-885f-24774256c2bb", "comment": "Malware payload (Prometei)", "value": "7719fd0af0a69c2038402554e8df42738f606bf85beb31dce507f62f6a6c5b4278581694e67ebd4c28fd06ca12986a71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830390, "uuid": "a0be8e34-ed7f-434c-b353-eb796e7d07df", "value": "T1DE155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830390, "uuid": "a04d2712-29c9-4ad7-a98d-9b3c69be2c75", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplp:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830390, "uuid": "80d24549-f3f8-4dff-b4b1-02627f5bbe77", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830390, "uuid": "fa8d2dc8-bd5d-4ea5-a3a4-8df1287c1ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830390, "uuid": "2d334dea-53ed-460f-b775-1c098d49c03c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f04a8a-0013-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741874374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741874374, "uuid": "53e8dcf2-82f7-4436-a3be-08b898b45872", "comment": "Malware payload (MassLogger)", "value": "b0c5b355fca05258a634b395b66f04c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741874374, "uuid": "31cd1fd7-c832-4c71-a57d-3fc40b39a7d8", "comment": "Malware payload (MassLogger)", "value": "6d2cb72f8519ea6716edf231ddf36015328196b5e3add66e90a7bf75e100bcda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741874374, "uuid": "383f0c7f-557b-454a-a457-1e0edb7c27f6", "comment": "Malware payload (MassLogger)", "value": "0248c6e4d7e19989ce13fd9778bf7d543412d0a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741874374, "uuid": "97aeebce-76c4-4fd0-a6f0-5032dd3122d1", "comment": "Malware payload (MassLogger)", "value": "585a1bee0cec5828a3335ba24aa6f158a5f299bbf569e24afb57f7298ab547d056366c675ad3abea1ecf9cf9b5512bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741874374, "uuid": "972d6c51-b753-4833-9dd4-6a4c029acecf", "value": "T117250281F658CB50EA240BFC0E54D5B687B16DF8A531C2022DEEACD7B7D0B639529B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741874374, "uuid": "311637a9-a363-45e2-917d-6166777d837c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741874374, "uuid": "928d1761-834c-47d8-b84d-7fa2e9d6a71d", "value": "24576:wnOeAMOiXBVlVlVVVZlkgmAtAKHMxPHwM1kj4CTe5anVlV9:LMpRPPPblkhAt7H84V0Ge6PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741874374, "uuid": "0abd7cb0-479e-40e9-94c2-66e412c7e074", "value": 1010696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741874374, "uuid": "76e1c155-12c4-4c4b-9955-5d5060caca3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741874374, "uuid": "3d59bb78-7e84-4702-b182-145997f64ede", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aef7cb-fff4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741861011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861011, "uuid": "514f1385-86d6-4fa5-b6f5-339744e69730", "comment": "Malware payload", "value": "284d536dab5865150873e927a29cb0ae", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861011, "uuid": "2c531562-730b-4fc0-887b-7b62d9c6831d", "comment": "Malware payload", "value": "6d999b3e3b5a9e3826d483b3ae0c8ad3203bcfab0c3701f6e5399fd7201fe57d", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861011, "uuid": "eb8ba1e0-e1d7-4ab5-a1b5-4d847b4f8845", "comment": "Malware payload", "value": "15e1210c4b07503d17caf7d5e7ade2d32a3c3bec", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861011, "uuid": "5cca2890-b9c6-4085-9210-d87548fffd1e", "comment": "Malware payload", "value": "87731e00df08d1937cb2f19a334ba94e48b99129b1f7201040d7553297b132736c80d5530b36ad70b59347f2c8602128", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861011, "uuid": "475b9485-b2e3-4ad9-b24b-3a4b38ecc06c", "value": "T193118083F97C2198937A106C90129042065A3913970AC536F7BDCBB01F5E1B2B0BF99E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861011, "uuid": "11c774f4-6ae4-4472-8d33-2c26161dc197", "value": "24:GpHpM1fiaPQnfcchwwoGW5nfr/mxfGdHbfH7vTHOczOhpK2t:OHGVlQfcciEW5fruArTbyK2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861011, "uuid": "a472e482-bb8c-4976-b160-14e5edda2dd4", "value": 962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861011, "uuid": "8bef1538-4484-4d6e-ab1c-b620b8066b6e", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861011, "uuid": "9e00df27-3a54-4f55-91c5-2fa76eba78b6", "value": "6d999b3e3b5a9e3826d483b3ae0c8ad3203bcfab0c3701f6e5399fd7201fe57d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7078d75f-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload (Loki)", "timestamp": 1741883413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883413, "uuid": "8cf5bdb0-b21d-4df0-94e0-dbf16be8ecf2", "comment": "Malware payload (Loki)", "value": "4289167ed65cbfcb87876591f4ad4076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883413, "uuid": "2fdf321a-8401-413c-9f49-d9292efedfd8", "comment": "Malware payload (Loki)", "value": "6e85c6e048be7693bfb2db94882c8a61943f9526898d165be3d9aa1760d3779e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883413, "uuid": "3beab37e-e92d-4f2c-abd2-9d02898ce9c9", "comment": "Malware payload (Loki)", "value": "7ce852b8a6d4d134f0c1dd8a9fe2e3e1d3dd8ad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883413, "uuid": "8d6298f4-75e7-4dc3-8445-f075c57c524e", "comment": "Malware payload (Loki)", "value": "4bfd6d2d8fa82983a05a40adbfc88c132bacb07f3cb0ec59f9acf307a351b191cf68182762d5cbff7f42940c13718f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883413, "uuid": "f6da5118-59ca-4c6f-869a-08abb1dddb11", "value": "T12F25AE2273DDC361CB669173BF29B7016EBF3C614630B95B2F880D7DA950162262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883413, "uuid": "bcd0c650-9218-4ca8-b503-be83766bc28c", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883413, "uuid": "45a46b7b-9294-437f-b657-d4b9d17f5d3c", "value": "24576:Yu6J33O0c+JY5UZ+XC0kGso6Fa4kGi8qqMSWY:Su0c++OCvkGs9Fa4tqqoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883413, "uuid": "4f82f99a-dbe3-46ea-9338-f3356c7a5de1", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883413, "uuid": "f97e76c3-a001-4520-bc5d-bb9060df9616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883413, "uuid": "b49190ae-cd15-4e29-8bbd-70f876569387", "value": "z47LOKUYTRE4560987656789-98765.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febc6f35-001e-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741879357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879357, "uuid": "9f1e2697-3a57-4c84-898a-2519dcc1d697", "comment": "Malware payload (MassLogger)", "value": "4890b9e6f9b73e6ad6d1ddf88044eaf2", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879357, "uuid": "050f1eda-d31c-44a4-9206-766872cea8d2", "comment": "Malware payload (MassLogger)", "value": "6e9fb253ec84086b218bb9e2f2993ac0a628e562073f1ed2bdcd21d3d65baead", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879357, "uuid": "877eb4c0-6a36-4636-a172-2fe9d1261422", "comment": "Malware payload (MassLogger)", "value": "939c961a8e06366a0d25b9c2815b64c3c0ac989e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879357, "uuid": "48bf8cc0-4ea2-4a45-8cd0-4062ee823309", "comment": "Malware payload (MassLogger)", "value": "16bf99b7e3e3f1678f7142b7f7f7dcd30a62423b90739a887bf1dd5e31ec192372b83d4f3a6cfd438ce38f5cca94a5a2", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879357, "uuid": "ee043111-8ad2-4a3f-9c96-4d9ab108f23b", "value": "T166A3070A77E48914D9BF8631D17191210B3ABC964926D36D1FD8B8ED2B7BA8048C7FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879357, "uuid": "ecf2cd41-1454-4539-85dd-07d867c6bec4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879357, "uuid": "e39a2920-8b2e-4a7c-aead-b5d7bc023ca3", "value": "1536:wwa49h+QGk3uwMMmKbF5JVeioednbatrVf4UMR7pOpPwZZ:g49d1udMmcvJVeiNnbanbMDOpPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879357, "uuid": "0b9ffb84-7376-4de3-a58b-c228debf0d96", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879357, "uuid": "d19ee4dc-531a-4f90-8446-4c6beaabef53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879357, "uuid": "f70a9775-8d2f-46f4-a6fe-3e030b5bb19d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1bf1ce-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Pony)", "timestamp": 1741824917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824917, "uuid": "99d54190-ecb2-486e-851e-a0648c398130", "comment": "Malware payload (Pony)", "value": "147df0e4da4e5ba785f59eb891c54340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824917, "uuid": "4f91d3bc-5fe9-417d-8361-9beadfc19f13", "comment": "Malware payload (Pony)", "value": "6eb8565541ede040fba65bea6bf46e35ffeb6cbe3bfd80f0363915ff0e04ff7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824917, "uuid": "2d567797-7392-4ea7-aba8-0d61ee6315bc", "comment": "Malware payload (Pony)", "value": "09f152bc7d479c70f814326ebbd2630d5446742b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824917, "uuid": "8d179680-ba5f-4f83-832e-ef17c44bc249", "comment": "Malware payload (Pony)", "value": "b8bdafc9b087e7f104aa326d953e3626bd80db16b6a11ed5e7436b4f99ca5a8045307d698f9373bad070aff8615649a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824917, "uuid": "c081b26c-6f41-4415-844d-9ba49691de4b", "value": "T196F2F187B7C4695FC78E17718952C8B8327AD178B5C06B072E60A0235F2C8B6236DB69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824917, "uuid": "735c8294-4d71-449c-a3ed-8f385279faec", "value": "fd1c3e92ec51071bfc1efc821ae166ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824917, "uuid": "633a4f8d-b540-49e2-973f-0785b26b724d", "value": "768:8WXxiAaqJ0yIU8liWygucJ3Upct+ht5WM4vKf/aMuTjI7wD6HiK:hnXOyIlwg3actM/WPvKf/ahnI7UlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824917, "uuid": "e8f92426-45ce-4788-91f9-5b9dda26bb2d", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824917, "uuid": "34f55f1f-2e9d-4655-8271-6b8cdfb58a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824917, "uuid": "3ff0d536-2b6d-4b76-be77-55327eae56cb", "value": "147df0e4da4e5ba785f59eb891c54340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8ff0b8-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855674, "uuid": "aed07104-ff3a-41dd-b974-3bd345750b91", "comment": "Malware payload (Meterpreter)", "value": "dc247ae19ff9c3977999cd13e52eb557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855674, "uuid": "7bc5208f-77da-45ae-82c0-c49ac5589d93", "comment": "Malware payload (Meterpreter)", "value": "6eb944d5c6d9dd6d1be19f8fba0ebb84bff53a5d7c1e2bd36f735ae1f1c0035d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855674, "uuid": "3709927c-59c2-42c1-acfb-bf9090b45c3f", "comment": "Malware payload (Meterpreter)", "value": "46592a3483334bc8e27fcbb6c819c52e82bab299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855674, "uuid": "6f89d599-5910-421d-9d0b-f13d1087ac90", "comment": "Malware payload (Meterpreter)", "value": "0538cfb06018002c68a5dada2d66fd3fb703a8fe162b21004e2a79d449d10c681efb2f47f4c8e3b9852f7675a112777b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855674, "uuid": "40ead0d6-9453-4d92-96dc-223a2072e51d", "value": "T1F412C626F71720F6ED3685BA0947770EB262F02823125FCB8A4011472E16CD67C3DB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855674, "uuid": "8ba63096-ba72-43a6-ab52-3ae3fb9cf7e8", "value": "57d6e7112c8e716cfe2eb0ff9f36763c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855674, "uuid": "c90bbc3b-7618-4d0d-939d-91ed20d555bf", "value": "48:q0r+l6O5aXyn/hNhx4/jC/VEhM+bCeY7TWiqqilklb0E:dX0eu+JY7TW77k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855674, "uuid": "73ff94d2-cb43-4527-8cd2-dcfd2a957659", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855674, "uuid": "9ea3fc16-1bab-4869-8de1-d758ceb5db55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855674, "uuid": "2fd407c3-7b26-45cd-8d98-4b9f484d5cdd", "value": "443_2003_x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3441d6b7-ffda-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741849811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849811, "uuid": "90353ef1-0ccc-47a5-8105-53223bf00527", "comment": "Malware payload (RemcosRAT)", "value": "188e7231fcea51d4ead4d2fbfeb435b6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849811, "uuid": "ab9e3a03-6cda-4b98-953d-9c0dcc406c94", "comment": "Malware payload (RemcosRAT)", "value": "6ef147fad49263cc33d1b2391e2647ca0aa81a28c3e4bb4d195493b6b713407d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849811, "uuid": "60e72f66-4326-4182-95a8-2d9b85fc8fa9", "comment": "Malware payload (RemcosRAT)", "value": "8adac6b4a9f7ca88bea76e230c0803ec4efb32a6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849811, "uuid": "5f2c82d4-c0f4-4b15-9611-3fcbf8ab69c5", "comment": "Malware payload (RemcosRAT)", "value": "f6e77aa809c93b8925f59755839704a8fdccb2ebf7f3b0116135cba22b08cbba3eed683e2379cf702c5342531289d6a9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849811, "uuid": "e1c8da12-69b2-4ec5-a099-a745f9dc8fe5", "value": "T11E04A61BDE03951814BF82814A46BF8DF26864B73750BF8AB64D71DA4F3CA68CC749D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849811, "uuid": "8a6d57a1-d843-4585-b0b0-7b61d07e81c6", "value": "1536:ykRHY4yDIOnfEIMwkJEJl0DQQ2sJ+WGevl:HdcIOMRSJl0DQQ2sJ+WGevl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849811, "uuid": "42c90136-ab82-42c7-9cc5-7a3ff931205d", "value": 184483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849811, "uuid": "c043a0a5-3179-4c63-a06e-479a75841868", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849811, "uuid": "f4de8a3d-4e1a-4fd1-ba43-9a35516296cc", "value": "Doc13032025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5fc18a-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1741849583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849583, "uuid": "72f9e17b-6f51-478c-b2f4-1bcd9e084858", "comment": "Malware payload (Amadey)", "value": "43a2e7284798e5cc66f396fb174228dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849583, "uuid": "e25b6d2f-88a6-40fd-95bd-ec6fccd07227", "comment": "Malware payload (Amadey)", "value": "6ef7a6e85b08fa1827fa6bc09b9dc1c8eb7c10bb8758dbde2ed78dc0c1d86368", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849583, "uuid": "30754f63-8b4a-400a-8856-830162f98785", "comment": "Malware payload (Amadey)", "value": "cb838efcddf230727eadab5410b96429925cdc79", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849583, "uuid": "aa54fe89-522e-440a-9762-a2b53f890070", "comment": "Malware payload (Amadey)", "value": "7361e839107ea0e06abcb951090a0400daeaba465f4172e2330b2ec8915c51a47c40d57e67b4c1019f792fcd2eac302c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849583, "uuid": "9e606119-9ad4-4e7a-9e21-cf7c5d73a67d", "value": "T115A51231418CF46CC1E7AB319AC0F81A8867F4D52F885FF369A88EA24DF5A991507F35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849583, "uuid": "7fe573d4-7424-488e-814c-15df90d74063", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849583, "uuid": "7d3cfbf1-50e1-46ee-b0d1-ce90ef7a67cc", "value": "49152:/IjAcTdWwVAToIn7ZjMJ2g0TMvd1ppCDeMj1aGMTkD:/sFWwVIoIn7ZHzMvTnQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849583, "uuid": "3d6c9bb6-901a-4b08-a78d-8c1f73991905", "value": 2154496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849583, "uuid": "16613e62-e603-4aab-bc4f-cf40b91c282a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849583, "uuid": "1c42fcb8-5257-4be0-8948-f29dcd0e3c7a", "value": "43a2e7284798e5cc66f396fb174228dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c595fb8-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879406, "uuid": "a16ddcfc-0f42-4f37-b23c-b9d47d2cbd49", "comment": "Malware payload", "value": "beceb4d4ed86caff34bfbbda78f928f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879406, "uuid": "a74adcf7-1b58-44f1-a848-199c65870b56", "comment": "Malware payload", "value": "6ef96c48fd4918526f49c4f9cf852f8769ee6855a8e066e3b266adff4b263e54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879406, "uuid": "e4ece59f-d24b-4eac-a9a1-b07b5dffcb96", "comment": "Malware payload", "value": "5ce1f2c9107059e0ba2acc7261e3b66a88015978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879406, "uuid": "b0f961e3-0cb8-4d8e-a91a-d6b486944e18", "comment": "Malware payload", "value": "ef77ecb611208ad413affdcaecc2439ba997858e519dff4a93d0c91ff3a984040ae18e540285d4e2cb8f2ec37c4915c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879406, "uuid": "30b814a2-1ff3-45af-b4c2-a7c1357357da", "value": "T17B262B32DEA0640CF96355306AB49653453DAC3B680DC90EF7C2AE486971AC76EF6337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879406, "uuid": "7d6c7018-5931-4ed5-8d39-147a4270e7f5", "value": "dc4b0007fe7466fbef59bc90800ae326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879406, "uuid": "724470cb-aa0f-40e7-bf70-60133bb8dcee", "value": "98304:mVmmDT30NWc3Jcigc5l7JIrWVgBIGF35GMUwHzKhx:m8mDT30NWc3Jcigc5l7JIrWVgBIGF35W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879406, "uuid": "36dd12b3-4533-4fae-be29-a52b241eb027", "value": 4739072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879406, "uuid": "dc0768d3-759a-44e8-8cc6-aedfed100c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879406, "uuid": "c15488ac-fbba-4775-8452-9a0abe2157d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d6771d-ffc0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741838805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838805, "uuid": "fe648793-177c-428b-ab52-6f468b66d07b", "comment": "Malware payload (Mirai)", "value": "74a703b94696cb29331eeef9a4d41516", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838805, "uuid": "ea43c093-ce6d-43b0-8a55-d58bf157d0f7", "comment": "Malware payload (Mirai)", "value": "6f08e3b0459392464139f5962fff545360e0bee8e94ced4c440c1bd329e8710d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838805, "uuid": "41927e13-3fa9-4214-8487-9e04ed29e3a2", "comment": "Malware payload (Mirai)", "value": "e2b7ecff918d34027d26d8a80ed050b2ad9960dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838805, "uuid": "eeadfa41-7fef-4a0b-a791-9bfedf2e51e3", "comment": "Malware payload (Mirai)", "value": "d6e242225b2bbd3073f085c2997e439bf3dba90b132d37685cb9ccbf438fbd9a343c007d859d21c3ec0fb8a25b0bc4f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741838805, "uuid": "345eb127-8829-470c-82b9-e7540899f07a", "value": "T1DD51F48662042F3839636E13E7B6416832C590D7ACE9EB95DDECFAE10A9FC147640763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741838805, "uuid": "32d48038-ee09-4579-b35c-7f15107f4afe", "value": "48:vS+7F+7N7hS+k+6GS+gc+zPS+0+KWS+2+oUS+72+7o7US+fj+3bS+1+9RS+K+cgn:vS+7F+7N7hS+k+6GS+gc+zPS+0+KWS+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741838805, "uuid": "7a75f010-ff4e-4788-8ffe-4739706be067", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741838805, "uuid": "9971b0d9-94ba-4bc4-93ea-54bfd4504b66", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741838805, "uuid": "1defee3d-4416-40ce-ab57-087e73f384d5", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5e50e9-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864184, "uuid": "7e5bbbae-94e9-4a50-a8b4-fedecd6ea19b", "comment": "Malware payload (Mirai)", "value": "8e089f705a2851ea0086805a303af404", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864184, "uuid": "a9e729f3-b60e-4ca5-a185-bb94c1ea37c6", "comment": "Malware payload (Mirai)", "value": "6f48e5add90a7860946de0645642c9bba4c888c007571fecd522ab0875fcc758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864184, "uuid": "def642ee-31f8-4592-918a-b9cdd6ce2656", "comment": "Malware payload (Mirai)", "value": "722072adb173fa38a9dd6ce2c9ab75f15a91bdd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864184, "uuid": "0d5485c1-6eef-4abd-8f1b-ef8fbc0bab0d", "comment": "Malware payload (Mirai)", "value": "e76805208cc7a307a4dd53e05a20af875c5f4550d84674bfb645ddfea1e352232ef48551002cf58118e6537428d8adcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864184, "uuid": "2f625055-b318-490e-8548-69037376eeaf", "value": "T12533021A422D0D30E671517E64E149A856EB2FB0C19FBACF20385BCB224FB9D3B79546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864184, "uuid": "d41c74a0-a956-4574-a52f-0df5c27e13ea", "value": "1536:lSzHOzxmSLrbRIDkcSZWD5D86q6xYOSUmpfL0:lwMPiYcSZL4YHfL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864184, "uuid": "94ff8079-9d0a-4e47-969e-5021090532e7", "value": 54832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864184, "uuid": "fd98e9e8-7851-4871-adf2-33fe55f8d9b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864184, "uuid": "45310d45-b1d2-40f8-b0b4-4744915a79c6", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9fa2c3-000d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741871783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871783, "uuid": "17539c53-2f34-4641-9b93-c50d96814d0a", "comment": "Malware payload (Formbook)", "value": "5c1022d908beaff7f12da5e9fa8f2f18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871783, "uuid": "3a88c9d7-c31e-4b2d-bd4a-3fb007443795", "comment": "Malware payload (Formbook)", "value": "6f8e85f3704f0179d0854b1c278784441b0e555f6cbbd7af19a677afaefef004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871783, "uuid": "7236b50b-5df1-4af3-8e1d-2760588cf0f5", "comment": "Malware payload (Formbook)", "value": "52c0121f5b75a55633571ac74316b8ede73fb774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871783, "uuid": "025273f2-7c9c-4e8d-b657-81d5b695f92a", "comment": "Malware payload (Formbook)", "value": "755668037c302152c3ce9debe5e78c42822193111f5f5084abe4413f9765ec24cbf9aa4324756bc871346e0badbad9c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871783, "uuid": "79c1001c-1f25-4528-b5e7-537ce87dbbad", "value": "T1C1E4E0983645F99FC897C9728E60ED71A6616D7A930BC30390DB5EEFB80D197DE040A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871783, "uuid": "632173e4-11d5-4ac0-961a-c22e55284f12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871783, "uuid": "71ffe824-1c12-48ce-944f-c130fd877d7c", "value": "12288:5w5MOiV1DtFkBbn11lwRl3l3ZVq+SZGPpatO9IpDDDg4MKExS0ISen0rhbYAgJSX:5w5MOiXJFAb11eRds+vPIweH4KEx5Pe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741871783, "uuid": "d3e34895-b02f-4313-b605-4affb62058dd", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741871783, "uuid": "4349cf13-424a-4432-bcc2-2e839fe518ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871783, "uuid": "81e67ced-4d4c-49d1-90ca-80fbd10249cb", "value": "FbL6HMA75LatWGE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dbcdf2-ffa6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741827393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827393, "uuid": "80740c6b-1b20-4591-bb3d-0f60cd4a2183", "comment": "Malware payload (Prometei)", "value": "01ee18ac7ec558ddbcad55b441ba4878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827393, "uuid": "5d8a2964-7edf-4373-b392-804a1221c910", "comment": "Malware payload (Prometei)", "value": "70107bc892826cd2e5990f0867c956d82b0cfd58e4d5cbcde8b57bde7a42cd36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827393, "uuid": "6a03eb13-51a9-47ac-843f-af51e7547b33", "comment": "Malware payload (Prometei)", "value": "ea8219e885c5676df107917c10cf5510f4346d77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827393, "uuid": "c1c44968-a410-43fb-bf1c-b8c668e979a1", "comment": "Malware payload (Prometei)", "value": "32a7f430987caf4c733a78f905f52580a3f4df3680defa0c10ea382381ca43fc44d4cc9870d7cd4533eccfea788ffa18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827393, "uuid": "28933184-688a-497c-8348-30f375256c37", "value": "T1789423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827393, "uuid": "9411bf58-1b06-4f10-b9b8-3d923114a659", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgT:25WOSACZSV6eKRH5EPiamb4DsDwwcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741827393, "uuid": "da585fcc-c8aa-4864-9f43-1346bc87c357", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741827393, "uuid": "e6393e49-edfb-48e1-9dcc-6b9f3b76f83a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827393, "uuid": "78d6705c-1832-4c34-a8b8-32d7c230ff19", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771f719e-ffcc-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741843910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843910, "uuid": "bc206688-ae4c-4d60-a5d2-f3d15044999a", "comment": "Malware payload (Prometei)", "value": "806e773367a3c6d32c03b03dd32970a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843910, "uuid": "02449e40-80d9-4267-abed-fd17321d9e45", "comment": "Malware payload (Prometei)", "value": "7020f00b03ea00514240a7ae0a23c6a8e1a5ef7f90eb34ea43ea2d19c7938504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843910, "uuid": "e1d755ed-84d2-4f50-9b14-0b40f55e99d0", "comment": "Malware payload (Prometei)", "value": "63e9352c0eeac12fb1789d7d01616ddd25610f1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843910, "uuid": "e2845806-32bc-49c6-8613-4d51e817674d", "comment": "Malware payload (Prometei)", "value": "288b0bf1f246890ca075f2cf4ed5a658fdffe2d1e860d8c75cd84fdb80655ae89860da55a81dae2c8915693b5e1e691b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741843910, "uuid": "b2d1e27b-9871-4efa-bb87-711079a01200", "value": "T10C9423F8C87D2E3098169B3CBB1A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741843910, "uuid": "efb9c41f-81d5-43ef-bf44-687d26c25fb0", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg2e:25WOSACZSV6eKRH5EPiamb4DsDwwcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741843910, "uuid": "c71d45e3-24ee-4a87-ab26-406fab3542a9", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741843910, "uuid": "700dbaf7-f821-4eff-94c6-e9afce6eca55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741843910, "uuid": "089df31f-d0b8-4933-909b-b0162162960a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78686d73-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload (SpyNote)", "timestamp": 1741882997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882997, "uuid": "d80156c7-4734-40a5-8319-28dafb6ccf28", "comment": "Malware payload (SpyNote)", "value": "7eb51c74216426237bdb9e4b26272d3e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882997, "uuid": "7ee789b2-7a5e-42e3-8db9-fc91be5ddd3f", "comment": "Malware payload (SpyNote)", "value": "702a68b14db170b46d3c56582a3fcc77d1c2061d7d859ea427d0889130f98bf7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882997, "uuid": "7376b6f1-e037-4702-a2ad-bc18798786dc", "comment": "Malware payload (SpyNote)", "value": "976319c9cded2bbcd3797551bed37edff1ee1d82", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882997, "uuid": "43afd9b1-738b-42d9-a0f1-e8d8180aff9a", "comment": "Malware payload (SpyNote)", "value": "b1daec164437c259ce46690e9232e511b1af18d7b679dc2f0ff9a0ce1bf9a8c411c858f2f90e14540401f3d8b37c9192", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882997, "uuid": "92eedd14-5263-45d0-9d10-ed8abece79a3", "value": "T14C26F143FB45DB8AD8AA83F56F770DA92A130F14C703A6D704557A6E2E7B1C10EC5A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882997, "uuid": "e26a5a6d-8489-407e-b74e-e3f57a8777e8", "value": "98304:1edduQuSEtzpd3wX41GrzYKNqCmzBzB7T/0tcL6idLL:1jZoXhWzrwcdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741882997, "uuid": "aa6dfcb1-b62b-47ee-a67a-edd9b78ba31c", "value": 4640213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741882997, "uuid": "d1d6271a-19c8-465f-a786-a7c39a9cce95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882997, "uuid": "f45b035c-d079-4ff4-8dc3-5bcd70cee67a", "value": "Blockchain.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f7fafe-0043-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895186, "uuid": "f587b1f0-27a0-4142-8a24-d1d77cfb8fdc", "comment": "Malware payload", "value": "2024b1a999fa8a5bfb111442c988508e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895186, "uuid": "976e7139-0991-4b73-8652-be5a1cf68af4", "comment": "Malware payload", "value": "7037eb45143cec78df496c1d1dc9d45ffbb4d2f282770b01714a661032819fdc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895186, "uuid": "b028c48e-913e-437d-b729-59aca3a4b2d0", "comment": "Malware payload", "value": "aa8df677a336fb97c0c82c864029f449f571b348", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895186, "uuid": "ea1b9f5f-02a9-43e1-b089-a66138ee76e0", "comment": "Malware payload", "value": "1605a0cd1ddb18678706f496f03cb6f29c9f07414a550326fa3c39649bf4e89bc235e9a5233d9e40a9bb54862564aa51", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895186, "uuid": "4c749d15-37fe-4234-a078-4f13a221a628", "value": "T102B73331B99E8136EA5E44B1A93AAA2FA43D7DE30B7044DB53E4F85714315C3A334B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895186, "uuid": "38e4472d-2a34-42a5-9085-675a3a148b33", "value": "1572864:CFT5lrefp7j7j4o3nipMi286l2R+3jUZFPohQAhI:CFT5l6bng2ZcR+TygaAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895186, "uuid": "b6041e45-f372-431b-9291-3dc5d809846a", "value": 51272704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895186, "uuid": "903784cd-68ee-4966-83a8-70a8e1acd9ae", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895186, "uuid": "b46c5c8e-132c-42f7-9a0f-9f1367374ec0", "value": "73aeaf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0556967-0047-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741896834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896834, "uuid": "00a5f394-45f2-4128-8f06-0bcd9d63add6", "comment": "Malware payload", "value": "d3ae01744f2459e0ad51938fecf597e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "\u8d85 \u738b", "colour": "#AAB0B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896834, "uuid": "57530e25-6da5-4eb4-9072-ac6eee568ba5", "comment": "Malware payload", "value": "708c39e1249e5d40a9a33017d3d3f7cf8f3e6054adb2c2415cd1e4b686e9373e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "\u8d85 \u738b", "colour": "#AAB0B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896834, "uuid": "3156ebe4-1414-4eac-9e92-44a80e522854", "comment": "Malware payload", "value": "4354f076c5c81a2bd63ece2e5730d0b692d42f89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "\u8d85 \u738b", "colour": "#AAB0B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896834, "uuid": "9a3891cf-b530-4759-9a10-a466c2bdebd2", "comment": "Malware payload", "value": "94c7f1ceca50d3f261803e8f69a6d17da96a849fd3b57c167e7486af95a4cffa4005935669b293628eb40dae1ad7a0d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "\u8d85 \u738b", "colour": "#AAB0B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896834, "uuid": "0c6d7b73-6c39-440e-a276-23553fd5411d", "value": "T113371227F3846D2FC0AB0B355677C2A0A83B7A2279128D7797F8094C8F359546E3F646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896834, "uuid": "0f491bb2-3d4e-4673-99de-c3ac2e702cc2", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896834, "uuid": "2fefab5b-c8a2-4b39-ae77-bda2f8928aad", "value": "393216:ZR48pW9jmXek5O2yWIXYS13xwmWxQ0lidyTiaKYQBvKJAN/9l4liq:ZR48pW4dO2yT13xJWZlpL+vKm9Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741896834, "uuid": "f2efc095-4a8e-4fcf-81ff-00b0111e4ecd", "value": 22913736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741896834, "uuid": "7a07f6ed-0de3-4bfa-b727-604bceaaf87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896834, "uuid": "e91310d6-5bce-4b80-9e2f-eac7b78a6b16", "value": "Galaxy Swapper V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039846af-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883230, "uuid": "fc131e2b-b358-46d3-9cf8-97fa2c9f5cb4", "comment": "Malware payload", "value": "c3bae03214c0454b47361e222fc6e739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883230, "uuid": "b5f4eb7d-e2f7-4bcb-b40f-193963d19dbc", "comment": "Malware payload", "value": "71c81b81687e69462e54a5bcb9e83e781acb08e13a075204df390aefe192b879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883230, "uuid": "67987190-efd3-4796-a139-332958ca6699", "comment": "Malware payload", "value": "96f7984d2eaac7792ef0ee6104029c98e3d3d59c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883230, "uuid": "6ba7f945-3588-48b1-a2e9-3ec2c6b76994", "comment": "Malware payload", "value": "f0d7203964ab142049100fd2bb4bc1f11fbda104da87aa6b75e0a3a264ea213150adb3d7410348be8831ac8f77761bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883230, "uuid": "ca96fd57-8a13-43c4-b88e-9188c76f41b0", "value": "T11AA5D023F2CBE03EE05D0B3B05B2A25494FBAA616522BD5786ECB4ACCF351501D3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883230, "uuid": "b05456cd-16ac-4598-a00e-456c45977f2b", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883230, "uuid": "a7812dea-5e04-4677-bb31-f45592a10a22", "value": "49152:rwREDDMJGBShrU3ftiaOXziJD+QzMm1RBoBVtYHqgW:rwREeXY3FMi9+Q4m1PQKq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883230, "uuid": "6dcc7aaa-0b55-4b9c-98c1-c8f573d99983", "value": 2241200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883230, "uuid": "166b022c-09a7-4480-b793-6975b46f62dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883230, "uuid": "e00559e4-ea79-4f46-9a4c-efa4f0330f18", "value": "cflbtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa28cd9-0023-11f0-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741881318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881318, "uuid": "d7a469dd-3997-4f5b-9c13-85b2cab8474f", "comment": "Malware payload (DCRat)", "value": "40286d02927b919f2c4049cd2c73d4b1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881318, "uuid": "0a52ae67-c661-43f7-9e13-6a2e5bc3a176", "comment": "Malware payload (DCRat)", "value": "71f38f0b1546e9925ed33132b22f4ee29d25ea4fdfde4142dec7a3ccb7449288", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881318, "uuid": "e9e5f6cb-b40c-4798-9387-21a0cb439dc2", "comment": "Malware payload (DCRat)", "value": "ce520c17ebd381e722ccd5ad83081ff1b05d5c8a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881318, "uuid": "66e2642e-4fab-4e88-9ccf-5a03c5614ff5", "comment": "Malware payload (DCRat)", "value": "be815f57386c6e55c4c1baeeb7daf8cff97e1c04c25c306df5d4749198d0ba94b4b354c01874c65cd8c765db4764c974", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881318, "uuid": "a93ca1e0-6624-43ae-9014-8b776dfd325a", "value": "T15A06E015A5E34E73C27A7F3088A61C2D4261D7363583BF3B756906E378A43E887D34A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881318, "uuid": "b2b9f018-f97d-4cc0-aa44-1d539e05d315", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881318, "uuid": "4f367212-993c-4740-8a86-80bb1e059527", "value": "49152:/jUyMvyMUnQ/ODxQm0woFzoRHBe3fy5VjuLQhzLwoSFHBFpy7NtRvhhjw09Q4JZw:/jLTQGuqgzlyVuy0FfFpEtVjT9Q4UV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881318, "uuid": "7cd82ef9-8329-4b54-9c41-28ff57e87da2", "value": 3865600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881318, "uuid": "94c1c71e-3a80-49b2-acd1-acd7162f2a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881318, "uuid": "4d220695-9e81-4c8e-ace8-ee0ad7e33b5c", "value": "40286D02927B919F2C4049CD2C73D4B1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5855f21-0017-11f0-ad17-42010a9c0004", "comment": "Malware payload (Adware.PushWare)", "timestamp": 1741876308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876308, "uuid": "fa1dc6b4-4830-4ab0-a97d-3d397ff77395", "comment": "Malware payload (Adware.PushWare)", "value": "84d893497446ad7570de1a36dac902d9", "object_relation": "md5", "Tag": [ { "name": "Adware.PushWare", "colour": "#103BDC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876308, "uuid": "3597a3e8-d245-43d7-bd0f-1e0792ca08b0", "comment": "Malware payload (Adware.PushWare)", "value": "728fe0deccc33770db381d70bd6f7afce91440aa554470e382182859a8051de2", "object_relation": "sha256", "Tag": [ { "name": "Adware.PushWare", "colour": "#103BDC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876308, "uuid": "ed4576f7-2865-461a-b65b-5ac81522b83d", "comment": "Malware payload (Adware.PushWare)", "value": "df8ba52c4782ad30a5120beffdc772b947012b06", "object_relation": "sha1", "Tag": [ { "name": "Adware.PushWare", "colour": "#103BDC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876308, "uuid": "5908ea69-a1aa-40ba-8142-fdc6ca063076", "comment": "Malware payload (Adware.PushWare)", "value": "535fd4e5e16d911f41f0ef2568f6c04792bdfe77b67711b9684c718e0cc9235345c26e6f0ea48e6741da0ac857bd027c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.PushWare", "colour": "#103BDC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876308, "uuid": "0a5a558e-1e1e-482b-8a23-b8ef95639472", "value": "T1561523D56B12A83ACE971D338EA6D1EBC7B2FEB4D05AC0DF57940B5D38C13D52209A81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876308, "uuid": "caa3d397-68a8-494f-95ed-66125fb67bac", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876308, "uuid": "2944c012-037f-4628-8ab9-56823f0849ab", "value": "24576:M5bfnrbjMuq8UYp2cnUnzLpckeyF82rZHt:M5bjPqzYscUzL+mFBrZHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741876308, "uuid": "54a1b9dc-1b37-4fbc-9d99-af7b033cc06d", "value": 890832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741876308, "uuid": "7679ea7c-f4b0-4539-b3b0-d68f9eee397c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876308, "uuid": "59f5e1a7-8c47-4f93-b6b0-0f86d1d362ac", "value": "SecuriteInfo.com.FileRepMalware.30870.28182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6886eb2-002d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741885678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885678, "uuid": "2a309041-cd83-47e0-aefa-dccf430a0b14", "comment": "Malware payload (Meterpreter)", "value": "084b813a9281fc0284e53c08fc92a844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885678, "uuid": "5c295bde-49d7-4f07-8103-79791b307a96", "comment": "Malware payload (Meterpreter)", "value": "72aa2202801981e347c4a02eae4b64835363f0c07f6edb2173a3e5d827171a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885678, "uuid": "3f46bf8f-5e37-4bb8-9361-50861c16fb82", "comment": "Malware payload (Meterpreter)", "value": "ebb9e55c4ff6b0d1625ed288635e2da109f9c75d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885678, "uuid": "a38af581-1aa9-4c8d-8051-27615a620829", "comment": "Malware payload (Meterpreter)", "value": "062cafc173dde0fea3314d4cd6b72ca6ce31ab5f77ea5dfd5baa7b28e6f15d831554f09c46f1f4dab62ad12d054f73c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885678, "uuid": "451e916c-bf78-4021-8ade-b7f20fb2c65a", "value": "T1E073CF42EAC41566C191227E57752A396A74E5FB3203C19E798CDDE4EFC08B0B22A3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885678, "uuid": "199eac63-2e84-42a0-9682-458875cbb696", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885678, "uuid": "3fe6b7a3-7b2e-4514-9133-8d74067cb554", "value": "1536:I0HwLCWU9CVzVP3G1fNO/esJvtN9Mb+KR0Nc8QsJq39:IiC9GFOp3N9e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741885678, "uuid": "62c107f9-82c2-4697-a76c-3a073f1c51b0", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741885678, "uuid": "0edc758a-4b95-4bf5-a9e4-498514d0d540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885678, "uuid": "c2138ec7-4842-4173-9ed4-3b1827c5d720", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84210f3f-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825034, "uuid": "981de3db-1241-457a-a4b0-1808a467a632", "comment": "Malware payload (Mirai)", "value": "35593ec984a93370a19e60ada5b26175", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825034, "uuid": "5c71dbc5-d7a1-4796-9930-2676cbf51439", "comment": "Malware payload (Mirai)", "value": "72b146ba6af3e9de5fd98750c3364d871c1fd650b8c356572575a8372ac54081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825034, "uuid": "22d45ea1-895d-44f3-a1f8-afaf5c0ce87a", "comment": "Malware payload (Mirai)", "value": "979cb5e394f092ca0f7b05e9b8a49151ac5cf0c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825034, "uuid": "71372c45-7141-4b3d-a6a6-7c1f1e63da19", "comment": "Malware payload (Mirai)", "value": "de2e0fc19076cd02d6e4ec9eab11c297a86c04d173193f67222edf7222ff6516becc16b2ebed7944bef112c19908dcd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825034, "uuid": "bd74ee6e-c62f-4b71-add2-8eb4c6f38e02", "value": "T138332981BC919A12D9C423B7FA2E01CE372563A9E2DF7207DE216F1137CA82F0D67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825034, "uuid": "49c9feaa-92aa-4c5e-834a-5e9c48e6cdf1", "value": "768:aMYhuGUGrNMi4fnhSeikzpneelJ6SdkwHUoO8XBNOS93J0U1M/:2huGUGeiInhSeikvCS6wH191", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825034, "uuid": "dd35d689-bf81-4b42-b98e-707ed4520046", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825034, "uuid": "37b8fb74-5413-409a-b952-3c4928d362ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825034, "uuid": "c61e4d03-0865-4153-99a0-e098c8541d0e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ed51ce-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741825014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825014, "uuid": "c8dcdc25-5bf4-4d1f-aae9-cd9fbcf1b556", "comment": "Malware payload (MassLogger)", "value": "179a3830db0768b766cc9375a3cf9a4c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825014, "uuid": "5bc88e04-db89-49bd-b0b6-fb7f9f3ea7eb", "comment": "Malware payload (MassLogger)", "value": "735354ae6e387cd7d7b63f2bc45f838f1218f956e278e20401b8ad606dec8488", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825014, "uuid": "dcc6ec71-f7f5-4ba5-b4b0-cbae6c52fe04", "comment": "Malware payload (MassLogger)", "value": "eb5290b3b563ad540db805c77b67bf49d394308e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825014, "uuid": "eb80f996-9af9-4305-a419-50bc64d85e14", "comment": "Malware payload (MassLogger)", "value": "41384733d5f8e1662c6851f637e04706055315cce63f4a8889466519c791f3f66543a3743f9eb55c94fb1c1e9de3f2db", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825014, "uuid": "738d5d52-6ee9-4358-a27e-51f2c9814f03", "value": "T1306275240C0FBD26172791148DCF69E848DFE799A4707AEA746C8590A379BF854C0FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825014, "uuid": "f8f8d588-ead6-4393-aa8a-1e3c5c16f44d", "value": "96:/AbxYbDbgXYb62O5CTfSyerb2wb2EeYbEbd+:OYEXY+2OATbweYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825014, "uuid": "4cf6bb7a-2da1-4104-8889-a1c3486dd94b", "value": 14864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825014, "uuid": "0f1cf7dd-214c-47e6-a073-8fb1162e970f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825014, "uuid": "9391d573-7ab8-483c-a967-d92576947ea7", "value": "uhg.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cc2298-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825039, "uuid": "65fdf2d0-ffaf-48c9-a32c-71a3526b6ad0", "comment": "Malware payload (Mirai)", "value": "ef18537fb6888a4148221a9aad7eef62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825039, "uuid": "90e13f0b-2b1c-43ba-83ab-40314968be0f", "comment": "Malware payload (Mirai)", "value": "738e477eb78c3275e1090b7cabff64de3091ac13ae03ff6c7673d9964178a8f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825039, "uuid": "84955b9a-615c-4476-a8a1-50a30c3bfa92", "comment": "Malware payload (Mirai)", "value": "480dbd316a86a4945d7601c7824c8fdfbb7ad58b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825039, "uuid": "c7e26cac-92e6-4ddc-a5b0-8421659d0f27", "comment": "Malware payload (Mirai)", "value": "4af5a8a8bb429cedac3d9dc3543fe4fc9555545e2b4f25016cd5698b691c8beb95f6f4e195bd3a686e486bbfac1311a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825039, "uuid": "d2249a9a-eb71-4d5f-9a4a-641a771444cf", "value": "T153C36CC0BB43D4F6E96204712036E7739B37E43A502ADA87C769EE36EC51518DB1A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825039, "uuid": "3800a73a-5a45-4fd3-9c88-b4e802ba800a", "value": "3072:zKL0me2UZeJWqS7xcBO+m/EvRO2DtfgLO:OL0mFkeMf7/EZrtILO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825039, "uuid": "4222f063-e7c4-4c38-b980-d65614e9958b", "value": 118252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825039, "uuid": "650597bd-51f7-411e-aaab-b9f13fa542d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825039, "uuid": "ffde27ea-254a-43c7-9f93-61f6d434ff96", "value": "bejv86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baa399f-ffda-11ef-ad17-42010a9c0004", "comment": "Malware payload (Loki)", "timestamp": 1741849797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849797, "uuid": "5637fc8b-dc91-49ce-b507-3964eed98dac", "comment": "Malware payload (Loki)", "value": "1600381bac9da755329c91ab3178fde8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849797, "uuid": "e6a4292a-e938-4785-a347-66dc8c31b4b8", "comment": "Malware payload (Loki)", "value": "7403170739b3dde1b83caf1f16c78b7eb27e1819df13647ffe08014d652fb3ad", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849797, "uuid": "aa1d7514-8493-490d-bfef-6c7dfe5e0bb9", "comment": "Malware payload (Loki)", "value": "94261065e2fd6deaa16dafe58cf7c06be7f93b10", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849797, "uuid": "211d441d-716d-4a5f-89ea-ec33e00d65c4", "comment": "Malware payload (Loki)", "value": "9e71a2311a6fa70906da4ca185d300d84f97060ef1d36ab354b58ca3303c6f539a87f6471c6c131568fea283d65e3560", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849797, "uuid": "455bdd88-572f-4040-bad7-09b3329c48a8", "value": "T153B402E12749E8A2EEE817711435E37603795F9DF4228343CBECEDEB7405625B10A2DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849797, "uuid": "f374dabf-86a9-4b93-8d0a-a3c217308858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849797, "uuid": "9c534bb0-283e-4eaa-aff4-0a39e8803e18", "value": "12288:E5MOiV1bQGKgVBIVWAaZnGhbKSR1LsfChpsiOJg4h:E5MOiXbhKgVBOaZGh1R11Kzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849797, "uuid": "1a29bf43-34e1-4a7f-8f3b-bb1768bc4b54", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849797, "uuid": "2c943480-5fdb-48b6-80aa-2e593119c62f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849797, "uuid": "f8312adf-b443-4dfa-b489-b572160acde2", "value": "DHL AWB Receipt_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cbb3bd-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879362, "uuid": "6d3387a0-79ee-43c0-ae97-2d07fbab0614", "comment": "Malware payload", "value": "bc2650d615fabce7310300dbaac4348e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879362, "uuid": "2f573b6d-59a6-4d5d-8bfd-f83ecc52fc03", "comment": "Malware payload", "value": "7403a00e5d0f9fda4230133d46b15d7fc8986df2a11b1dd8a4bee38c1c3cb6a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879362, "uuid": "0266cc0e-d6b9-4365-b26b-f71150e727d3", "comment": "Malware payload", "value": "0efba9e0df192e09829a3057a0ee94aaf511a9b4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879362, "uuid": "471a5362-c6fa-4cb0-8eed-f205b0541601", "comment": "Malware payload", "value": "4c4c511e880596de720f136904e055a36cd389230dc6c36bec068920abdb34fc243d1e84b16fe9b4adde8c3a0fea9302", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879362, "uuid": "d15f07ff-826b-448e-ad4f-955f7b4d29d0", "value": "T18135C061B685C072D95F21740438F7BEBA7DAD740A20CA67FBDC379D1D31980872A2DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879362, "uuid": "8be8038b-fe77-46b6-b603-97eb50b64b04", "value": "3ca2fa204f288edb1fba4335cb242293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879362, "uuid": "ae33ccd6-f662-4164-ab52-2697623d5c2c", "value": "24576:JaPNO7H+M/0w2aGulCw87cZsAmMegOAthIi:JaPO+M/bpwimMegBhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879362, "uuid": "e17be8f0-5ba9-4741-a73f-824926950d3c", "value": 1123424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879362, "uuid": "0d30dae0-7e31-4884-9324-7a03f161b14d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879362, "uuid": "5b84d395-6907-4c2b-baa9-3e61c46237ac", "value": "TurboActivate.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcd0805-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825000, "uuid": "05bc4c87-fd56-463e-885e-5966e2347583", "comment": "Malware payload (Prometei)", "value": "37b0c2c63bb6b4ed19f2c320f9084434", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825000, "uuid": "cdc6427e-e058-4f1c-89a4-5d5d2989da26", "comment": "Malware payload (Prometei)", "value": "746df3eed2444db2b9bcfb4a04706d593173168eb4b6d1b54b3089da14e8be2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825000, "uuid": "45db626b-3409-4ff6-a7a8-3a9d1b7da5fd", "comment": "Malware payload (Prometei)", "value": "813cf411996a69e0b0ddba17a31838939e456317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825000, "uuid": "6b5ca769-c649-4197-b07a-db93af429cf0", "comment": "Malware payload (Prometei)", "value": "7310d7fd25cb64280bce0987de08122c0a84bc713df3a40a71be7b1832d739ad7694837f57ffb9520c88ced837cf49c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825000, "uuid": "dc7c8a4b-e13b-4709-870a-61e771919e8d", "value": "T1F09423F8C83D2E30D8169B3CBB5A8268F0A15772D9562F7AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825000, "uuid": "ae7d4644-0abe-4a1d-9464-110c34f915ec", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgK:25WOSACZSV6eKRH5EPiamb4DsDwwc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825000, "uuid": "54c0e30b-0701-4f14-8022-8babbde69cf7", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825000, "uuid": "d3cd4546-960c-40f4-ac3a-4d8179a0ee60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825000, "uuid": "41fcaef6-4538-44da-b9b1-2a7545ad39ab", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766b661b-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741825011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825011, "uuid": "9f625f8a-4802-4470-9e2e-a47dbf5b4347", "comment": "Malware payload (RemcosRAT)", "value": "3f77336e1aeee995e54eb873951e023b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825011, "uuid": "ae3a186e-4150-42c1-a9b9-f9f61d08a264", "comment": "Malware payload (RemcosRAT)", "value": "749713e64d27cbb6874d3bd2fb09ce2e22262c24cd2473431ec89d7f7701446a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825011, "uuid": "4dec418c-f51f-4a0b-a47d-bcddf43e1df9", "comment": "Malware payload (RemcosRAT)", "value": "273c928368510271c9aef992e37b7589ad8ed479", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825011, "uuid": "8dc29caf-a0a8-4fca-9004-7d7a990af884", "comment": "Malware payload (RemcosRAT)", "value": "15582f88e0e28d91e219cb00426c8b50744eede12399058220e838e17ab39f2a332ca00d1e610e0c300b4a551356fb36", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825011, "uuid": "cfe455a6-d5a5-4b35-b030-06f3db58eb42", "value": "T1986283005C35FD496790C5B3F6CD29E40F0E872F8135551A70DE8ABA5B5327A18FC2AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825011, "uuid": "55438ddb-9109-4810-9d65-7fd25cd55d0d", "value": "48:33+05p8Pr+05pYUPmEa/1cYpyDeYkjczcQ+05pK+05ppRePW+05pnPG:+054i05Ra/qIW3fQ05L05zqB05h+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825011, "uuid": "dce54482-ed35-453f-ad62-a85bb6efc7f3", "value": 14778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825011, "uuid": "9b6633b9-9598-441c-b4a5-5051fd3a10ec", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825011, "uuid": "110cfcea-ffc8-42fa-b950-a8e9db6acc85", "value": "mgoodnicepersonneedyourverywell.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585f48bd-004f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741900123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900123, "uuid": "fba05db7-79e1-452e-ad33-94c731aca1d5", "comment": "Malware payload", "value": "0af2a4338f851ec8b9c4195f7cc18847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900123, "uuid": "3060c395-baf2-4803-8ca6-b3f79a3da2f8", "comment": "Malware payload", "value": "74a393e2d32d0609e7dc0b0220889f3b4e29bdc712e8bf7774beab33871c8d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900123, "uuid": "82851431-f7e3-43f6-8fcf-49dbf3c21592", "comment": "Malware payload", "value": "ddeaae7a10afcaf570c6c9b5170cf693068f32ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900123, "uuid": "fe7479b1-0df1-4a9f-9849-abf8a76b55f3", "comment": "Malware payload", "value": "19d3d37a19fcc05ea7e7ef4c7db3d3296206264fb5671aa46dc415c059d94c8d176533a56f48259e2dc5143ce36220cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900123, "uuid": "98b14f90-e3eb-44b5-b8ec-2ea119ee6ca0", "value": "T1A4662331A162303BE6F519F3F851D1302D6DA2182B18D9AFC6D4D90C39689D6EEBB347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900123, "uuid": "bbd576f8-9e66-48c9-b5df-82d82df18d00", "value": "657e40fb09b2c5e277b865a7cf2b8089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900123, "uuid": "df8c21f3-1130-4e21-a079-499779d3a7ec", "value": "196608:vla4hlIoD241TtAnwN5Vmhu5IMA0zqhTf1:daolIsVtUfKIqzKTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741900123, "uuid": "4a88e25e-0e63-42f4-9f4a-d7fe8d29bfd8", "value": 6820077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741900123, "uuid": "f9b58822-4637-4964-8d43-6dde23089329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900123, "uuid": "04ef4de0-e865-4e1f-98f6-421669b612a1", "value": "BPILEUNC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d611b6a6-0059-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904629, "uuid": "f24af797-9ee5-43f2-9155-2b29e8b8536a", "comment": "Malware payload", "value": "08685ee366d432a65ef45774925692a8", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904629, "uuid": "5336ce8d-6251-4cf5-a0ea-556d5cf0c65b", "comment": "Malware payload", "value": "74eac4ff60257db6dcbef047e8b9f23f03f3c328573aadf7091093504405b3a8", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904629, "uuid": "99b90f01-2fed-4e9e-aad7-72c2aa03b93f", "comment": "Malware payload", "value": "f20da68f0a36954ec587c6e93e9e96901035c317", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904629, "uuid": "3c12796b-4ae1-4811-b0c6-d500e269e877", "comment": "Malware payload", "value": "6c2d99e01e70c03dff591407fd19d2d36af346b7551544df4ddfcec041bfeca237e0bb40cfb51ed3b44140268c88fbe9", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904629, "uuid": "615c86e9-7c88-4e6c-ac02-d546d306587f", "value": "T16DE56B137296C136F56E4573DA68DB2A107A3F651F7444EBE7D8FA6A0AF14C20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904629, "uuid": "55e256bf-6d97-4e97-b659-b9ca71eb6b5e", "value": "49152:z+cYf9Mftgk7AZVqVZ9Rw4YP/BD/vTKPduTRUhfwEgB6zDojOwfFlupqLOSGRJv5:vY1EA/qJPdKBqwqpqLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904629, "uuid": "5f9003cb-583f-42a3-a99f-c5e5a9aeccb6", "value": 3182592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904629, "uuid": "d5a53a2f-6ad2-42bf-8e69-d69ccf2db849", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904629, "uuid": "c2aacae6-0ed3-4582-8569-a2fbfe06e254", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a259fd1-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741849445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849445, "uuid": "fc701886-393f-4a12-9349-396d21e0d2c7", "comment": "Malware payload (RemcosRAT)", "value": "5b145d889f03b5253e441a92d55bfcfb", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849445, "uuid": "b41df3bf-f7b6-41d3-9266-1558496bafe4", "comment": "Malware payload (RemcosRAT)", "value": "7572dfd4a5b97e84dd6a023ad7078330c6c919d20af5f0f5f4ff8418698ef1b6", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849445, "uuid": "fea9b95e-12e4-4ea7-8116-820c456380b7", "comment": "Malware payload (RemcosRAT)", "value": "2bb18bb1828171d775e6e3c8127d3f375e10346d", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849445, "uuid": "fc6d0e35-4e88-4757-afdd-41a9f65292df", "comment": "Malware payload (RemcosRAT)", "value": "1e23ce1e4a0bcf10d7b50e118606060f48ebee7ca24729dc7f46241231e96161276614672a39c25efafb0e31c92ef161", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849445, "uuid": "dbf4d45b-b0ca-45f5-9eeb-70c85b8f4dc4", "value": "T14FB4BF01B9E2C172D57654300D2AE776DEBCBD2028358D7BB3D60D57FE30190AA39AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849445, "uuid": "58ff652d-8fc5-41ee-834f-e5f846ed3b46", "value": "41e05d591d7d93bdd5bc6d5da04da74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849445, "uuid": "f5dd9e8a-6bde-4d5f-a1e7-36c34114400a", "value": "6144:nIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6kJ:n200OFp+G0imvHn3Cp6qyBP+YdsvZGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849445, "uuid": "3f75a339-aa6e-4186-a419-185a56d2d13e", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849445, "uuid": "00b85631-562a-4e11-af32-e359b4ee5095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849445, "uuid": "9483dbdd-0c43-4395-a26b-8b514f0f221e", "value": "1741849444a901b1e837e9d936a8b52d2404ffdcc02326cc98d522e878bce2a5a11d1b4fa7469.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85cc721-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883185, "uuid": "2fe7d782-70a4-4636-aa46-d6f2b466e098", "comment": "Malware payload", "value": "dc122f317efb84132bc2c9e0083659e9", "object_relation": "md5", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883185, "uuid": "9b13d070-a372-4ad9-9255-70d543967487", "comment": "Malware payload", "value": "75797892d19890d12a9715232127e3148c508dab8ea7ff8f3ecaaa64b6e58116", "object_relation": "sha256", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883185, "uuid": "0622614a-7317-456d-b29a-e4af058b6e0a", "comment": "Malware payload", "value": "bf80ffca0db49f37cdefbc8eaecb6d9fb84e2c18", "object_relation": "sha1", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883185, "uuid": "d2ccd6b4-b0c8-443f-99a5-65f772ec2a3c", "comment": "Malware payload", "value": "f59e0f0ebbe81dba074d940b3d3251ac5940949322e46655a58490f57cb562c52ceaa99bad46c16d934944f50e762841", "object_relation": "sha3-384", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883185, "uuid": "625e9035-a618-45b0-90dd-c47d4bb6fc6d", "value": "T1CD9336BC57877C3D0C7E53C9968D7E84B4B809F7952845CEF48E2C86ABB4A10DE4AD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883185, "uuid": "46d19645-fb9d-4e79-8427-841d437cc549", "value": "1536:aIISt7bzV5riATRapiWNiL36esWCYa8v4jUlxZv7WjayE:aIIs5mAdapiF36eXCYaFyx1XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883185, "uuid": "70c27710-94d3-4405-8926-8d296e03bf3e", "value": 93560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883185, "uuid": "fb63642c-3001-4ff6-8fcd-3817c654ba60", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883185, "uuid": "6258abe9-b81e-4f3b-8ca4-c62e0522bf11", "value": "75797892d19890d12a9715232127e3148c508dab8ea7ff8f3ecaaa64b6e58116.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f1a619-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883202, "uuid": "5d9e9d0e-7707-4c24-9889-9763c2a2c4da", "comment": "Malware payload", "value": "8b30ff5743f8c3191283297d29ce7a1c", "object_relation": "md5", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883202, "uuid": "81a57e7a-1000-4f8f-ba47-6b770714899f", "comment": "Malware payload", "value": "7634973d7705d732d1343e13ca09edc962da93e3653e8f16a33039a6f9e95b4f", "object_relation": "sha256", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883202, "uuid": "0d2532e9-a797-4725-887d-e78a041b8f13", "comment": "Malware payload", "value": "769cc9ea2c254a42b431ed5d8bc8ee4446f0a550", "object_relation": "sha1", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883202, "uuid": "24f92a1d-56fa-4ed6-bf84-f8fd14c6ae87", "comment": "Malware payload", "value": "7838be2422a297f6d7ed89cb03c26632e6a49348a2f087293a436e7d8e95bdae99cae13e8c2b974f76418869c7ffb4b5", "object_relation": "sha3-384", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883202, "uuid": "264a1835-738b-4170-8dc4-13d1795953d2", "value": "T1ADC08C144F4EC0D65263F89A2768CC20AC2289847A6EDD1692D88E0C9CC2E868ACE2C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883202, "uuid": "d8d46494-bd68-4e59-8f31-5be02e8126a6", "value": "3:HRAbABGQYmtXATSEl+SoBKSo1YSo/QJ5i1Jj4I5o6Rfg0ck2RMQ5yn:HRYFVml2SE1oBKqSoIJ5if5oeTckF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883202, "uuid": "60eb3526-88ac-4769-95ba-1070c06bf93d", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883202, "uuid": "08c6da75-08b2-4e96-a9d3-5f4311c88049", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883202, "uuid": "1d663e1f-8295-41dd-855b-bc424abf344d", "value": "Passwords.url.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56ddca7-ffdf-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741852149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852149, "uuid": "8e2d086c-86ec-4305-a733-b04524a7f63f", "comment": "Malware payload (XWorm)", "value": "e5c739446db91cf8902f3a8b9a5fcb0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852149, "uuid": "dd021cd0-9ba9-47d8-9bc4-15f1ab5bdd88", "comment": "Malware payload (XWorm)", "value": "763aee198551ad7bb7cce55802ce2a7aef4f4b98ecbbdea408fd83b6fd628bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852149, "uuid": "0007e571-9862-4bb4-bae5-c63a097ac026", "comment": "Malware payload (XWorm)", "value": "da6c3a22de5d505db23179e3d0f669c4aad32c0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852149, "uuid": "e67f94f4-93aa-4f54-bfc3-84490320184c", "comment": "Malware payload (XWorm)", "value": "89afead2f5ead7b7bf0c1411d02e9a7ceddae844bd068298dab8f76d400106aabc41141033766cabe58ba33a050e7c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852149, "uuid": "2809b924-a59e-4433-99e2-e5f094504e4a", "value": "T18DD32B077789C522C28D6B77DDA61410CBB4D683E263E78B79CD63B904037A99D09ACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852149, "uuid": "14267923-b41e-4c27-8cda-7f76b0245909", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852149, "uuid": "169f3835-b57f-4537-b82b-4c8e2191822c", "value": "3072:sz6WGJ+9rXHiDri3CPSKzB+ntWh3pfKYMK:sz6WGo9rXHiTB+ntQ3dK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852149, "uuid": "076a55c9-5adb-44c8-bbde-ccb672b35963", "value": 137728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852149, "uuid": "094aee7e-94a5-41ce-b021-86e48c174af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852149, "uuid": "8fbf77ae-b5d4-4899-bafa-0ce1ed70ceb6", "value": "12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332f0c8f-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (CoinMiner)", "timestamp": 1741879445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879445, "uuid": "2086e86e-d9e1-48c9-8dec-c2ab0ca78883", "comment": "Malware payload (CoinMiner)", "value": "c6067cd3b970c7f932f73f4084df78e8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879445, "uuid": "e257d5ad-f503-4cf0-a585-32c506d55cb7", "comment": "Malware payload (CoinMiner)", "value": "76ed4d9fc0972558a1bbc35ae4ff12561715c2bb2f286ae3c359a9671d0911e8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879445, "uuid": "ca3970af-b03d-403b-9f3a-fbdf5f4183ce", "comment": "Malware payload (CoinMiner)", "value": "99ed9789295dc7d28b0e864bc0ab253832c8a871", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879445, "uuid": "f1e7bbfb-8fc3-40d2-9c2f-4e3433d11c7a", "comment": "Malware payload (CoinMiner)", "value": "4331b7f57e16143a8a6db47e1ca079ae71955539a205fcb70a0e12969c5140e64f23a217b7808e50003af4d51873c337", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879445, "uuid": "888a6640-1941-455b-953b-dc06cfeea08c", "value": "T1D8967C47EC9545E9C0EAE33589B29253BA71BC484B3223D72B50F7382F76BD46A79340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879445, "uuid": "20ae4e69-ea68-4c0e-b8f0-2b21010b4172", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879445, "uuid": "0338e619-f9de-4625-a2b4-c28310d1cc69", "value": "98304:TjnWIRW/ZdjLMEbsVBdaagU8PRIHh4DuRNrjsIrE5i3Fesc:G4W/Zh5HGBEoyME5iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879445, "uuid": "47d7bad2-497b-4ff5-b06b-e965350b8927", "value": 8771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879445, "uuid": "425fae64-1d21-4fa5-9538-63e9413a4a6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879445, "uuid": "58990d2d-dacb-4df1-8a05-21f0f21776da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf617475-0037-11f0-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741890015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741890015, "uuid": "1f2d78a1-484b-40ec-9ecc-160187b0b12d", "comment": "Malware payload (DCRat)", "value": "4a38c2048da687af5b8ed26cfb60e4cd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741890015, "uuid": "a4751625-dd61-42a0-a325-065816b1cc31", "comment": "Malware payload (DCRat)", "value": "77a27aa7867b9af53f7e54c38158e34446c9adfd2f5960633dc9834c6190e564", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741890015, "uuid": "4bba34f7-1440-4b71-b46a-2f4314561d15", "comment": "Malware payload (DCRat)", "value": "ed406f4969e98debb8fd11efb134d6cd019d3076", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741890015, "uuid": "cd161625-cae1-441a-ab47-0f2b2870a5f9", "comment": "Malware payload (DCRat)", "value": "5015b0aeb857ddbe2e790969030b9f95b8513481806a636bf0ce33287e8e0b16d377f48f6fbd7c1f144ac82883d7f542", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741890015, "uuid": "35a72116-afab-4805-8963-634faa13d2c6", "value": "T1D206F10A96534EB3C2B43F3084D7112E43B2C7627962EF6B761F64D1AD072718B57AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741890015, "uuid": "bc46ede8-1f24-4f85-baa2-0468568c475c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741890015, "uuid": "2544e0a6-a8cd-4d8d-9079-38a2df8b3196", "value": "98304:Xh3EMBRGZVPCNfRyb/kH3+vln1DWZxbJvmqdONGVcF9aGQy:x3MMmIONGSFgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741890015, "uuid": "5b6133df-ad5c-417f-aa17-430bfe93b7b5", "value": 3680256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741890015, "uuid": "de63acde-5d23-473a-a34c-3906b97b9988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741890015, "uuid": "d5e2f949-f57e-4108-ab0d-2d71100bf4e2", "value": "4A38C2048DA687AF5B8ED26CFB60E4CD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6d9476-fffd-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741865154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865154, "uuid": "397f8d14-87f3-48df-b0b0-06944fa6d46f", "comment": "Malware payload", "value": "f474f6cd156e53a994ae3d25dcecb50c", "object_relation": "md5", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865154, "uuid": "43f1d7b1-3ce9-4fb2-a97e-ee357132b389", "comment": "Malware payload", "value": "78a810e47e288a6aff7ffbaf1f20144d2b317a1618bba840d42405cddc4cff41", "object_relation": "sha256", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865154, "uuid": "4be17ded-65e0-4706-9126-63f68337318a", "comment": "Malware payload", "value": "3a7b4a507db8ac2aa59c83a59dcf1242411d14f5", "object_relation": "sha1", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865154, "uuid": "594afc06-fb3e-4f55-8634-442770b4222f", "comment": "Malware payload", "value": "e9f004c7a47ed837496b46bda2efa09bba63457ca309e42b8ee0cdc4ddcbb84a816fcc7f7c458d9ba75f9d1a88297164", "object_relation": "sha3-384", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865154, "uuid": "8ffde28c-b41d-494a-9887-020383e67f3e", "value": "T196D34A0772D240EBF06E923480535B1AA372B838466CDF6F07E447569F53BB64C2BB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865154, "uuid": "22df827f-53ad-4e5b-892b-b4a440778f4a", "value": "13824a1c1003fb6a594d5675bf5f2b72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865154, "uuid": "de70cb13-2011-43be-89f8-ae299eb790f2", "value": "3072:ZDcNCpdPBXXnMaM8X5AefFrkDuXHN3xOiPU0i:ZvpdJXMWiefFYaq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741865154, "uuid": "cf074718-4adf-4a06-b904-f0aa9c0e4791", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741865154, "uuid": "b8da7381-61cf-42f8-9387-b9434f82314c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865154, "uuid": "9ab097ab-7176-4e93-ba5d-77356da2fa50", "value": "AppvIsvSubsystems64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8effa7-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869122, "uuid": "ebbeb2a9-1afd-4945-bbcb-12ab04709ae9", "comment": "Malware payload (LummaStealer)", "value": "d3dfeb11e332ea228567f9f4ebafef51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869122, "uuid": "68d74939-e361-494f-b093-56c066207679", "comment": "Malware payload (LummaStealer)", "value": "79188b44c38f4fabdb8868d0fad3ba1b297b627e8a7d2438fcf7edbaf4c2a6c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869122, "uuid": "f6c1a4df-6e86-496d-9320-675accf08204", "comment": "Malware payload (LummaStealer)", "value": "86ab8368a72f9490c175de5032c2b9f2a219f0ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869122, "uuid": "4ff147be-6706-4d4e-81eb-9740a80bb7a9", "comment": "Malware payload (LummaStealer)", "value": "c389346725620c0f7fe9c34bf2a7710745e5566c34c55408adbd672f0cfadc0a7db68ecef7a2f4e76c8d413dcd734870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869122, "uuid": "ce2bf0bb-bc51-485a-ac84-7ea5e3f40867", "value": "T12155E07270C1C073F642A5B23598E3B5546BF672DE2E0FC7A2B4E7749148AC117AA12F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869122, "uuid": "9e7ce5d2-2664-42d7-9003-625d8cd51d87", "value": "d462aa757f68629e41b3df6e6d4c6a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869122, "uuid": "384445fd-d3dd-4763-860c-c0d3d2e68a79", "value": "24576:6Ai/c6dNtEWZ4B+UsxoxbzmXFHaeclEX3fq6F+cONK1B3rRHaeclEX3fq6F+cON2:k0qNtnKB+UsxoxbzYF6TyX31F+6zrR6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869122, "uuid": "44e5f3e2-00ce-4377-b07f-b2d62ba17397", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869122, "uuid": "6f159d73-9114-4ce2-a98d-0ba7ba55613a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869122, "uuid": "db8ff640-ba9a-4210-ac51-9a5b4680c96d", "value": "setupx 1.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db957352-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Metasploit)", "timestamp": 1741855675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855675, "uuid": "d39391d0-e9e4-4d7b-8ad3-6b0d0fd9caa4", "comment": "Malware payload (Metasploit)", "value": "2f430287ff12fe71f94901ba67ccaae8", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855675, "uuid": "83351ccc-4cdd-4e26-840a-404fd604056b", "comment": "Malware payload (Metasploit)", "value": "793e0e2ca35715d42ef7794663d1a7c4180ee6b5e0e231397856761e3ecb9e87", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855675, "uuid": "0ee370c6-82fc-4fb3-89db-55cbc751d63e", "comment": "Malware payload (Metasploit)", "value": "f67d43dbf61f2e85dc1531c28f8cedb0e43919b0", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855675, "uuid": "02f2281d-eb86-4c64-a8a8-ed7230e35bc7", "comment": "Malware payload (Metasploit)", "value": "79ff3014ba18886c94179cef5f9c4cefe38d913d76455460f4306de4a2255733a296b99fcd1d513c59ee1a0209240d21", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855675, "uuid": "22e367bb-fe53-4404-a466-51be4165c706", "value": "T18E9192933042F49E014687BE3D4967E6907AC625E68A6045F38C9FAEBDDCE533D8D2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855675, "uuid": "ac293056-3ca1-446f-bd26-20aa39601ee7", "value": "96:RGTZlGh3HuSCh1I5QfdJ0WA/qdx3HHNYi:C7Ghsa7WcqdZHHNYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855675, "uuid": "925aeba8-99ce-458d-bab0-16e55f4f84e0", "value": 4206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855675, "uuid": "72884632-1e34-4585-a1e2-444cbd6a1108", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855675, "uuid": "b7ba9b41-c631-4ecb-a3a4-51e8b0e9f54f", "value": "443_2003_psh_x64.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b914ec82-ffdf-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741852181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852181, "uuid": "9f6047ce-1c3e-4b88-aaf3-11b1177baf22", "comment": "Malware payload (SnakeKeylogger)", "value": "2b1b16363ddcf9686ce1c9cc781038e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852181, "uuid": "06ad8f4a-73c0-4fdf-b88d-b5f6a0e09395", "comment": "Malware payload (SnakeKeylogger)", "value": "7a1af0954cd7db05725aaa1b43ae149bc9f7bb610305b216744f3863e5247663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852181, "uuid": "7a723fcc-6339-4203-9536-6a6100935730", "comment": "Malware payload (SnakeKeylogger)", "value": "d2bd4f0ea1e8164084cdac78673a4f4f4fceb3bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852181, "uuid": "bf18d0cb-2b16-4bfe-a4d0-1e67d2090297", "comment": "Malware payload (SnakeKeylogger)", "value": "666e85954ad2ba75c69a49aa7dc95d11bff4ec86152c78b6a3971f053adfaa83d5ee394196ff48a10e52923345279911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852181, "uuid": "43c962e1-ab5f-4219-8cd0-650c8f95b6bd", "value": "T1F1250291FA45DB60E9180BFC0D64C5B683B11DF8A536C2426DEEACDBBAD1F139205B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852181, "uuid": "870867a1-9eb9-4107-9c54-c08e305498b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852181, "uuid": "f518393e-de39-4910-93e9-2b045efd1f76", "value": "24576:XnOetMOiXBVlVlVVVRwsSUcvBERAVHhF0vy5E0O6VlV:TMpRPPPPwsSZ2RAFJ5s6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852181, "uuid": "7daaef4c-c4e3-4360-b180-30c39fa315ae", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852181, "uuid": "134c0c57-bf0f-41eb-92d9-a10f8a4b3a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852181, "uuid": "40b6fc8c-87fc-4e75-a9b0-6b8949c2c741", "value": "category05 sc110-11\u3000_Z01G-00008D Siparis PO15804-25 - H64PO1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e56c337-fff8-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741862793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862793, "uuid": "5bd55cd9-8733-4f0c-9cbf-6fa15f09d0a5", "comment": "Malware payload (XWorm)", "value": "7c924f459544f772dc59fe28017bed9a", "object_relation": "md5", "Tag": [ { "name": "45-88-186-38", "colour": "#0CC62B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862793, "uuid": "57ab36ce-b4b4-46cb-a3e3-83244f46f829", "comment": "Malware payload (XWorm)", "value": "7a5e7ffe03839f2a8b690da5c55388122b1a8fcf5774f8a91db6eb9061b7bb4b", "object_relation": "sha256", "Tag": [ { "name": "45-88-186-38", "colour": "#0CC62B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862793, "uuid": "1ebc7daa-4478-4f2b-a4d8-145c72fba37e", "comment": "Malware payload (XWorm)", "value": "a96e57afbcc3446aaf51ef7f9fdc041484a98c90", "object_relation": "sha1", "Tag": [ { "name": "45-88-186-38", "colour": "#0CC62B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862793, "uuid": "ac4eccc2-f697-4992-bccf-c8288007856a", "comment": "Malware payload (XWorm)", "value": "819ec1893610727d60430f5c94b321befb20c67d3587d6544916b632e8ee5555ccf312cf22331d1e3565eb327620f2a4", "object_relation": "sha3-384", "Tag": [ { "name": "45-88-186-38", "colour": "#0CC62B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862793, "uuid": "400af1bf-9b1d-4171-8f3a-53cf00a0a22e", "value": "T19653E63EC6F8FDC0536B70C1625E3B0E104D9B93BB751BACF9C648A91564A48EF7A148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862793, "uuid": "c1d1ff2d-c103-4105-b48d-14c68bf0ee5f", "value": "1536:UDbIy6OLPDWfbjug7Z/O6ZkbmEKUgXEXzICKUnFbouH9:UDbF6OLCvuG/ODHfBouH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862793, "uuid": "dfec00f8-7e53-41dd-b336-0589f295cabd", "value": 63508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862793, "uuid": "f3e16c1d-5db8-4a43-8983-ef9534f1418d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862793, "uuid": "00ccdc9d-1abb-42fb-bb8f-0a035525b853", "value": "dwm.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4a2c99-ffe4-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741854333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854333, "uuid": "594345b1-8919-4901-b80f-8ca3c9899f31", "comment": "Malware payload (MassLogger)", "value": "2bd36a058624c4c3357556f3fe02bcec", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854333, "uuid": "ee1e0ec1-0cc4-4c3a-a10d-e51d334322d8", "comment": "Malware payload (MassLogger)", "value": "7a6fd46328e6a0d7c0a4f366b1ea2b636999aeac664dc31f7753b6e1b2be0d1a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854333, "uuid": "10682f3f-f4a9-43a7-b52d-8ce3ad8ba401", "comment": "Malware payload (MassLogger)", "value": "83a0f59b88b607c950051525cc5fc1dbfe8ed2e2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854333, "uuid": "27eb0d48-ec0c-4dbf-9d29-1939177bd2b1", "comment": "Malware payload (MassLogger)", "value": "48e305b53cc6cb61d2dc3db5e9fd119c11e305f2c5938e82da8e4632e8194a2c7dbfe7303888b4c47ba62a6a9475c5aa", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741854333, "uuid": "b60e84c0-c0e8-42e6-90d3-2caec3837b99", "value": "T1A862A4086D55EC53CB6616705CDDC8E2DE0E17CD7500783D38AE8AE9DF492B089ED6A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741854333, "uuid": "6cabbd6f-4478-469e-b9a4-7e142ce452ed", "value": "96:/Cw4qbwtA4qIwtOrHXRgwXQwp5H4q84q7wtv4qV+:KwnoAnDOrBzNxn8nIvnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741854333, "uuid": "e1f441d4-5333-4c71-abed-cc09bdcd4b49", "value": 14913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741854333, "uuid": "944192a2-57ac-4602-96ee-36bc5b6eff17", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741854333, "uuid": "2a71652c-4438-42ed-b648-50db1d1fd57c", "value": "efs.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a905f4-0044-11f0-ad17-42010a9c0004", "comment": "Malware payload (Havoc)", "timestamp": 1741895365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895365, "uuid": "0e32a2b1-3eb7-4620-bb88-7b5942c29887", "comment": "Malware payload (Havoc)", "value": "57eeefbfcc48afc4caee146a4f84f626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895365, "uuid": "31fc602f-2179-4760-a8ee-789bcf2670bd", "comment": "Malware payload (Havoc)", "value": "7a7b7e3f3a6ee93a9d8b737a3bb9ea7f2fb6a674cb7270a354d9d9c8eec46eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895365, "uuid": "fef5fafa-7bae-42d4-9d84-30f1e652aa63", "comment": "Malware payload (Havoc)", "value": "b39f57a18dbb66f005dc81eb1419ead850c8cef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895365, "uuid": "f6bfa357-2408-4c49-a77e-9df8cad16e73", "comment": "Malware payload (Havoc)", "value": "f9c974c61a14dbc0358cd21e7a0ba3a59fd72f7ae2b3da348c62a8e45e05e7e1012a9e8b903cfb38aff60b6fe9d689fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895365, "uuid": "74c82a55-5735-4811-9c53-84040e3a2e4f", "value": "T1130833DEA89844D1DF081E7A1285E4F1DA0C8E645313A1778DD4BC373EDB2B67E18A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895365, "uuid": "36b75fac-ae0d-4328-81a8-441c44017f07", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895365, "uuid": "ee528ad0-0e8c-4192-96c0-95d6eb9b075d", "value": "1572864:7r9mj0J4sPdi/ra/NpT8iA+rkMZP/viAAG/AWIc6vyRFPOgtIVU7K:/EYJn8/ralpT86rkMZJA4vuyRFGpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895365, "uuid": "30413fee-84d6-4002-b0c0-2544a7972253", "value": 79062832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895365, "uuid": "6e29402e-daf2-4063-9b23-a6d86e94b230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895365, "uuid": "d74c4f41-6d17-416d-83d2-3ffc4105e7ff", "value": "Installer_1.5.4_x64_v3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6050b29-002f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741886590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886590, "uuid": "4f528a62-17cb-4355-85b5-68cf1e0d2f5f", "comment": "Malware payload", "value": "5899ee213738e786cc159f207fa47d4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886590, "uuid": "3ce717b4-4a87-4cdc-9aff-6d205d64d2e0", "comment": "Malware payload", "value": "7ac14ea846bb61f6754732e64d4e676bf7b7d920542d63eaa0c9587e082fc183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886590, "uuid": "71f1ab62-b9f3-483c-a360-807b4ce5eb27", "comment": "Malware payload", "value": "e0e01e375a98fd8dbad11b04e65b7ae4f97c8bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886590, "uuid": "39f62234-0412-4e34-a799-84e9e55756b1", "comment": "Malware payload", "value": "042e61e32ecc6d47b96663e88ab2ac8443a7059c67c874bba7a741e900560387fb1e83af1017da4258771f2dc762aac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886590, "uuid": "dd56acd6-5749-4f2a-bc1b-82b1488218d9", "value": "T168C4B48AD447C0A8D22611B045A9DE7E03E76F015D13BFE1EBBABF3A7A774837410646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886590, "uuid": "88aa49f8-afa1-4e92-9872-1bc356be2eb9", "value": "3062c2c9a3e12ad60a8526eb9117a28d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886590, "uuid": "b3228820-50e2-4086-a9d3-68112b89c407", "value": "3072:AhGyae+flPy3AfjglWLtwHFFDoS8ln7Sc:AhGyobg85aDoS8lnWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741886590, "uuid": "17c6bb2f-46bc-4c42-9db6-9e8389ec4c70", "value": 590350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741886590, "uuid": "9fe5bbc8-f7d4-408d-ab3e-c14c5f4d429d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886590, "uuid": "a05c24e9-a8c7-404c-8b81-aa46858a0357", "value": "OrangeOne.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b43a85-002b-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741884895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741884895, "uuid": "2829bd8a-10ae-41b5-9b20-6825bd5b973d", "comment": "Malware payload", "value": "1f2c4ac075b7a79917c290f0b9fd27b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741884895, "uuid": "164a9c32-ce8b-4d1b-829f-a89ed106cbcc", "comment": "Malware payload", "value": "7b7f4f1480f606b0e49ade273dd67ff9a636c428319fe074f9d98d0f76612728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741884895, "uuid": "8477728c-0ae1-4513-bb73-a0004bdd637b", "comment": "Malware payload", "value": "26b2d2ed94bea477e82f1dfe490aff259824ac5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741884895, "uuid": "d31b98cf-bc7d-43da-a7b4-61f11d828e05", "comment": "Malware payload", "value": "824373370c5c648f23bf77c7506853769355678000553413dec11c339014c8c6e66346299982a40941d4c993dcf581bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741884895, "uuid": "a1c56b8f-4b25-4ab5-8a14-ef71f8bc5000", "value": "T142E31254EEF2D6B6F06D0E3A19FB8DC97651F2613889713E41CFA3022AAA1EC1567740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741884895, "uuid": "96dad338-9ae6-4fd5-8acc-07a59ce43ed0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741884895, "uuid": "29b851bc-b86a-4081-b8c4-4c15c0244ae3", "value": "3072:b3GqXhaXFCV70nVvzvgQMjTjm5qCxBfSIEt/4EIOxhy/fFqBO0A3UQ6oaJ:Jx6Fw70VvzgQMjTj0xB2ZnaFkgGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741884895, "uuid": "dc3fd3c0-9a3e-494c-bfd3-48c6706e1686", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741884895, "uuid": "3d4bf241-1584-4e50-9dfc-409a8298a16e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741884895, "uuid": "e841458a-10c8-4ab2-809b-50b840a7b8a1", "value": "Portals.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13445c50-002c-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741884975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741884975, "uuid": "fcaba436-a1e2-4337-9d7a-d4fb3ab30b40", "comment": "Malware payload", "value": "776568985a9d8cbefa291cdca53d14b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741884975, "uuid": "7b374e9d-3d15-4155-8bec-aa308baae1a4", "comment": "Malware payload", "value": "7c8bee51f92cef74013e5c6998a2024f5b3b4a06dedc92c03a890f61debadb0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741884975, "uuid": "29c56688-1584-4de5-9e00-3c083157c2e1", "comment": "Malware payload", "value": "464d060a5c3376e1a460d22906b1bfc896b9d6c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741884975, "uuid": "f09094e9-9c9b-4cf9-9d31-891242fb42bb", "comment": "Malware payload", "value": "49b082a833afc801053d3d80459944a620d36da334d6dc517d058bc31711dcc425b08beb761c3b1cbdf6a1636ea1d223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741884975, "uuid": "f38fd0a6-7647-4cb9-a422-e4316c435982", "value": "T18B4530C2854112A4FEA60B314F3D595E517F6EA97934B42E98A6FCB33F331C2246AD07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741884975, "uuid": "a4deaa24-b192-4a8b-a035-ed38446a59d8", "value": "08f22dca3e4cd9ed4e3f459e8f6c3e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741884975, "uuid": "a4178dff-f888-4475-b5b5-5f7a6a024493", "value": "6144:fs8akwWVoEsw3Lxg5Zm947lNjyjxmsHGkyyA:fskua3wZF7bejtWyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741884975, "uuid": "b1f1a736-779d-4b97-848b-9beafb3e6933", "value": 1197292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741884975, "uuid": "7b69b3da-9412-48f3-8151-742c7b70e3b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741884975, "uuid": "308c63a5-3cf5-4cc9-8f8e-3f5178a815b7", "value": "xcfR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f862dea-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860138, "uuid": "cf631f05-34c1-4318-8a51-a9889e8a6bd0", "comment": "Malware payload", "value": "ed2510198b03435570d72ce274bc245c", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860138, "uuid": "71872375-93ca-4a02-b821-33ca6469b0cd", "comment": "Malware payload", "value": "7cba150646b812549c6f17c8bb622bee49fc115b04c67b87d30179c492a12f55", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860138, "uuid": "46600efd-d772-40d5-9663-1a2821f2b46d", "comment": "Malware payload", "value": "7cfcd32d2cd839adf08e6052f64e9dd561306a15", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860138, "uuid": "6690344e-0d18-4ef8-aba1-3591b39e3127", "comment": "Malware payload", "value": "610fe9957af9657d2b1e36a786f06d42dca9cf9bfccd77b226fc46b5064b65f9298485432a2d42e4eb43513123855c91", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860138, "uuid": "f12b3d36-80e3-4ff9-8f38-e2a82e2303ff", "value": "T1D051A790CEF80411C3A303105253958697CA3C238A09D8BE7FFDC7586FCC2A19BA50BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860138, "uuid": "b4d344c8-2998-4be1-aee9-13a0e4d1d1c9", "value": "48:9+wKKWaO8QpYXgCuyWFs4NNvtYEtB26PUYI5mMcV30:9+wK1yPWFVNNVYEacdI5mr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860138, "uuid": "764516d8-2a28-4c35-953b-f068e14c8431", "value": 2639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860138, "uuid": "fe21b6f0-ac8d-42cf-8e58-7d648069db7c", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860138, "uuid": "8a2526b8-0343-47ba-b4e4-ed7e588c97fe", "value": "7cba150646b812549c6f17c8bb622bee49fc115b04c67b87d30179c492a12f55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38c266c-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Metasploit)", "timestamp": 1741855608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855608, "uuid": "c801b7be-d713-4145-be18-5bd4396d34b7", "comment": "Malware payload (Metasploit)", "value": "588efff45957b805b2eafd26149c72d9", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855608, "uuid": "b650b7d2-5fda-468a-a880-8dc1fda6de14", "comment": "Malware payload (Metasploit)", "value": "7cc841e989e2bfc25da39eee6b8888f790712ffa1cde77bf6b8ea6c448054c0b", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855608, "uuid": "cc62e26c-3083-4769-bb19-295de1f74ae0", "comment": "Malware payload (Metasploit)", "value": "1e27bf5c4df5f2ae606f496bc30620456423beb9", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855608, "uuid": "5d7152bd-6eb3-4f5d-ad58-91de1f1242da", "comment": "Malware payload (Metasploit)", "value": "3a4eea36823987946355de9552e541136d5eb400f2d59ae5236caa7f2567adb7103b0f8f311c731f0aab02953eec2a9c", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855608, "uuid": "5dd9126f-5f28-4ba5-819b-8ad5f2cfb6e7", "value": "T1C161A4283FABAB6949C700727D7398CA5E252B3149EC7800F5FDD491BFAB9208537394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855608, "uuid": "0bd16fff-ef8e-44db-9d97-6f917410afea", "value": "96:wzgHr2/LvvOmP3uMrT7v0l1q0l1bYw0lZ0ly/:w0ruvOTMfA/cFM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855608, "uuid": "39d42071-e4ef-4f4f-aba9-f88286d84636", "value": 3198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855608, "uuid": "4e693c7c-f8d2-450d-ac71-b075868010e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855608, "uuid": "48837bb9-1ed5-4552-b84e-86a680328dd3", "value": "443_2003.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9123b66-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855591, "uuid": "cb347ca4-cee1-4ee9-add5-e2ca112c5478", "comment": "Malware payload (Meterpreter)", "value": "74c678685eb82e3ab19da2ff4d3da582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855591, "uuid": "be42649f-0ec9-4d5d-a82f-bcca0b892b85", "comment": "Malware payload (Meterpreter)", "value": "7d54021aae1144c9116756f1cac2dfda2a422c5580d4197390785b0c8955de59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855591, "uuid": "8081480b-2fe0-4312-8b73-537ba7c28580", "comment": "Malware payload (Meterpreter)", "value": "18c420a144d5ffb734b9bac442bd55ab9da9e81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855591, "uuid": "13d4eb18-0b67-4d67-92aa-ea1c350b0fe1", "comment": "Malware payload (Meterpreter)", "value": "8a1d215c559c5e2de89c6aeae3e2e2ea5c7759589eb9c28d2331a3d75feaf2c221d44336976b325f8216717bd11b7a3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855591, "uuid": "dbe3ee35-801c-4064-8b6b-ed08c305725a", "value": "T197E1830332691DBAC889463B0AA7E51B2455AA202BABD7ADCB14010F687305475B9A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855591, "uuid": "cced4f74-7116-4316-b481-ed438e1021c7", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855591, "uuid": "dc7da2e8-e08a-4636-8299-12af7f693df6", "value": "24:eFGStrJ9u0/6Skv/nZdkjBQAVAWch7qlKU64pSIxuuBYUbuqiksvcx+gGpmB:is0Gvb4BQXhel7Z8IxuRUqqilkxrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855591, "uuid": "f7e10530-469e-49c2-b528-2a6e0af69618", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855591, "uuid": "a204be49-38af-4e21-b5e5-2a28838625dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855591, "uuid": "3e89b4dc-8ac9-45be-8b96-d811bb51a333", "value": "staged.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953226c7-004f-11f0-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741900225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900225, "uuid": "5d09cd0d-3053-4e8a-8bae-347dad2bede2", "comment": "Malware payload (DCRat)", "value": "8f8da3c09f54ba611da847eb80c99686", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900225, "uuid": "cb855439-7f1a-47e7-8194-04f2909b6297", "comment": "Malware payload (DCRat)", "value": "7dc1fbc080662648b9fbfb4a4bd3ccf782b02ef3ffb1f1c841e5a041109ec7bf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900225, "uuid": "064375fb-7a91-4e6b-867a-2d78e73166d7", "comment": "Malware payload (DCRat)", "value": "c7da974c27816850bb08c3c02d72f7cd193ca7fe", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900225, "uuid": "a8999ee8-938a-488a-964c-83c8441aeb54", "comment": "Malware payload (DCRat)", "value": "e867e779281dd0f87f75fa7006e2cfcb6a77f16a89e225f3d086a7e1064194bdf1ed4bb58a35cc039f9d590a00956053", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900225, "uuid": "de203bb4-31dc-4ca2-8850-ec71e67e9c7a", "value": "T135E5E0027E84CE51F0191633C2EF454447B4EC116AAAE72B7EBA376D65213A37D1CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900225, "uuid": "faca8795-6180-4e52-a057-c6f0689d13a0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900225, "uuid": "2a8c0bff-ddd1-43b7-a5eb-1f689de1c510", "value": "49152:UbA30+N7c5Hoaep/t6vvq0KZfSn3iM7tNyGeXkulaPB8BcmB3CUj3twVmSMu+3:Uby7c5GpU+ESM7dPkc63VjdwVNy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741900225, "uuid": "9b435b62-9326-424d-ac02-fdbdeed4eab5", "value": 3089562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741900225, "uuid": "81d04bf8-23f6-4299-b5c5-d8bd8381b36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900225, "uuid": "98a5f56f-7e45-4f6d-a196-731f5402b403", "value": "8F8DA3C09F54BA611DA847EB80C99686.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2483e4a0-0022-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741880708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880708, "uuid": "b221c06f-a92d-4fdb-b865-ea8c6f8a6f18", "comment": "Malware payload (AsyncRAT)", "value": "96be558d45a473021cd62af69cb4e9ce", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880708, "uuid": "1406265d-507a-4e98-bdb9-01a58a1bcbfa", "comment": "Malware payload (AsyncRAT)", "value": "7df86e825f91ddf8f1983f1ecbdf5e68c7eb66137a157f989815d925c372637f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880708, "uuid": "2a71933c-3e1f-4847-8056-5d057ff77eac", "comment": "Malware payload (AsyncRAT)", "value": "e30732ff1dce6534edb84a15346f813d4a8e420b", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880708, "uuid": "0092895a-fec8-4662-8955-a5f55f156fb6", "comment": "Malware payload (AsyncRAT)", "value": "7090578ae6b45eec79534c5393336e04e782796b23730f18359e6496501f35fff423c8ea32764bd507b84ff4a1c9b9b6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880708, "uuid": "47880de0-86eb-44ba-a204-e82019f8f3ec", "value": "T1B72309003BE8C12BF2BE4B78ADF26145867BB2633603D54E1CC451DB5623FC69A426ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880708, "uuid": "c789041f-f78f-4672-9494-cb0aeb5a0727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880708, "uuid": "975bdf88-08d6-4ed9-b24b-fbe161babb7f", "value": "768:mu/dRTUo0HQbWUnmjSmo2qMi5hfQ1PI0zjbTgX3iA3eJ7uQ6rBFBDZyx:mu/dRTUPE2+H4S03bMXSSW7uQidyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741880708, "uuid": "cc358154-e578-4cc8-be89-f8e18acd5789", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741880708, "uuid": "439358c0-9fc4-43e7-ab41-11a00d29795d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880708, "uuid": "056ba891-4f6f-4994-b013-fc9bb567b818", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18336ae9-fff6-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741861790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861790, "uuid": "8cf5f30d-28a1-4708-9597-02fcd250c7c8", "comment": "Malware payload", "value": "cfcafa0b81c96d3616de494915b0ec83", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "library-ms", "colour": "#08201A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861790, "uuid": "8182f758-c936-48ec-8a07-91813d57864a", "comment": "Malware payload", "value": "7e5283395321363c7ce09a7cfc0e20b09f59442d5051d1b120cfebf1b43cc11e", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "library-ms", "colour": "#08201A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861790, "uuid": "6c302bf9-9132-4d74-b8d7-d4dedc42a738", "comment": "Malware payload", "value": "66245f6bff86ee7073e304e90f821b621f6190e1", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "library-ms", "colour": "#08201A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861790, "uuid": "2950627b-f3c8-432c-9cf2-07a9c378ecd7", "comment": "Malware payload", "value": "049aebd1df2965319f4ba3856a47b2e733acebe17dc5ee5376cdf07679f5b1713f82fb5563c81d7ff5336c7cba289752", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "library-ms", "colour": "#08201A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861790, "uuid": "0cf2773c-7c53-4bdb-b499-709337bdbb95", "value": "T14501664558F1E64073F78262AA21E10CEA72874B875A8D10F4EC43275F35AEDC627B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861790, "uuid": "cee6f5c5-24c7-43f1-950e-f8983f3b214e", "value": "24:2d+VP4+DvQJnPjIBAIBBT4eA0hrIqCbqFNRRZ2K5ZWqBqCR6:c+9Dv8ImITTvHvFNRRZ2IhAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861790, "uuid": "ce383a2e-6141-41e0-86cb-cac8ee9eae4f", "value": 786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861790, "uuid": "d9ba78a2-2e1d-4531-a45f-95992072b5ae", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861790, "uuid": "ff4b34fe-4600-4ab2-8f62-ab7e360c6a65", "value": "Order_invoice#09123.library-ms", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bd7391-0036-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741889351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889351, "uuid": "39e89384-0bd2-4116-88ae-73bc83dc7325", "comment": "Malware payload (AsyncRAT)", "value": "0fe820a7e7d09f2cb0c993efb7d175a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889351, "uuid": "bd61c73f-f912-430b-85e4-12b8cecedf76", "comment": "Malware payload (AsyncRAT)", "value": "7ef5857ed0663777ad1d98f4bca4fe9a51fc3f3e6b31bbfcc8085fed3d9105a4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889351, "uuid": "e886225c-190d-4ba7-b84f-35a616ee7bf8", "comment": "Malware payload (AsyncRAT)", "value": "983d74a5ddee0c797e72dc609c732f1ca866dfb3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741889351, "uuid": "265e6567-afda-4235-8a15-d8709c717764", "comment": "Malware payload (AsyncRAT)", "value": "c96681c6f08a68d482af3af3b5b7fbd75a13e2b62c47a3e81fed673f2682a3993d8a28ba09a448ef3a4a4499b109dbfd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889351, "uuid": "e6e3506b-1a83-40a2-ab08-f8fd2185b707", "value": "T186035C487BD44226D6FE6FFA1AB372060730E9079913DB4E08D89A972B377C489057DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889351, "uuid": "866b8ee3-b7a2-4972-b99d-52385d1cc78e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889351, "uuid": "76e17f37-46c9-4cad-b694-372b061a7de5", "value": "768:aiS8brf7blu3ml5G719NFfAL7FWPB9KXBOMhAaokrp:Npnf7c+5IFOFO9KXBOMKcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741889351, "uuid": "24c3e411-81d3-49cc-9038-74ea5a826f48", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741889351, "uuid": "5f708497-9b69-4da7-84b0-44c8b7d1799a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741889351, "uuid": "630d9691-3fa1-4d8d-8766-d7597983345e", "value": "sigmica.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1f5317-0024-11f0-ad17-42010a9c0004", "comment": "Malware payload (Triada)", "timestamp": 1741881797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881797, "uuid": "d907df23-b524-4149-aeb6-4a6fa46dd413", "comment": "Malware payload (Triada)", "value": "3222fb5739db6e7239c3233826ca5942", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881797, "uuid": "e17b677d-e93e-44dd-a044-2b67f44e53ab", "comment": "Malware payload (Triada)", "value": "7f72609c0fd19829da7ad12c02a26d1c7f609c820589b636f8ce42855a529a9f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881797, "uuid": "1633e596-3108-4db2-afce-83ed2915df78", "comment": "Malware payload (Triada)", "value": "07188e40d30a7187542c25fb46809733184dd6fa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881797, "uuid": "740a964c-23f9-4e18-a1ff-0fbbf7bca2c5", "comment": "Malware payload (Triada)", "value": "b06b1871ae089e45ce0b8113a9ebe474fdaae989b631a520d46a460f831cb564237d0817d614e1e37d8d6edc921ad92c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881797, "uuid": "1b5ae80b-ff8e-4bbd-ab86-52a0c83c29bd", "value": "T173180253E76C9FCAC4E3D2366A36C091106A6CAC434BE2AB2C2C7D7907B75C3570A5E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881797, "uuid": "2ecc77d2-9978-431a-86ea-d26dd4f9ad4a", "value": "1572864:O2+3andxULjzlXjKwobSLuKVc4CqWN47wbBf9kB6po4yp+:OuXClXuVguKbWN47A99kkM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881797, "uuid": "7531e45f-500e-4468-97e9-cd15508320a8", "value": 87912009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881797, "uuid": "04dbecd5-2a9e-4ea6-8094-9086c0657eb3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881797, "uuid": "31bda02a-ef17-4ef3-b8ca-0f9b0ae490f8", "value": "FM_3313_39.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662afa60-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879530, "uuid": "81a5d844-13ec-4791-b92b-84e3cd7bf7eb", "comment": "Malware payload (LummaStealer)", "value": "b7d4565a9d634456b769b497ab240125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879530, "uuid": "ae7c9c0e-9ce3-4371-bfc6-62258633795b", "comment": "Malware payload (LummaStealer)", "value": "8076fa4a81dc3069adfc7c9f902e6bded83edfc4131714d17f2528267789bc19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879530, "uuid": "270719fb-48df-4fd5-983b-09a5edff6f95", "comment": "Malware payload (LummaStealer)", "value": "895b664866ac5fb4e6b602f1525982e69f30c9e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879530, "uuid": "740f8bc9-e8ca-4de4-bbaf-5aa36bbc27a6", "comment": "Malware payload (LummaStealer)", "value": "99fa7e72ae1fdffca89f077d48ab7d20b5bb33ec7f7025672a8b67a96c53864eb1c320315d371a46a55a60d028c04edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879530, "uuid": "fe044c6d-1753-49d2-96d4-1f7ddb21a144", "value": "T13DF4D046BC91D0B3E91628B14D29E7C50C6B6B604F20C4FBBED89D646FB76E08932357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879530, "uuid": "9d88038b-a544-4d4c-b1fa-dd2d2fef4fa0", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879530, "uuid": "7ceb3eac-9901-495e-b647-3991527b0756", "value": "12288:GIJQ/s2kiatVPnIpbWiJ621POPAANU/Sc+e1RoKq/T/+Kc5fBzBS0+I4d0Z2cdyQ:7BnIpnJhdQAANeNboz/aKc5fr3l4dzcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879530, "uuid": "11a4b04b-3fc5-4980-879b-362fb90c6893", "value": 775488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879530, "uuid": "8fdac91f-c330-49ff-b614-84cfeaa3aac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879530, "uuid": "f6b217be-d1e5-4219-8213-6968f4363909", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a1fb34-0043-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741894832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894832, "uuid": "5bde06be-d6ee-4a02-9f6c-9cf690f530de", "comment": "Malware payload", "value": "fd5446c8f2d30af55c29d1d5542410aa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894832, "uuid": "1b60427a-143b-4136-b822-b60034036e9e", "comment": "Malware payload", "value": "828b1d178dfac4de6f4d8837ea231e8cd8597fbbaa7b5a096a4f86ab927d1745", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894832, "uuid": "7367af71-b6a3-484b-aeca-29b314f13fad", "comment": "Malware payload", "value": "1d0edbdda3582c74f20c81c1dcc269e8e44fc607", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894832, "uuid": "b6f29c39-dce5-4323-9e87-5211d9a9a160", "comment": "Malware payload", "value": "47c6c45698956891e1bd241c5e7e00263dc5f538b9d3d94fa12011bb0d6aec3e21ff71efaad9a62eef8020e15587ada3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894832, "uuid": "596a0031-1977-41f4-975e-c2684a5af723", "value": "T14EB73331BA9D8136EA5E44B2A93AAA2FA43D7DD30B7044DB53E4F85714714C3A334B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894832, "uuid": "dfd9efa0-45c8-4dea-a551-e807e658eeb2", "value": "1572864:uFT0lrefp7j7j4o3nipMi286l2R+3jUZFPohQAhI:uFT0l6bng2ZcR+TygaAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741894832, "uuid": "24ba4856-c84b-46db-8294-0a8ca6961159", "value": 50821120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741894832, "uuid": "0f04dc77-47ce-4c07-a8cc-367fd5ef3063", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894832, "uuid": "f060786e-716d-4f3b-b01e-9a7e8c286986", "value": "MSID1F1.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba89987-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860346, "uuid": "0a361acd-3595-48f9-87f3-9d4438d5bb38", "comment": "Malware payload", "value": "cf1bbe570d3114f032006df1523c2ec4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860346, "uuid": "4cb697c0-1738-42af-a65d-05bc259ea1f2", "comment": "Malware payload", "value": "840b7c653456c018f7d78c2e73494c5b6de6b4d53e9378b7645d2ba811bad937", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860346, "uuid": "7aba3735-131a-49fb-b344-559f7bf8d75b", "comment": "Malware payload", "value": "d9811d8bd9b3b9579aca1561bcfa4159be9cfa29", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860346, "uuid": "35451d88-9a1e-4747-8e1f-08aaa95ab819", "comment": "Malware payload", "value": "c402c6ef19b49909497ddcdc43f964363d02ef6319fe315323660d7311eead03de1d6957b7ca3f18ed7c4aff4e46eb9b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860346, "uuid": "836d3d95-9c5e-42ad-804c-9558042a8b04", "value": "T141F2D2754AC38F8F700B841BB2FEB7550C5EA57E5279E3EF9494392B89C424DA4124F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860346, "uuid": "a1653fbf-71c3-49e8-a4a1-8840502f08b4", "value": "384:gJh7dEvmY1sWf+e9dFzf0OFHyeIrSrq0NMJjfmNalWc2d3r4NUm4KTOXLHy4T:gJh7d8mY1pf+veIrSrq0NMJjfmNmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860346, "uuid": "fdb38c94-7b3b-4cac-8cff-b6507619eba7", "value": 36216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860346, "uuid": "78201bd0-973a-4d30-a60f-bbec6afae925", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860346, "uuid": "b392dea1-716c-4f15-8d8f-faf2c213e88b", "value": "xo.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ebadfa-0042-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741894800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894800, "uuid": "6d8285f1-94d5-4dd5-8be0-ceaf6591b13f", "comment": "Malware payload", "value": "1e7fcf154dbb896e98d93cd8fe450b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894800, "uuid": "73e4b088-2081-424b-bcd9-5a97e8879869", "comment": "Malware payload", "value": "851abaf510c088a58b70ddbc258edbbb2a699e0a5c41413364a296809ec01fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894800, "uuid": "3cd0701c-520b-4502-9e03-b07a2b2db3ba", "comment": "Malware payload", "value": "e837a3ca8082c4092eeceefdca847297ab340c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894800, "uuid": "182aef1c-f596-4958-b0a0-a5c25f1a47a2", "comment": "Malware payload", "value": "5885514824427b71964cc29d302a7c21f6902181027444e1300c2297de9003cf480c774bd27049553fec1649508e595b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894800, "uuid": "a00ce19c-8b4c-4fb6-a85f-b5b94a26ac6c", "value": "T12EE7AE11A7E80B06E73FC27DC6639252E7B1B4431351C6CF0198DA993F53BE19A362B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894800, "uuid": "9de167bd-c272-4bf8-936b-6a57f493b573", "value": "4b1892ce4fbcfcf064c6f69d693fc6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894800, "uuid": "ab837775-9dfd-4b6b-944d-e25bbc23d5c0", "value": "393216:GrRGb1Tx8Dz+MP9ZGVWOeU85mlZoSaH8z1HSajXgJgV36hqM5+t7MH1tMnJWQuiK:Lbn8DzuWOb85P859MOV364MM2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741894800, "uuid": "d373b05c-828d-4779-af70-2f3359adbbbf", "value": 68974752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741894800, "uuid": "7db577ae-1efa-4e9b-ab6c-50d4eae7cd01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894800, "uuid": "c1a5c195-9a8a-42ec-aa79-b3b7311e3da4", "value": "Distributor.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5eb254-fff7-11ef-ad17-42010a9c0004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1741862446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862446, "uuid": "cf1fb861-d50e-44b8-b4be-b3f54517754d", "comment": "Malware payload (VIPKeylogger)", "value": "091339b9b937b6193b28a92975e7d2ae", "object_relation": "md5", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862446, "uuid": "b315e6e9-3f51-444c-89fe-98f6fc28c070", "comment": "Malware payload (VIPKeylogger)", "value": "85a8c769dc1066bc515c68796178c74677e8bfc7a6251688f9f3bccb275df2d0", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862446, "uuid": "39071ded-f7fb-4e9d-abc7-f18b62aa1a5d", "comment": "Malware payload (VIPKeylogger)", "value": "a4f023b841cdf5942908c93d27f33a4fbb0ffb07", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862446, "uuid": "afb1f94d-a90c-4e07-872c-4156ec0b368f", "comment": "Malware payload (VIPKeylogger)", "value": "2ee938b9d79c3dc07a95f655cb1a6e7ebd82c76590615d71dc92a13a7bc6a0eb94d83306a23baa73dafd14feca195175", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862446, "uuid": "7914822c-2803-4746-a40a-e5053363ad51", "value": "T14744F1108D831FABEBB90A0752BF2919B3D111AF013584C797977E0AAFBF54C5207A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862446, "uuid": "707f7872-8a83-49c6-9f99-63f00dbb76f1", "value": "6144:4s39gNPe2hOYtobWZ2OwqvFjOYJziR38Umc:4s3ONP3hkbW9h9OGtlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862446, "uuid": "a99cf7b9-5f7b-4910-a1f0-0b64e7ecc71a", "value": 265295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862446, "uuid": "f7b532f0-4e55-4765-a379-e933fcd56892", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862446, "uuid": "85266d3b-1e8f-4986-8ae5-fe17fe970fb7", "value": "SOA Since OCT DEC 241738316681530012900.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ad3a9d-0025-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741881996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881996, "uuid": "f496d4d8-e28e-429b-9c8c-24cd033e1506", "comment": "Malware payload", "value": "8bb4a1ec1e543f4e9dcc4bd46a198c07", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881996, "uuid": "71c8553b-d203-4bf2-a3e4-5888c3090546", "comment": "Malware payload", "value": "860155110ca64bde55038ad179f43f19455a83c93a7009583d5d2a808ad72d58", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881996, "uuid": "3cd0d7d9-af1c-478e-892b-5026987a2411", "comment": "Malware payload", "value": "41cc2226c7c67b5165beee51bdf3a6c8b5614704", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881996, "uuid": "1e7afb97-cc3e-4bf6-82de-b9279c6b04f7", "comment": "Malware payload", "value": "1cbef0e9b3e681c97a9758b6160443e6d4455aa5bf11a6630b679523916cbd05455664a70a0c5356efecaeac94861d17", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881996, "uuid": "d04b6a74-a2c4-4bb0-880e-6e79a0ac94b7", "value": "T183D712E3E309AC69D6F2C33693B411A7B9250D659713E3670502F6386EF3EE08149EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881996, "uuid": "2f36176f-8a12-4aaa-b936-c9f078fb1c99", "value": "1572864:gaRlhvJOex2/0aMkqImyQopU7S8xR0sleU:nRlhAeXLkZgo27S8nL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881996, "uuid": "c2d7ed71-eead-4524-8eab-4cbfeca1650e", "value": 61261838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881996, "uuid": "8e4fd5b3-42fd-4bf9-84a9-932184b8ae22", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881996, "uuid": "4ea396c4-d55b-41de-b507-1abd96cccd28", "value": "TG_CJ153256_pxz.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213d2661-ffa9-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741828734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828734, "uuid": "4fa9b6b7-e9a7-462d-b20f-1b1813656c8a", "comment": "Malware payload", "value": "41208a0e37b2d9055c433ad7ee814c5c", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828734, "uuid": "287ca187-31ec-4b2c-ad12-e69aff232857", "comment": "Malware payload", "value": "86bc8962bcf3e8463af6a4b4e4ef2ae552da99ead8170d0d29a8cc6103a9a9c4", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828734, "uuid": "4ad05051-86e5-46b5-9e2e-9990fbb1c28b", "comment": "Malware payload", "value": "3884eb2942764637538b8c6fcd3a08b947c9179f", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828734, "uuid": "0097caa6-5648-42ab-9490-25d9a1d25ad0", "comment": "Malware payload", "value": "577333e879be09d8d6e64d86778b8147c0908ab97fbc0c5077a5192606ad3eefd86715393a18f018d5abfa90b4a3104d", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828734, "uuid": "fda3ce89-f7c6-4062-b1b7-b0c923cf63be", "value": "T1DA1422B7FABE4204EE0D82F4444B6F0C1A15A89CD1DE9958F7E016563D12A4C7E2EBF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828734, "uuid": "fe8e3100-66d9-44cc-9f35-484e1498e55d", "value": "1d88d597200c0081784c27940d743ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828734, "uuid": "926f2c03-7c32-43c1-8690-8d237b5a61d4", "value": "3072:deLpPtupPniqz0a6g5lFfH57Jjr00JyecsMc1U57VV4vKj8DerAPgrIVout:deLttuZtysFvtJjr0heI4vc8akQIVoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741828734, "uuid": "15bd4340-c08f-4c7c-8b56-0e1cf596108f", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741828734, "uuid": "f979e7d4-f587-4ab4-b6c6-438a593a60aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828734, "uuid": "3bc93850-adeb-470c-9fee-a5c7012b3640", "value": "dxp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99710b79-ffa4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741826788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741826788, "uuid": "9dcddf1d-3d7b-4f58-9a9a-f46928238d5f", "comment": "Malware payload (Prometei)", "value": "f8186063a573f5f4d5485d713789f1f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741826788, "uuid": "e1746f00-d514-4b90-8ed8-3b629f9ea000", "comment": "Malware payload (Prometei)", "value": "8713aac4702e000ef67bf5d855c9fa2f64541021abbe38a35a6ebf5d6407a7d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741826788, "uuid": "00976db7-0b38-45c1-b996-74d963b761a3", "comment": "Malware payload (Prometei)", "value": "7d6969180bf7bdebeab99f75faa5854602231863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741826788, "uuid": "f65dc6dd-6257-4fb7-b548-a796deaeb37f", "comment": "Malware payload (Prometei)", "value": "0febdbb58ba9caeb1419ec90c62bcbaa206e2f6ede135db338f5e6995042848e3166ee66053595a5af85d4744cbb3530", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741826788, "uuid": "661f8689-e109-4021-808e-3355874543c2", "value": "T1919423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741826788, "uuid": "27e1413a-1603-4a34-abc2-9a6f0ea83f88", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgo:25WOSACZSV6eKRH5EPiamb4DsDwwc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741826788, "uuid": "bac7f447-dbf8-458c-aaa3-6b8e93b21997", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741826788, "uuid": "3ad38282-7069-4248-933d-70cafb0c3e64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741826788, "uuid": "787d910a-6c49-407d-a9ce-3cb72837caf7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33d43b6-ffd2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741846615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846615, "uuid": "910153bd-c5aa-47af-843a-e034b08f960c", "comment": "Malware payload", "value": "68bc4b5e05849b3af3ad62c7b218ec12", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846615, "uuid": "246f6a1a-af49-4734-aa42-38542f433d46", "comment": "Malware payload", "value": "8759fd83d8f7dbcab2f404499c6edade4f26755773b26c37d67e83a953e5041e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846615, "uuid": "ec1b142b-1502-4c0b-8d95-2669d1e4d8ca", "comment": "Malware payload", "value": "3d91885f2d4aacabedcd930942948c0d8d3447a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846615, "uuid": "abd326b9-afc7-4e35-aa4b-bf8eb3b709f2", "comment": "Malware payload", "value": "67f2c75e06856c3110e285a5b6cc0c4c2e7a42762678ec6f7c201e1f06f6167e8abc0e581d7b6e6ad7a3e7d7c89507c3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846615, "uuid": "58a7737e-ba9c-4b61-b585-4598cc95ae43", "value": "T1EED02B4CFC0308F7F0348CFA66E71494D10FA30C2E06668C4182011BE4F0C905410853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846615, "uuid": "8522f010-a7d4-4e5f-9cd0-2bea7060745d", "value": "6:/VJswFGYj2VYtBLdY7YBIQXo3FsDKVKhOXqIKa03IKq1IEE1IKBKW:/VJH2CpY7YXXjWghsONI08W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741846615, "uuid": "30e069a5-f157-42e7-8c3c-5271d8de16d0", "value": 257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741846615, "uuid": "fb0ae560-5f38-408f-a7cb-a2cec81b2371", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846615, "uuid": "7fb56899-6f17-4b53-9caa-20b46b6f4b00", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039e98e2-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741833409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833409, "uuid": "c178bcc5-1a90-4878-b685-074ae972837b", "comment": "Malware payload (Mirai)", "value": "264c6c748eec1098f6fa63d2566d9414", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833409, "uuid": "93b0beae-767e-458a-b13f-4972fac18e31", "comment": "Malware payload (Mirai)", "value": "8816157dc12083016794e44507210b1ea6f34936b978cb52dd5b910def37e9ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833409, "uuid": "cd55ba99-2382-4ec2-9119-c8276effd31b", "comment": "Malware payload (Mirai)", "value": "66cb0070ea801e5e9c42090f9fe8e5ca20d0873c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833409, "uuid": "2db699c5-c70a-4e58-be66-6b58781a7481", "comment": "Malware payload (Mirai)", "value": "c6ea352a8523fcf8f48e672c2ab016a1040f01b210a2b72a399964670ff39c31c9616fb3ddc364e521f7dbc567eaa034", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833409, "uuid": "5d76f1d8-6db3-4794-8a7d-324091f9eb5d", "value": "T1AE233A95BD819A12C6C61177FF0E428D3B1643ACE2DE33039E16AF2176C796B0EBB150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833409, "uuid": "865bc0fb-0478-4142-a800-e3cec1402c71", "value": "768:7keZOwI/UwhsP3SUPZwZjW7PJg99CcCM5M//M9V22XTK5RT2Vy9KQv+I:6/U1P3S0ZGrj5r9VRXQRaOzv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833409, "uuid": "50cb83be-8004-4556-98f4-f551afdb6b79", "value": 46436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833409, "uuid": "5d70978f-23bb-4886-b6cc-c45c0eae7bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833409, "uuid": "693d233d-df0d-464e-87e6-cd3c248d6720", "value": "miori.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28367dc-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741855606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855606, "uuid": "a4c4255a-f2a8-4554-b8d6-8e97fa6a75e8", "comment": "Malware payload", "value": "374d956014cd7dc05958c6a315cbe5e8", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855606, "uuid": "70a1e80f-e6a5-4c30-a83e-e5274a0f7789", "comment": "Malware payload", "value": "887474719c9330a49c49b0f33c2942bcabd0b5437e71644d56c9a2213cef50ee", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855606, "uuid": "5dcac6be-c8ca-43f2-93de-503175bf5d68", "comment": "Malware payload", "value": "236e151aa7c9312e0071373d1108fd9a5366029f", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855606, "uuid": "8e031906-40b4-40af-bbf5-b7e88bad7abd", "comment": "Malware payload", "value": "6d28cb96ccc500cfb224256a2c12e9fd4b9a9caffe9fb6445e53aa9033018ff8487d7edbc11e02bd7f46b21520456b39", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855606, "uuid": "138fba4d-283c-491c-bebb-f9fe0b54d3fb", "value": "T16A016502735331A8CA6014BF8E19E92CE4AACF323B063CD4E71A031767B681654681D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855606, "uuid": "74aad27c-5d80-4147-a52e-4b36513d3aad", "value": "12:yeBn1t89xkaupK9UUFFrYlr0JFt9L11n0+skejq6xi4bE1Enb+ljWv0VxcOKgB3:d1cxwKBFxYlrep110eoVxi4buqiksvc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855606, "uuid": "8c8cc339-fa26-4ecf-8b85-afd842307111", "value": 755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855606, "uuid": "954ada46-2c53-4af8-9e33-c158f8083157", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855606, "uuid": "f8814ef9-fd51-4c2d-a136-5431825e0d03", "value": "443_2003_raw_x64.raw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22714b15-fff3-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860519, "uuid": "29854fa8-a70c-4859-a037-2a7601d93339", "comment": "Malware payload", "value": "c66022aa8b77a95c9b78a8743657f830", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860519, "uuid": "ddc73fb2-4df5-44c3-9eb6-9f6f412e334b", "comment": "Malware payload", "value": "88e9e2810590d3126a518630460e4179f2a4c8cb956abc6886c663b0749382f2", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860519, "uuid": "92904576-641f-45b6-bac3-84f9f6acf4f2", "comment": "Malware payload", "value": "7353de0aa950726c57245932fb6a21da7beb0a4e", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860519, "uuid": "75adcbcb-1b16-4033-84f3-3fae7b3e00f4", "comment": "Malware payload", "value": "7ac27ca8535e2f2dd90362264f5606d2701c1f6d1a1af3a07afb97562bc3da973430a46b0a9b5c736d7ffe84b8deac15", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860519, "uuid": "3dc0ee87-67ce-46f1-9000-214939d6b0a4", "value": "T18011BD82EFF9206062B6892E91837126C5B03A43437BA826777D5930DF370D5E2632BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860519, "uuid": "c9af46ac-fe51-4de5-ba7a-645d10b7b875", "value": "24:LL8Y96oYGwXyOn9MoioCK1bfxyUS/A0CY5hRIy9x:ZdYT9MzK17xmo07Kux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860519, "uuid": "1a6d5589-f4dc-46d6-a41f-593c0db52a52", "value": 976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860519, "uuid": "a1895019-2e5d-404f-a72e-e6f3e8c29baa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860519, "uuid": "01b18e18-3af4-4d28-ae3b-2ad51a885aaf", "value": "88e9e2810590d3126a518630460e4179f2a4c8cb956abc6886c663b0749382f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ba2841-005a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904788, "uuid": "ec28fcc4-c90a-4874-84f6-0a1d36df86c8", "comment": "Malware payload", "value": "bc7b5c831742a47e630c11f8ca450dfe", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904788, "uuid": "6dfb67c4-151c-434b-8995-61676d46a9a2", "comment": "Malware payload", "value": "89d4372281d6782f99250ac75522a7c1aa0e515e62cbf506fe682bfa86fd4009", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904788, "uuid": "a0061a3e-3efe-4137-b44e-9822708be657", "comment": "Malware payload", "value": "53c6d7f03f58a358a74092f03749843093681403", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904788, "uuid": "716bd585-d891-4589-935a-4d076fc77f65", "comment": "Malware payload", "value": "5f4517a49af15aca9fea593c3b11cca10b32e58f75c83ddd2817e23abcf136b456dd419fd44ddd4cad8e3be52246db48", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904788, "uuid": "d4523013-e150-4eee-8d28-24e491138106", "value": "T17AD58D11B697C136C57E45712A79EB2E10BE7FA51F7448EB27E85A6F0EB14C20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904788, "uuid": "9c13a027-5ecc-44ed-8b7d-9f8cb38ce4b8", "value": "49152:e4SY79MftgkPApVqVZ9Rw4YP/BD/vTBPduTRUhfwEOB6zDojOwfFl8pqLOSGR3v+:AYxYAvqePdcBqwApqLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904788, "uuid": "cfded6aa-7018-4571-b1de-a62851705c9a", "value": 2860032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904788, "uuid": "ba58dd70-6e81-40c6-bc1e-890d8fb1fbcf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904788, "uuid": "9081e03f-7243-4378-aead-3af33fd726c4", "value": "AIE9C8B.tmp.part", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8fe8d5-001e-11f0-ad17-42010a9c0004", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1741879355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879355, "uuid": "6c883fdd-8644-4b53-a458-210b94579328", "comment": "Malware payload (Socks5Systemz)", "value": "b4ad1bac62eb28ad0bff59d9cf44abad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879355, "uuid": "2d6b6356-c876-4d81-b382-2400b81e05a3", "comment": "Malware payload (Socks5Systemz)", "value": "8a35e6b6f7fce33c90f04aa7ddf355d4fa8b9329757709de60b4dcf7a39c50b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879355, "uuid": "7983173e-f1b7-46cf-a328-1cb433e0d485", "comment": "Malware payload (Socks5Systemz)", "value": "bae90c58ce70d8238254029b9d660fab66736b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879355, "uuid": "a73c6ff4-c66a-475b-b6a6-a09e5c9a911d", "comment": "Malware payload (Socks5Systemz)", "value": "2afbcecfe579d35b1beb7420dbb8ae1d6143cd44a9d66394a0535d6fc3912bf449cda9e5d9a6b2f8197d5638b0c1190e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879355, "uuid": "0fd13ccd-7ee3-4754-baa7-5ea1b66f46d5", "value": "T1B416334F62F3D83AD0A9C6B92D37D113519B7F52397B214072986F18DE3F82A212D366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879355, "uuid": "c59d6428-4c14-4d20-b17a-b8f42ee861c3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879355, "uuid": "d3ccf1ca-fb75-421e-885f-c004c49c9f2c", "value": "98304:3//dOlnLPJMx82oRDhBWny0DN3IP+US1kXr:v/dOlLPJ85Ms3IGU0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879355, "uuid": "75ddb8ab-9ad5-48df-9496-cde2e92afc85", "value": 4057649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879355, "uuid": "d4214ece-61bd-45a4-a963-70f2481c50ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879355, "uuid": "dd54b526-e187-4789-b8b2-af8421e4473d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f5a0c7-ffa6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741827698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827698, "uuid": "61854776-9639-4e63-9f1d-081414ad5dbb", "comment": "Malware payload (Mirai)", "value": "a1e67a8441fb2df1bcc1023b81befe90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827698, "uuid": "bee95b0c-233e-4875-9a92-8be245881fbd", "comment": "Malware payload (Mirai)", "value": "8a461208e3394ba949987ba259c82b1249148614b03474d8a83c5e829f340668", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827698, "uuid": "4645ea09-93c2-42f3-9f3c-4f5941aa0129", "comment": "Malware payload (Mirai)", "value": "c7d4da52edabbe3d1f4b72aafba690f0a795edab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827698, "uuid": "d3facf57-8adc-4d3e-af5f-90a3fa57500f", "comment": "Malware payload (Mirai)", "value": "84441071bd26988848dfc05b72bb41fc4da208e6eaf99ca46d11c295de4f904306acb6f577838159a6a283ca684c58c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827698, "uuid": "ea9f586a-f729-4470-91a8-80eaf7ce47bd", "value": "T1C57312E027B5178C1276E8393BDD306E8124722A339E29242D9791CEF85B703A573DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827698, "uuid": "a8e6a53c-fb65-43af-975a-5b03ca77ed58", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzZ:8D+CAXFYQChaAUk5ljnQssZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741827698, "uuid": "d8a799a9-63a2-45ee-b761-c4fef658e4ac", "value": 74048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741827698, "uuid": "1eda8e7e-783d-40f9-8d2f-22934ad3d516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827698, "uuid": "e412febd-3342-4f5b-b9ac-f25cb158c30e", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66312a6c-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879530, "uuid": "3671eed6-f201-49e7-919a-b124e83f825c", "comment": "Malware payload", "value": "7762990562f96b0650da3c55e3329efa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879530, "uuid": "a8c2f25a-c129-4b8f-812c-562e94608c11", "comment": "Malware payload", "value": "8c11f38ceb7b2a8ba3b7d6a34a1d50ede35bf328838cf1d8483ebc85313b5ed0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879530, "uuid": "57663755-c0c5-4b22-9f6b-f9642f31815a", "comment": "Malware payload", "value": "feac520d4484a377ff4e183bfef4f6a843e3a977", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879530, "uuid": "27fd33c7-7fa3-4945-85e4-7215260de959", "comment": "Malware payload", "value": "3974b491495e7aeb7ab0e2d535e1005c8a2f17118675c1266607f0f82dd44b559168f84ba8a8aa9115c4ccae661e1a76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879530, "uuid": "3e50ceb8-3203-4897-86a1-0c2f58856d3e", "value": "T13A867D52FBCFC1B8CF4BA1340C0E961E892AF2494B254BE7E9885E574D11ED12DF9287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879530, "uuid": "eabd7e7b-b0cd-4ebe-b38f-831a915b7e22", "value": "13e24b6ace05771ab3f1203f65f160ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879530, "uuid": "a3c26660-f3ad-4863-9da7-74b577ff3ac3", "value": "98304:rxROZAe0cTSFGuzhyzzJx13wCMNVZoznsN+vF:rxwZNeoAFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879530, "uuid": "4ef95ad2-6b6b-4495-a509-c7861aa99dfc", "value": 8602792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879530, "uuid": "5032e5d7-83d9-48ec-a8a9-29219009cf8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879530, "uuid": "40e5f29e-325c-4682-a420-358147d2c581", "value": "QtGui4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46978bb-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741849624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849624, "uuid": "450df243-fdd9-4f08-8003-255da5dec5b7", "comment": "Malware payload", "value": "67f29147e2952b2f744ba6ad8efb0223", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849624, "uuid": "971fc9fa-05f0-43d2-b40e-4a69b2a3436f", "comment": "Malware payload", "value": "8c48531c3948d5835d619bf7cd66b27998eb2730e9239ed475ac8a812245bd91", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849624, "uuid": "300fe2d9-3788-4286-8cf7-5aa47bd07cd3", "comment": "Malware payload", "value": "5d36fad2751c54e17a937de11c7a67eee6c427f1", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849624, "uuid": "16e5977c-412e-4a44-892d-a77a3a7bcf2f", "comment": "Malware payload", "value": "31a6141a6ab2465aa469e4f4b46de59b26a40e34d1139860515dda4c7cda4e38ddb4e77587172f82013602b63a98fd62", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849624, "uuid": "9821b9f7-147d-484f-9d13-5d53f46aaeb3", "value": "T1A73522E9BC907F57DB0B413A5B4EC4BDA40A7E1E2748D14B3530775A2637B6E80B282D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849624, "uuid": "b59f3204-6006-4a35-8a34-0181aa9dd14e", "value": "24576:9JIwgUBaBKIb3nOXYXKFlHB18/+12vWhTb3hx:9zgXd7O7Flvh1f/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849624, "uuid": "6e2048de-34ad-466b-b24b-f6749fa30a39", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849624, "uuid": "1b07641c-a5e2-49fc-96cc-c03438145d2f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849624, "uuid": "4b722024-a506-4a88-927c-acfc2e7c5bcd", "value": "NB NT19901102W.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6415a8a2-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824981, "uuid": "81ccb480-766f-4411-bfd1-fba5226a8563", "comment": "Malware payload (Prometei)", "value": "121f79cfc657e11859c3af4fe9126080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824981, "uuid": "1669c8ad-aa79-4387-8f0d-85b294fd7e01", "comment": "Malware payload (Prometei)", "value": "8ca60e4a35a62ec52f6b79d4c93561f7251926c6d255ca5b01bd9b239a5d3cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824981, "uuid": "a9a8b152-8cd3-4dd6-97e5-b2b8d8acfc01", "comment": "Malware payload (Prometei)", "value": "a6b687da205abc13b3e5e695ac831734bcdcb01d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824981, "uuid": "d1f0c74f-413b-4ba9-a161-e44c1d5c42b1", "comment": "Malware payload (Prometei)", "value": "d39b53bef94ce8341a4aed13ffd40e73c2d4ef6dd3012784fe70c1ad6c3e4486a18c0b157fd7de38d7232de97c12d3ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824981, "uuid": "f184b8c7-9b71-4324-930e-74bba0f57773", "value": "T1729423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824981, "uuid": "cc0667ef-f6d5-4bee-8a85-773517311fa5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgR:25WOSACZSV6eKRH5EPiamb4DsDwwcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824981, "uuid": "80dfb8e6-064c-4b9b-b6f7-1e6076a34bef", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824981, "uuid": "79a0191a-50b2-480d-af30-aa876d937e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824981, "uuid": "14bf041f-3219-4209-a459-9896cc403cc5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd9a188-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825022, "uuid": "aabaa753-4ffd-49f2-a01e-007bdf01afef", "comment": "Malware payload (Mirai)", "value": "a56b26776399d45813f809bd996d5cfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825022, "uuid": "c75b534d-208a-4744-82c1-4e0e01b122e4", "comment": "Malware payload (Mirai)", "value": "8ce3c69d9f4343efe954ea8ac37b1be72384272b217e8169ef9cc5cd2f6e4fc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825022, "uuid": "0e672ca2-092d-46db-a0a6-36e0e66f6ab0", "comment": "Malware payload (Mirai)", "value": "434f45b4d4180b9ab8626e414da42230c6943fe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825022, "uuid": "96d25f76-0f05-44ef-9842-6561982e1a9b", "comment": "Malware payload (Mirai)", "value": "5df4503ae02fb9a0a715202a00bd26953b8a81dc50e54a77ecbdb11048754d8f9906d2bd6ce6f5c7d469f325728bb77e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825022, "uuid": "0a9a4c15-2e4f-41a1-8eeb-73758813e4d3", "value": "T101638D76E4266E54C0850134B4E48F750F63F2D8822B5FFB6AE182A65007EACFA05FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825022, "uuid": "30ad2a9e-939a-40d8-a7d3-8af525ee2c11", "value": "1536:Naadjk0XHHDeDZkF/KLlAyrK2rA2sII41gCwNUR7410nH:Ntk0X6tEaSyO2xI41giR4eH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825022, "uuid": "6d81825e-f2c6-4116-891e-089bd294d385", "value": 73280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825022, "uuid": "01609759-c54a-4adc-86c6-4967c0be8752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825022, "uuid": "e7244872-1c1b-48f3-a386-dc085bf0fa2a", "value": "Federalsh4Agent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f0e537-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883387, "uuid": "501ee68c-93b2-41b6-aa08-a6156c9a33cd", "comment": "Malware payload", "value": "2c8c8fcf45f95527a07bcb44a4817853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883387, "uuid": "e7989ba4-441c-47c3-8f33-e321d064f8c0", "comment": "Malware payload", "value": "8ced01bc855663b15ed346e996956f101d8b60b0cbe76cd002ac08a64d0433c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883387, "uuid": "a3c5263f-8a9c-447e-94b2-eb1284e846fd", "comment": "Malware payload", "value": "6efba5105cd587663f6e01e3acfcf93d090140b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883387, "uuid": "1826f568-d046-4fad-baee-7801619c24fb", "comment": "Malware payload", "value": "3881395d4b7dccd08181e3589f5a5309f2b8ad821ab31cb2ea702a9fb6e4e08d47be786bb1f475fb7a36d4f9186a68be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883387, "uuid": "0ab9936f-597f-4ce0-b6d7-188034da0b87", "value": "T173A5D023F2CBE03EE05D0B3B15B2A25494FB6A616422AD5796ECB4ECCF351601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883387, "uuid": "59a2055a-686f-4188-86f4-07076b57aa43", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883387, "uuid": "df4dda05-fb3e-40de-98ad-c38e379c0c30", "value": "49152:GwREDDMYL4i8lnA3ftiaOXziJD+QzMm1RBoBVtYHqgr:GwREnAA3FMi9+Q4m1PQKqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883387, "uuid": "87788822-1b40-48e1-ba1f-d4992d68fb03", "value": 2241760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883387, "uuid": "79220c72-daa9-431c-bb00-39d496cb3f5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883387, "uuid": "9ff6e77f-b10b-4b85-9416-e741ca14c8d9", "value": "abtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914d1883-0003-11f0-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741867577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867577, "uuid": "2c22addc-ecc4-4b01-b4d8-38328b3448bd", "comment": "Malware payload (Mirai)", "value": "f4117b3630e70d5b990880f88f257471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867577, "uuid": "4670db33-ca32-4ded-87e8-4f0c2faf172e", "comment": "Malware payload (Mirai)", "value": "8d43da4cd364245a27c679df4fad3e0bc7b07bf6b87375a8b98069c729ff1047", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867577, "uuid": "1ae21049-f1ef-4b30-938b-97cd72da1e0f", "comment": "Malware payload (Mirai)", "value": "9968fe7eea32b91d8b4ea524a8b88ea62470bf03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867577, "uuid": "264e464a-cba5-4a38-8617-187a8206e009", "comment": "Malware payload (Mirai)", "value": "f325f42fb6ce57f06ba56d17ef195270a9ed70e3fe3656dd884e80a28f10c5b8ee92e0e5c4564ae69506071172706a84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867577, "uuid": "187f02e8-b806-4b69-95bd-5e98d291c1eb", "value": "T1DA4318C1B586F8F1EC04557C30AE9BB26E77F436B83ADEAED3C45523A805241A20739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867577, "uuid": "e75fb496-d755-4e5a-b9e0-9a19612c2046", "value": "1536:50revIyoYJH9Hzko6wiInu22FqBNmvkkCXNRdSgEUQ:LvIjMH9Hzko6b722FqvmvkkC9R8fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741867577, "uuid": "379fa015-80ff-450c-8726-4d70b50bbd76", "value": 57944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741867577, "uuid": "9ca30090-9b8d-42fc-8249-f810d79fb65f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867577, "uuid": "a59a0d7d-b2bc-45bb-aa33-7a429eaab663", "value": "Owari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76805459-0044-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895449, "uuid": "5af39798-f143-4943-b8b7-7988f3154d9b", "comment": "Malware payload", "value": "33bda16926a94a83a84c21c867341f3c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895449, "uuid": "cd3e0c20-d6da-4ba6-a672-67cc4d433134", "comment": "Malware payload", "value": "8db35b2412c9d955c4abed065ce4ceb4d0117e81845f84c51eda3542342486f4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895449, "uuid": "0ee58603-c54f-409a-87d7-7a5d81f39529", "comment": "Malware payload", "value": "93700fb209d06b4c0f96f3f1a4eaa633082fa522", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895449, "uuid": "f506944e-76cd-494a-a903-83a7febbc143", "comment": "Malware payload", "value": "6fdd9dfa126de679511d75d499e5b466c89da99aa916e3fc97afcf51a3a6ee8d13f6d9d45db9c5378617be3f97e3d773", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895449, "uuid": "cfe366bb-da1f-4106-ba1c-6a5377f5016f", "value": "T171169E217A5EC036FA5E45B1A63AAA2FA43D6DE30BB044DB53E0F85B15304C39335B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895449, "uuid": "d9e24f7f-db78-4d5b-8cb1-41c1bf452afa", "value": "49152:2BEliN15sBAbwjHtS5DfKFT3zGLAl+quHMlKJM4L1aLKc78kZuzktoS9xeXf7LKx:J8HOFT31uooUwXXMaMs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895449, "uuid": "27bf92ad-f419-4915-ac83-258c95278d45", "value": 4220928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895449, "uuid": "9acfc40a-48aa-4739-a784-f4220975c24b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895449, "uuid": "e6f235a9-25c3-4ace-9bb8-c32fb36ac4d0", "value": "Distributor Software.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5ccbc6-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848722, "uuid": "2e4803cb-f9c9-4622-a868-44cef28b5639", "comment": "Malware payload (Mirai)", "value": "48547dff3d8b2ce7b97f017252e5aaf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848722, "uuid": "52caaab4-e033-481b-ab9a-3882afe65287", "comment": "Malware payload (Mirai)", "value": "8e0b3881d123b8800f0a351a1a6fcad479fdad6fa1b1a2c950f94211d09f6034", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848722, "uuid": "683f7508-05c6-40c5-995f-701a9cf757bc", "comment": "Malware payload (Mirai)", "value": "49e887a0c08eba2f5084cc53fe62ab43a0f668ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848722, "uuid": "ebe20f25-ed72-4ada-b0a0-659f3c20972f", "comment": "Malware payload (Mirai)", "value": "613fc0a07de5d860f7a2344064d1692b9c77571a3385898b0423a9910b7d2a37ebe6b1cc22af62e95a393591e8fa2574", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848722, "uuid": "ed2fbd81-8b45-451e-80f1-621c48c9611f", "value": "T1BBC3AEABFB4B0551C86206F417CF4FED7E1321C15E2B89EB6D2A257A6D750CB4902F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848722, "uuid": "6dd66d0a-dec4-43ea-8174-c4a2f727f517", "value": "1536:rb2+EPUyTU+VQVccxbWgl8y8jQm4kuC7CyvFPrFqlQggh/LWo:PXEPxA82WLUXVC7tFPrFqlQgghq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848722, "uuid": "3fc0e509-6ab7-43af-9d07-2a8105a816b4", "value": 124184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848722, "uuid": "6228d875-f9e0-4578-be56-484da818aabf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848722, "uuid": "9846ffbf-f2fa-47c5-9369-455496b50fcf", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db7b1c7-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879570, "uuid": "d201f441-c84a-4e41-b40c-e6c0140d3f1a", "comment": "Malware payload (LummaStealer)", "value": "8573e80453a60e13e102005e6e71e063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879570, "uuid": "fa8fd945-d3a8-4f44-9172-fdb5bee1b849", "comment": "Malware payload (LummaStealer)", "value": "8e2216e6b642943545237a0225fc99fd65688d362ca5ef4c9dff6a5750d17be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879570, "uuid": "af2442d0-d9b5-45fc-a8b1-97a29b280c19", "comment": "Malware payload (LummaStealer)", "value": "3a3d02c1cd3d1811bc6f8e16f133f626e7640d9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879570, "uuid": "04c3a1ac-da4b-4124-8f09-b3eb489a6c1b", "comment": "Malware payload (LummaStealer)", "value": "1793edfb1bd2a9ab8227970e2ed5a65f49aaca98b8d9485d0b1dd9d914ca85bf2c2a23ff041e337c095fb928bf53df30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879570, "uuid": "8decf223-f934-4899-b0c4-efcf6b4f84df", "value": "T1BBA523813ED2455DE2ABC6FDB938928B02AF5D3DC3BC99FE1A756401A2D735248C0F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879570, "uuid": "e4bae890-df98-45bc-a12c-af0d53e7dbef", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879570, "uuid": "68f69930-e450-489e-b60f-3f71713efc29", "value": "49152:A5YIBFLdh3kaz0C097zexCnFJ+WBL+9z5ygy24NqLaW:ZkFoCsGC9VxNo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879570, "uuid": "d7cfde97-cf1e-431c-8869-2c04cc608c6e", "value": 2144256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879570, "uuid": "8fd29316-15bd-4e71-bf25-4032981fa948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879570, "uuid": "b7b5f9e6-1ae1-4d26-a8fc-64921db25f18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6cace2-0001-11f0-ad17-42010a9c0004", "comment": "Malware payload (GuLoader)", "timestamp": 1741866657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866657, "uuid": "89dc2a0f-5a7a-4059-9954-259b35057bf0", "comment": "Malware payload (GuLoader)", "value": "cd4a7896862a853578957c4228731a2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866657, "uuid": "dcb61cbc-41b2-4055-b3ae-712910e15980", "comment": "Malware payload (GuLoader)", "value": "8ea377c526d68585928c8b8649e5e500ff1c1105cebea657fc4d23f9130f627e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866657, "uuid": "f3a5985d-e12b-494d-bfce-45ae7402857e", "comment": "Malware payload (GuLoader)", "value": "081b3cf76baa752380cd435fb5d5dda74404dbbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866657, "uuid": "e9b6d35d-e51a-46bb-934e-f72f80c37d4d", "comment": "Malware payload (GuLoader)", "value": "68d8d7ce6facfddf2c2fc106cf6de6fc73b8d9d98b627ffbc183672dcda17431d6bf55cf03fe53d409437fbd53fd2fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866657, "uuid": "f256c1f7-6c91-425e-aa94-6ed326ef902a", "value": "T143F423DC7180A055E5F21938B7B66EB4A9BD8FE16C042706B721BFED7932048CE17267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866657, "uuid": "fe3735ea-6ac4-4971-8cbf-af03bd2fd0ed", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866657, "uuid": "f436d4c9-440f-4100-bc7d-80c1068e8e50", "value": "12288:2i6rLZa+3hBpiAh4lu+XvBPLw/Qo9yWLG6UZrPn98zC/2qvhHWUnHZW9dF5:cw+3VxCs+X5LEQtWa6OTn+hWBWU5WN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741866657, "uuid": "b7aeadfd-87d0-4cf5-99cb-dfa69b2165e4", "value": 730010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741866657, "uuid": "c25604af-206d-45f6-b688-5d4cf69310df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866657, "uuid": "c4561235-3a97-4d55-979f-4eb1ae7865ca", "value": "PO-USH3gS.pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdced89e-ffee-11ef-ad17-42010a9c0004", "comment": "Malware payload (ValleyRAT)", "timestamp": 1741858632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858632, "uuid": "6e664f3e-c9df-4264-9db4-e8301719c7ab", "comment": "Malware payload (ValleyRAT)", "value": "43cc53fa23d293cfbe704eab6eafb042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojans", "colour": "#60AB27", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858632, "uuid": "1174bacc-e7e1-4bc6-a688-897e72b861a0", "comment": "Malware payload (ValleyRAT)", "value": "8eb94aac55dcfaa3f125994a9bc6d70dfa3ef44c515525e6b7c6e4598442a4fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojans", "colour": "#60AB27", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858632, "uuid": "dcbdee72-b3da-4366-a81d-c9588ee30537", "comment": "Malware payload (ValleyRAT)", "value": "27c1ac5e0490a7e1c03677fbeecc05eded2acf4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojans", "colour": "#60AB27", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858632, "uuid": "2a328db0-d637-4a42-915e-f161f9f5b801", "comment": "Malware payload (ValleyRAT)", "value": "f3c263087f4f5516ac1895d805c3d2d4dfc282f77a4ec6d7beaf29cb89f531e596b6c0f8f981fc3ab898281768e83398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojans", "colour": "#60AB27", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858632, "uuid": "0759d76e-3f24-443c-a5fb-d88669726a24", "value": "T1ABA47C59F6248475E067A134C8E74642E3F13C9A5731978B22E62E2E3F37FA1593E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858632, "uuid": "54a586df-3c2e-4e2a-a8fa-2a8f7277f202", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858632, "uuid": "924db449-1541-4da7-8f3f-dc59cd1d1bee", "value": "6144:8+EVb6zslTwelTJ4RZOHkRl6+0E1JopxLrvGU2UmvEJ7Ia61Z4xLSSzSdzUR:FyWzswmzYJo3HvWUmvmI4kwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741858632, "uuid": "adb995ce-9100-42af-aae9-110d6d66d73e", "value": 469104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741858632, "uuid": "ba2255c0-9735-43ab-81eb-2e93fa69b3e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858632, "uuid": "2bd80b12-6b5a-4962-a8a0-bb5fcd1f704e", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7c4a49-0026-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741882410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882410, "uuid": "857ca1a9-cb91-45f2-ba4e-48facc403aa5", "comment": "Malware payload", "value": "de97dcb97605765953a3c706cc504171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882410, "uuid": "26c8d4f1-5575-4bb9-8dfe-4139136b6407", "comment": "Malware payload", "value": "8eed39069dfa0574b41e3e3f426809e29f9b108d5106670e07b2c1524085b6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882410, "uuid": "9da8a6f1-633e-4f68-8f8d-2a172abd31f2", "comment": "Malware payload", "value": "88238af01dd0d84fcb17754ac4afd12e7562eb2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882410, "uuid": "8449f5b9-4205-478c-9ea5-eef952e34791", "comment": "Malware payload", "value": "ca9f158f5350a08a0489a9ba8da51cbf00d133be04fa54a970c4acf150078f5708f61db6a3d607378191aecff0ad431c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882410, "uuid": "d07f785c-78b9-445d-8a87-a5a51506ddb1", "value": "T18EF3F703A74A45B2C2485776DCD7010057B8C643EA5BEF5F798E33A96C0BB6E9E0129F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882410, "uuid": "feffb15e-ec75-4a28-92fd-a88cf0026de8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882410, "uuid": "71c91d0d-7c95-4e66-9418-148cf53f5537", "value": "3072:5ZuHBDY6vQulZ0BAAiaRxpU0//rQ7CAJ:cpvtlZ0nXRxa0/k7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741882410, "uuid": "395f7bb5-845d-42e4-b0fa-0b70db8b857b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741882410, "uuid": "599029dc-52bf-4117-b825-aa0d3d331bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882410, "uuid": "c3804105-4cf7-470a-8713-75fd96226668", "value": "DHL-Documento de env\u00edo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c74fc2f-ffca-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741843007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843007, "uuid": "461d5339-3968-4c37-8ae9-a918ef15489f", "comment": "Malware payload (Prometei)", "value": "60d3294b2d9fdc267c91fab8ee8be05a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843007, "uuid": "1508c058-64c7-4d2b-b3e7-83f65f4debf5", "comment": "Malware payload (Prometei)", "value": "8efef6898e12944d1a075f6a76a408a91349b7e234254099e803585e4dc97395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843007, "uuid": "20b43d84-9205-41ac-8d5a-f36e0c11cc90", "comment": "Malware payload (Prometei)", "value": "619d099e8f62386f570453b9ecfe8ac9f52bba34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741843007, "uuid": "f5981489-a465-46d6-ad0d-f75f9e785373", "comment": "Malware payload (Prometei)", "value": "94c4fae53a8c552a41f10c42af425cb1f1dedb9666474fe4ce0034b4ac746fef20009a1f7d4cffbf1969eb4a49d5d47a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741843007, "uuid": "d04c23fa-991a-43eb-a130-da8dd7507ca8", "value": "T14D9423F8C83D2E3098169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741843007, "uuid": "575b4640-8b92-420f-b28d-fd11feca5679", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg/:25WOSACZSV6eKRH5EPiamb4DsDwwcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741843007, "uuid": "b485f8f2-e362-4045-8d13-7ca6d84d9bf6", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741843007, "uuid": "e55b5a56-2a77-4785-b830-4658cfdef604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741843007, "uuid": "cdc459b9-c420-4041-9f93-58c114eaaf42", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb07f09-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883197, "uuid": "be2813b2-5045-4438-8ac6-fbcd7e188195", "comment": "Malware payload", "value": "18983de56bb363009528a125b8f4145f", "object_relation": "md5", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883197, "uuid": "7efa2aeb-5347-4010-a2fc-2384f33ec7a9", "comment": "Malware payload", "value": "8f54dfa771cd17aab3b5d53c82f92e35a30190b44a64ac86b5739758a1640ee7", "object_relation": "sha256", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883197, "uuid": "3e1dbe55-6d59-4a76-9b6c-da18b90b90c5", "comment": "Malware payload", "value": "2b75d485f28365a6f669046637aedaaa47341f92", "object_relation": "sha1", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883197, "uuid": "58c98474-1e80-4902-ba6a-684a1a8c1a64", "comment": "Malware payload", "value": "b45e390c68b0493b43ee0fe559294e53f374513e0250a9f2582b96ac2357824ded3f8c61e72fbbfb33368a72523b170d", "object_relation": "sha3-384", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883197, "uuid": "5bec52fd-abc6-4ea7-b38e-bda5f35d686d", "value": "T1844124042EEA0325F3B38A7558BAAB20C53BBC46DDB19E1D008D42881377614E4B5FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883197, "uuid": "3f332ff4-3160-4945-b7a3-2ce9085e1a1f", "value": "24:8Ayj/BF//Z/U9p+/+GUWb4zraIxdd79dsHgPf+:8ZLZwRGUa8FdJ9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883197, "uuid": "14e9c552-ec4f-4adc-b3bf-57411a3351eb", "value": 2428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883197, "uuid": "1b2127f4-1ebc-4a37-a021-8df1988a6b16", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883197, "uuid": "92f84e30-54f8-4714-9daa-24f363be008f", "value": "test.lnk.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f15a28-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879614, "uuid": "723e2133-8ee4-4f31-a32c-d0117b0c1e9a", "comment": "Malware payload (LummaStealer)", "value": "cdb3cbc1da45ba7cf22a9d2a950a2e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879614, "uuid": "5661cb46-c76c-4821-8ee5-43f1e638a14d", "comment": "Malware payload (LummaStealer)", "value": "8f64ae1fd284f35875317eb3c8f7d8074111dd007014ea524e799b70ac02b9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879614, "uuid": "1d9a677a-9804-4e9d-8257-75190eba9ff0", "comment": "Malware payload (LummaStealer)", "value": "29623c955ee4eb535d4f3dab196d725a36131f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879614, "uuid": "351622d0-ffe8-42ec-9b2e-88c3b7cdc46b", "comment": "Malware payload (LummaStealer)", "value": "48c8adeac4e6f0a66174bab3f64064606d2dea2e4019fa0e6e08c3672e20ca53a541f3fd376571d3e8559c3fb6be2aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879614, "uuid": "e090e717-2549-45f9-9e39-9cec846b7edd", "value": "T141A512E30727C4B4F00F97B86D5095A7A2DDB489034DE726EC6616B3DB8BAC21904FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879614, "uuid": "86522513-f199-469e-aab6-d41455ea2d96", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879614, "uuid": "60f5f2fd-b43f-43bd-820e-345c92444b93", "value": "49152:EaeqFvHbZ7u06Rt8BHmqAUhx7QMwQwWjcpy:dv1DQ8BGTUhx/w0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879614, "uuid": "ab1fa058-205b-47a8-8afc-eeb05fc55347", "value": 2114048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879614, "uuid": "f944dc56-f298-433c-9b42-a0bdd129a9ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879614, "uuid": "f5592219-eeac-45a2-b654-b7596bead6be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fcd7b7-0004-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741867912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867912, "uuid": "1b34d928-23c8-42c4-9d36-05045b8b2278", "comment": "Malware payload", "value": "e1e4d522d768ebce443fa4f464596636", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867912, "uuid": "b0b85029-ee5f-4097-b722-19d444d54fd0", "comment": "Malware payload", "value": "8f808b955fe6cbc78d621efd63e0b30c0140c4fc5f11c8a867144d40c0f1f91f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867912, "uuid": "d0e5b03e-8efb-47a8-b09a-e9688e1c8ce4", "comment": "Malware payload", "value": "60176e726a72c5e3106484e2e7ed1ab3447b18e4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867912, "uuid": "f4c831c1-1180-45d4-b853-522cd9ef542f", "comment": "Malware payload", "value": "55e1848ad957a3d13b0133171b36fda4580a05ca4b0c0cd82b8669c860e0129ef725ead713428abfbd5cbf08428f2413", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867912, "uuid": "c469ce81-f649-4191-b465-61ffc60cfb5f", "value": "T1E0B5330B34D085A807EE98A936C86EB6415B9CB9776FDC323FC1605A87C6AE331DD425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867912, "uuid": "8768b233-b77e-4e85-bffb-4fb615a0aab7", "value": "49152:BL/C7WVArU6tLVN8TbqVBHoNQrfmqOYlwnNxidKo9OgMnlGsv:BLTVnEInqfoNQrneidKlplGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741867912, "uuid": "7bfc054b-67cf-4164-95f3-6c6bbf770153", "value": 2381403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741867912, "uuid": "56427985-7a98-4286-a235-5c00db483bf2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867912, "uuid": "63d1a0f1-c25e-4474-a518-34a0dfa563ec", "value": "capture.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c718933e-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849628, "uuid": "295394e3-f4b8-4840-81e8-abcee40d5d21", "comment": "Malware payload (Mirai)", "value": "f1c593b94cd55b58fb3254f6c593368b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849628, "uuid": "4e487922-17aa-459b-9d28-0d7a99f949f1", "comment": "Malware payload (Mirai)", "value": "8f8d2604014d5ff75691b17d4e98d14dccc1039cd874d95d166fffdf38c122d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849628, "uuid": "a842a5d6-f592-4cde-a907-f17e5b3d9fab", "comment": "Malware payload (Mirai)", "value": "8de634cc1e4f1f92f01fc745e9987b3a9a440d20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849628, "uuid": "684c33fd-94df-4f64-9c38-e74d3f0b1ddb", "comment": "Malware payload (Mirai)", "value": "f0ee706b0725b150614d844fbe463adeae462a3dddf501c814f5aeb6888b1c254112a20aac6a97ac7d9d428a5b4786a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849628, "uuid": "cfdf120d-0990-4bf0-a778-af482503992d", "value": "T18E230271880E9EB124303C76EBD5A393B5E12AB1C6773013D6190A386FB57631E4BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849628, "uuid": "e4a71176-62c8-4470-82d5-f545fd64905d", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3A79q3UELbUXfi6nVMQHI4vcGpvn:gECFd+A6YHAxvLRQZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849628, "uuid": "4b477d32-fad5-44e8-896a-cdc6684fc4e6", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849628, "uuid": "6c03671e-0f77-49c7-8497-0f89704a5208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849628, "uuid": "e427510a-cf6d-4a70-b3b1-8cbef42cfbbf", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee67c79f-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860431, "uuid": "45ebb48c-fb7f-46b7-870f-ff053ef24856", "comment": "Malware payload", "value": "1b701df9e6b5252feef3d1d8dcfe12f5", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860431, "uuid": "8d791710-dbf0-4065-848d-4256f143c8dd", "comment": "Malware payload", "value": "9039fb7b875ddbeb39cbde09a78f82102cd6d6270fa9e6a994e84005dba68b70", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860431, "uuid": "4f3fbbc2-a4cb-4fec-8772-1bbb0740ce30", "comment": "Malware payload", "value": "33e2230bc30f8da47f61ad26b2ace02d6312aadf", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860431, "uuid": "da8c502a-bcb4-4655-8279-2240ab6f3e36", "comment": "Malware payload", "value": "824056a84b35fadc8fe295860bd21b271248822977b7a575ca3946bc80511c8307cad3fb2ce58567ed548ac67e669c6a", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860431, "uuid": "696e03f8-c28b-4ac0-bd4e-966d80a0a951", "value": "T1F8518C959CB9A8748633885D9843C859F24A07170636782BB3DCD6C4AF71BA0D3E4AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860431, "uuid": "ad0b20d6-9eb1-4c81-aa1b-8c4f326bca93", "value": "48:0yA7VCZhgsswhw/LeWQ/GqFf0//Q+5+4GQ+5+J+oS40s92OKrgBlX+40:/SC8sHi/Cf/Nw/Q6uQ6KDHPsOPF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860431, "uuid": "9fe155f3-8be3-4a4c-a354-dba03fbd2a7e", "value": 2876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860431, "uuid": "8ff4dd5a-ccaf-437e-bae1-c1dee7e2a29e", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860431, "uuid": "7cf0b2be-97c3-4c90-8d42-2f438d48cf30", "value": "9039fb7b875ddbeb39cbde09a78f82102cd6d6270fa9e6a994e84005dba68b70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719fe300-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741825003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825003, "uuid": "50ce163d-fde1-42a5-bccf-ab0bd11116f5", "comment": "Malware payload", "value": "a92373a2b6fdc2f5b6ce339eb63afd9c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825003, "uuid": "2ce0e08f-3512-40bb-851f-cd6bd9931270", "comment": "Malware payload", "value": "904ffb1d59affedf40335c98ff2b96ba09afed7def944182b5a82715d943ab67", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825003, "uuid": "b87866d6-78f5-4f5c-a7b7-ce85b54c000f", "comment": "Malware payload", "value": "37923e7e581e046fafc89cfc1f2f13916ad88a2b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825003, "uuid": "f656cd81-bb51-4253-b467-e1339d732652", "comment": "Malware payload", "value": "62d518673c0871e6f00c5a1122aa813c709f466c60bcb53c98f90ca8f1439e1d51f92ecbd85392f8d6708195c0b17966", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825003, "uuid": "a6acf785-34e5-4c04-bada-a250b65f0085", "value": "T170D02B8CFC0308B7F0348CF9A6EB1484D10FA3082E0A518C4142001BE4F1C905010863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825003, "uuid": "cbd9e464-6fdb-496e-812b-cb8c33d9ac41", "value": "6:/VJswFGYj2VYtBLdY7YjAdjwIQXo3FsDKVKhOXqIKa03IKq1IEE1IKBKW:/VJH2CpY7Y8F6XjWghsONI08W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825003, "uuid": "43a16f9e-0cc3-4ac3-a95e-76b876d76f56", "value": 258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825003, "uuid": "952df1ba-4506-446e-ab08-1bf5c48f6700", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825003, "uuid": "da6384a0-a34c-4cd4-9e69-d563c9ce636e", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2ec49b-0046-11f0-ad17-42010a9c0004", "comment": "Malware payload (ValleyRAT)", "timestamp": 1741896321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896321, "uuid": "dc89c8d6-8c74-46a2-a1ca-0655e31f5f23", "comment": "Malware payload (ValleyRAT)", "value": "89ebf2795ac8923daf7d3caed0491907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896321, "uuid": "2a4dccfa-66a2-4d47-a49f-b05e5e282328", "comment": "Malware payload (ValleyRAT)", "value": "907d76317c31e9ca799beeef08144d12f5005fcb4acf17848f9f467e098648d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896321, "uuid": "f53dd5ee-832d-4b22-a003-947c5b41d2c9", "comment": "Malware payload (ValleyRAT)", "value": "bc71f292b0bfadd44bb2fcba8795117e26a76b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741896321, "uuid": "b4213256-1f0d-43af-b48b-565dbf97dad5", "comment": "Malware payload (ValleyRAT)", "value": "3d9a85086799126835450fc3cdecea5506fe3c5c5ee8dcee4aba221b0c317603173f7607bca32fed2706475cb9e3a297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896321, "uuid": "469227ef-3392-46e1-a75d-b95c0c6a80f9", "value": "T1F6C633023E11D4C2EE75B33DC888FA333755A6FBE79488DAB2417523267E44BDAB4548", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896321, "uuid": "d76607de-2623-4c27-a150-794a5b16779d", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896321, "uuid": "93cc8d1e-4916-433f-b97f-3aafdd8c633c", "value": "196608:SOGMJpADerDI67ZkknrHzqZ2R72W1GxDMbmREQykLpiSNCwchsqiDwkP21lQF3O:SbMJaerDIwfqk7TbnQy8BNCgqi3OeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741896321, "uuid": "29fe2bfe-fd5b-4f81-9c7e-debe864f084c", "value": 11562844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741896321, "uuid": "cea99906-c3c9-4d63-b0d0-698d669be3c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741896321, "uuid": "3692e214-259b-4d94-a9c2-a5041b790851", "value": "89EBF2795AC8923DAF7D3CAED0491907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819af6bd-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825030, "uuid": "f185769c-f18e-4e3f-9ab2-996db21c9e47", "comment": "Malware payload (Mirai)", "value": "fe48dad3d48b780d600db122968b4139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825030, "uuid": "103657a1-8e6a-4376-98ae-1e1c4cb72aaf", "comment": "Malware payload (Mirai)", "value": "90daeef896b379084fc12243e0cdaa2a292dcb7ceb3895327af02bc544d5f48b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825030, "uuid": "9b0a79b5-4a6b-470b-9a25-36b252625428", "comment": "Malware payload (Mirai)", "value": "7acde477e78533364e455e9b176408df29f66291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825030, "uuid": "345fc57b-7295-48a9-84d4-ddcc632ed1bd", "comment": "Malware payload (Mirai)", "value": "b87d91da0ef0f009b85996369a015aa3ef534df1c3358ad7037de741e95652c792f94060ef43b73dde819e6f23c5f9b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825030, "uuid": "4ee41890-6e60-48b6-b37e-ebdba08761ab", "value": "T19FB39D9BB74B5251C86287F40BCB4BED3E2323119F27C9E7AD1E267949381CF4A06791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825030, "uuid": "71037d01-ca24-4371-ba96-c338a9ba2e9b", "value": "1536:2AHaIPealc7XooCqPrdwxnKieTe4E6Meiadig1/LWu:28xGGcbCCuxKiGE6MeiaEg1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825030, "uuid": "a5d37ae0-e1fb-4efc-a756-177560386c20", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825030, "uuid": "ea42b17f-8a78-46b4-aa33-458ef9099893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825030, "uuid": "bf4d6e60-410e-4b27-b084-5fd2774f090d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c85736-ffe0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741852317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852317, "uuid": "c5ca8195-548d-494b-beb8-d121334af1f9", "comment": "Malware payload (Formbook)", "value": "b4390634f9e5af4a90592600febf99cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852317, "uuid": "791faf6e-e6ea-4c41-9846-ac4915e0767c", "comment": "Malware payload (Formbook)", "value": "91cf9005ba60dfbd124f9f435bcbcbff58d63f3dcf014c82d74b655520dee2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852317, "uuid": "7996ac3d-f805-4734-a160-6140d229ec06", "comment": "Malware payload (Formbook)", "value": "900a5f9e5899c603456166d7ebe704abba80d02b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852317, "uuid": "6e136de9-a172-4225-a01a-a126916268ea", "comment": "Malware payload (Formbook)", "value": "490e5d4ededcb6e985569d2942de86ead01d07460a550edbf1922147398a61b2f8fda34d131145e8a97b1284e0eb0f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852317, "uuid": "55f4153e-504c-4c00-9594-24bc3ebcd52f", "value": "T17EC4E04E2BED4664F1FE2E34A5B516900B75BD6BAC32F31E96C061EA4E323458D02773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852317, "uuid": "4674f21a-c79d-421f-a791-60569e19fc8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852317, "uuid": "0fe9cd01-c664-4c95-aabc-ae3af3bbd9d8", "value": "12288:E69OqVyDmN6gEao7MSZ+5iquHB2qCJtuA:EUOiN6gEaoblHBOJcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852317, "uuid": "ef61b68a-fe46-464f-93bd-2e270436babd", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852317, "uuid": "0578d2ea-d238-4c74-8589-55c7bdfb3953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852317, "uuid": "99061a97-ecdd-44d7-af58-98e48465bf9e", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41acd045-0020-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879898, "uuid": "4cbf647e-8b79-4cb6-8af7-741ecbde9f75", "comment": "Malware payload", "value": "76d664c0b67b7480e9520bf7cb7cba19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879898, "uuid": "5d7dcb36-0d02-402c-992f-ea1eab9a6eb0", "comment": "Malware payload", "value": "91fce53706cbc552ae2413aafd2c3581e83570d0056d5bedc3dbd3a6f2e1b514", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879898, "uuid": "08b16600-1b8a-4a4a-8e60-50af05ab805d", "comment": "Malware payload", "value": "cf00ef32f31c141ddd7a15c857b270b9c519170f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879898, "uuid": "b7d5be11-b67d-434f-a3bf-a1627d55d005", "comment": "Malware payload", "value": "48ed6b0bce2dfd3a71d1cfb5c861fed356125369be7ece8bcc781c95218653d318eb193486994c22ed6107346e46f84f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879898, "uuid": "f8d91ed6-4316-4cf3-8f78-2d70a91389a4", "value": "T13B21C20F9BC44F22CEABCD31409A23A527CC982E81A5DB0B06B555556C0AB449AE7C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879898, "uuid": "92cf7644-cc63-4241-b5e7-61fa4a7f73a3", "value": "24:E8U6EUFfin5C75CgOnSGc+UTWSlkKh6lu/e/StcW7LCLeMi/:EEEUFa5QeSGMTWSWO6ke/StcW74Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879898, "uuid": "0ef624f8-e098-465f-b5f6-9319efa0ade0", "value": 1336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879898, "uuid": "f3859ab3-f2d3-4c9c-a629-6b4c3f3013af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879898, "uuid": "9d821559-c53a-4ff6-b638-e4cb257e0cd2", "value": "91fce53706cbc552ae2413aafd2c3581e83570d0056d5bedc3dbd3a6f2e1b514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c1dfd9-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741849577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849577, "uuid": "fb2c2d15-014d-4050-9140-f1e870d4c8f1", "comment": "Malware payload (LummaStealer)", "value": "f90ba46d886c0e6f9d0bbe702ca2f535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849577, "uuid": "f829093a-e89d-4eed-a70d-26fe92659433", "comment": "Malware payload (LummaStealer)", "value": "921eefb9c8a07ecfcb836f7859efc081d55f6709dc011c1af16e0a019a029791", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849577, "uuid": "c1e40a6c-436c-4a97-8eeb-fefa449ece84", "comment": "Malware payload (LummaStealer)", "value": "e177ecba5530e2e04d255182112b63ba5d49b4a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849577, "uuid": "c835b894-1e9f-4e4b-b352-d624443b900f", "comment": "Malware payload (LummaStealer)", "value": "62255b7474328b751cd9b326f2ad0d42b245f54aa615eceabeff8d7f72f19305c10a0c24fc3f95e5cbddd9d147da56fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849577, "uuid": "76d6898f-3fda-4b01-a46f-074dae3fd5e1", "value": "T178A512EAE51D87B0DDB91F7CAE435839112813D8DCA433AAA609607CE4C1371E9A797C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849577, "uuid": "9e9f0db2-31d0-4b24-9ea5-bc8d94b49033", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849577, "uuid": "0dc25082-1e1d-4d84-a9ee-35f415d323d4", "value": "24576:VHdVc2wUEFZlrUWzCQxo12zaAK9E1kzg9gXCgmIcaaDGDVUQ3Xi5qkyGq7RSXGxW:Vf0ZlrvhO121k5SgQa6AFiYOYls9SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849577, "uuid": "f3a4c77d-f178-4bf6-9cb3-42141a612ffe", "value": 2152960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849577, "uuid": "99aad2a5-1234-4d3a-8815-94d9a28f1efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849577, "uuid": "f3fce078-3f2d-4ff9-919c-214fe6207287", "value": "f90ba46d886c0e6f9d0bbe702ca2f535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86228f02-ffea-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741856820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856820, "uuid": "d0f6ca1c-0bf3-4ae6-8348-63c5a44acc92", "comment": "Malware payload", "value": "56aee726f8052d4496ac6bb2c5e53dec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856820, "uuid": "1edbfbe3-b52b-48cb-8a1b-6ccd7948f575", "comment": "Malware payload", "value": "9293d706288e8e7546750c0af33b0a7e8582feac78fe9977a209c7fe58682fff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856820, "uuid": "df8483f7-d5b5-4ae6-aac9-81ff3ff0039c", "comment": "Malware payload", "value": "71342e16ff4f4ff704ca65dff85d665ff8c94f8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856820, "uuid": "70cc4695-2a29-4b4d-830d-016c5104d08c", "comment": "Malware payload", "value": "110c10f97c6732a46d16ac58bd7daa7c83ab7975206cf033aa8a812ef8295d251bf63244808b9f83991f65f9ec5eb215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856820, "uuid": "0a1b7f4d-87fd-460c-86b5-d6ff24bd8525", "value": "T156B15CABCFC25A27D65117B385034EA57CFFD934DE0C7581E0A27948CB66814A46F68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856820, "uuid": "88720a94-bacb-4b9c-80b7-e144cd7024ce", "value": "96:9r+CWUN22TjW1VtAS7+jnPq4whEZQtFoTOsV+Nc+FKQ7Ah2K3s00kKBTnej7:0JUo2TjiSlZwhEeoCg+8J/3s0Iref", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856820, "uuid": "f6eca442-34cb-46a5-8fb8-8196bda1860b", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856820, "uuid": "1bb6a5f9-209e-4421-b33f-03acc3be60c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856820, "uuid": "144e6e5b-091a-4244-9e52-c25f7533a356", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5f2ad9-ffab-11ef-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1741829796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829796, "uuid": "9bc839fa-d08a-4e42-8a67-0cb8e805ba2d", "comment": "Malware payload (Hajime)", "value": "d84d0bf5c470a00373fae025c70aea96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829796, "uuid": "1bc383c1-f955-48f8-91f4-db2e4be7fa7e", "comment": "Malware payload (Hajime)", "value": "92c94c3d5f7783641196d76efe7e31f1738ecc37562d688e3437479c5abdf41a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829796, "uuid": "5bdfb9ec-86de-49a9-9dab-d895df353cb4", "comment": "Malware payload (Hajime)", "value": "7b5a1ddee579b03d8b5839f819ca07e78197c47c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829796, "uuid": "7c259161-4bf2-4cba-b66c-c0a189cf3898", "comment": "Malware payload (Hajime)", "value": "3c32826f919b0286fc70cac73aed5e481c218d9caa73610de7fc9ae88433314d79524195dac9c107e9dccbed1042a5d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829796, "uuid": "bd6cfae3-019a-4645-b10e-c1fdf4eb537d", "value": "T1BD7302E017B517CC1371E8353BED205E9128223972AE35602E97528EF957703B6B2DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829796, "uuid": "3f52509d-8a1e-41fb-bdc4-9d48e49e87c2", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBhR:8D+CAXFYQChaAUk5ljnQsst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741829796, "uuid": "1aa1ebd8-beae-4f77-91f0-dbcae4f4f91d", "value": 79072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741829796, "uuid": "9d8cec17-e184-4d90-88ae-b3ff8b76c4b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829796, "uuid": "26aef8ab-b05d-4ab7-ba90-7033b141651a", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712524a0-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741825002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825002, "uuid": "aeda362c-6d8d-42af-9d04-90f8ce1c8bbb", "comment": "Malware payload", "value": "6099966c51783a53002d8c93a8caf63a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825002, "uuid": "ef79e420-b6e8-4689-b97c-91ddfb586793", "comment": "Malware payload", "value": "92d69eb8c16d911e06f843e141c175150a6fbb6bea2febc57a14e1fbcbfb238f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825002, "uuid": "d94142c8-d911-49aa-8511-b2800e02df72", "comment": "Malware payload", "value": "c89479484bb764a6a0d475146dc0c968c9900401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825002, "uuid": "f414a994-f206-43ab-b5ed-b768ad0bf9ce", "comment": "Malware payload", "value": "ecf94783bbff730c32237b1324c164aead59e7a2c9e6b5789d3cc828f60b8a5bb6d008bdc6aef418a145a8c49173a773", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825002, "uuid": "26552fd3-788c-46cc-bf7d-69541d9346d8", "value": "T10C356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825002, "uuid": "dd5fad5a-d859-4edc-bfed-f47a7f01349e", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLvE:00BnRED/TwOjX0a5xTdvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825002, "uuid": "5cb60228-e2c6-457a-822b-0a4c1fbed9ad", "value": 1110147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825002, "uuid": "6e4d0574-c017-424b-8efd-59ca87ecaef3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825002, "uuid": "ce57ae8e-5ab8-4c1a-bcf2-af7934e113d7", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fe04c7-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855587, "uuid": "768430b8-772c-418b-90da-a24dcb33db09", "comment": "Malware payload (Meterpreter)", "value": "4d4e39d6ad1053468fa7dd7063d0aad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855587, "uuid": "7f848042-41a6-491e-a3b8-e115e3298c1e", "comment": "Malware payload (Meterpreter)", "value": "9380295fdf2cdaf4fa7f4587d1b03b2ce710005a52da91ab94185693d5fc6e2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855587, "uuid": "37d45c0b-57ab-4bec-92a4-47b9067d2cd8", "comment": "Malware payload (Meterpreter)", "value": "4baadc2738327767b6102a3fbd5c7f426e56f89c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855587, "uuid": "083f44af-6b33-41f6-a856-a61b4c526006", "comment": "Malware payload (Meterpreter)", "value": "a4adc6ad1ddbe4250c17d93b42ae28323c4e7b2a79c4357ec327eb6eb72d45b71b333f295c6b2e1c7c463728f980320f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855587, "uuid": "602e795f-89b9-40f9-b055-4396f877746f", "value": "T16CE1710372A959FAC4D8027F4BEBE43B7489DB303B1783E98B14030B2CA20147475A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855587, "uuid": "b58a92f2-aea8-4c74-a0ec-a36f43b0b7a2", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855587, "uuid": "5817dd2c-5606-4ee5-9c15-8956ae0bab76", "value": "24:eFGStrJ9u0/6gWonZdkBQAVtqYKU6nwIF/dbuqiksvcSpmB:is05W8kBQe7ywA/dqqilkdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855587, "uuid": "48393169-161c-44cf-836b-6ea7efe1ae7c", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855587, "uuid": "475d54ed-ba95-4a46-9498-13d8dd0e61c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855587, "uuid": "a567e37b-abc3-4d07-bab1-ead13dd6187e", "value": "msfstaged.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9a282c-ffa1-11ef-ad17-42010a9c0004", "comment": "Malware payload (SSHdKit)", "timestamp": 1741825589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825589, "uuid": "467349ff-44fe-4ffb-8e1e-591217253ec5", "comment": "Malware payload (SSHdKit)", "value": "54922c74f8d78dacf2ee5d376d2274ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825589, "uuid": "4ebda614-c76e-41e4-a82a-66623b513d40", "comment": "Malware payload (SSHdKit)", "value": "9480e88cd5f317094e02c37c0df9676bdff0305edecba31afdd02cb27571f7a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825589, "uuid": "6cfdfe0f-a4b9-4be5-8aa0-fefd71e634bf", "comment": "Malware payload (SSHdKit)", "value": "98830add23bfb5a6de8537437596f0a7f76bf880", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825589, "uuid": "46f529d7-2ce0-490b-bea9-1ee08bc65923", "comment": "Malware payload (SSHdKit)", "value": "ec8145e7fd93ea64e682743f5de35313e42a08a43a0bf8328dca30a64d08ff9c03efcc53accd8bb62dd52a0a0407f705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825589, "uuid": "04b7d55d-24a1-4b48-acf6-707d5fa93749", "value": "T193356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825589, "uuid": "fa29561c-b2ae-4aa0-9a79-448652134c96", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLvS:00BnRED/TwOjX0a5xTdvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825589, "uuid": "a210ef20-9579-4ed1-a069-4ba57acdae6b", "value": 1110203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825589, "uuid": "e903a2d7-b4f0-47b5-9187-9739d7c77cbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825589, "uuid": "49a232ac-6a58-4818-9924-4a4885b24685", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811eea26-002f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741886447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886447, "uuid": "01a2e067-2cf2-4431-9dc2-f3ce99bbd313", "comment": "Malware payload", "value": "254d0f5a8121e648285c6187ebaeca06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886447, "uuid": "529843d6-5ca0-46a1-aa8b-3f272dbd3e96", "comment": "Malware payload", "value": "957ad373bdb893235d2d9566da227dcdafcaa984ba15b9f4e5b11e9accae0a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886447, "uuid": "50bad929-5edc-41ca-afe6-730c57d8ced9", "comment": "Malware payload", "value": "eb41ed28feb008525a3efc4191b4ba97a335b606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886447, "uuid": "29759698-3376-4579-84df-a13218273c89", "comment": "Malware payload", "value": "09b2e4ca94ad8928176e7b8823a3fa275c8f49be1661d4def1de78c26768fee46156a5804ea5e47215d98ffb1608360c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886447, "uuid": "d71b93fc-14dc-48cc-8998-fdafc8931c3e", "value": "T1BD152929F70625F4D61797B2869EEB778B187A198022EE7FFF4BDA08B4330123C46155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886447, "uuid": "095a14f0-8d35-43cc-9d84-d68216bec70c", "value": "ff61884a50c8f87e0a3ccd55f9b352a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886447, "uuid": "3a3daf48-8ef1-49eb-955d-5efe64ccf5a5", "value": "12288:UOiWcR9jb0Dy5qgM93VrHzrz1Q0rjygnjaDmcT6N6CGo:TiWcR9IfjrHbtK8al6cCGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741886447, "uuid": "d83ccdb8-8728-4434-90a6-c6a150c33a71", "value": 941582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741886447, "uuid": "47d4c3ab-a128-4fcc-acaf-ed2e75561ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886447, "uuid": "ffef2673-5d76-4e9f-8b8b-324324dde4de", "value": "Program.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23b6f27-ffdd-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741851365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851365, "uuid": "f353d83d-d483-4481-afe2-3e2f87a085b6", "comment": "Malware payload", "value": "f69fd0c51bd8ab263a9351ab883c3f2b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851365, "uuid": "75ed3539-0a47-4b25-b757-ad2f4db0b425", "comment": "Malware payload", "value": "95aa4d687b08da337b095c42b4406f0108b9fec405e1ff6adbe4dfc57088c638", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851365, "uuid": "a6919ade-a9c7-4f26-8e43-60741466963e", "comment": "Malware payload", "value": "b5a5adfef0e132132249bddc9416c305eccafcfa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851365, "uuid": "676e4736-fc95-4a6c-a4bb-4d4067b00813", "comment": "Malware payload", "value": "d1c58ff03b862307a2b75f332de929057ae68b56c016c4546c199fa127a75474ed8bfdb4e9e0574a4e5ebf91c066d94b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851365, "uuid": "12c3310d-aab3-463a-abab-6be7413d95b2", "value": "T129715C22354016A114BC40B1AFE26FA0E27AC77B8AF355F2EA1D65118CBADCF0F311D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851365, "uuid": "ce6b5611-232b-475f-9853-b8f254f12f78", "value": "48:9Ei8PzCFMIFKc4dvN3TSH0gL/2zKfytNcE/5v+DYakKRf36NLbHxdhZ3X:X8PzCFMIFi3WHUKfy9BvMYu/6VL73X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741851365, "uuid": "b7ec011f-51b8-45b6-a183-2f5cd59386d4", "value": 3520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741851365, "uuid": "0eeadebc-7ad1-4268-93e1-b508e81d0de0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851365, "uuid": "dc57884b-3ec2-47b4-8745-1e5f6a12de46", "value": "\u7535\u5b50\u53d1\u796820399201011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a2459e-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855669, "uuid": "70e8f2e6-4228-44a9-bae4-290a8afc215e", "comment": "Malware payload (Meterpreter)", "value": "e3bb99db8f920825cef70a09e3920acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855669, "uuid": "6bdf9e03-790d-4d8d-aac6-a797275aa211", "comment": "Malware payload (Meterpreter)", "value": "95b48a765a765a2bc3f2c7dc346b2d7e7e55a0d48adc78b5f3dbc6b04e8e0d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855669, "uuid": "0b4439cb-755f-423e-b4c6-8fc62d7e9edc", "comment": "Malware payload (Meterpreter)", "value": "fb2b2a6d34ed57ca7836e9d32b75cc55919b8531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855669, "uuid": "518540c9-cda5-4a73-9985-922e22a0a997", "comment": "Malware payload (Meterpreter)", "value": "119ed05863ae78eeac6e71e99653ce75152ff9d935bea7048bfd399da6324c7405885ffeed5065e648fbd6e4c9e13742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855669, "uuid": "87a481f3-7350-4c66-9941-bf1a1cf01c9f", "value": "T18312B462F65620F6ED3995BA0943AA0EB765F13463226FCBCB46004B6E12CD57C39B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855669, "uuid": "e412b46b-0cd9-41ce-a98e-b3cad71fb979", "value": "57d6e7112c8e716cfe2eb0ff9f36763c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855669, "uuid": "25d10b93-256e-4229-9a17-c2cf9b782d06", "value": "48:q0r+l6O5aXyn/hNhx4/jC/VhduCOa+ePtFaqqilkFtfb0E:dX0rd8cPtFD7kF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855669, "uuid": "f9102198-61d3-4daa-b520-8b36c50d191e", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855669, "uuid": "ec3837f6-5ce8-4cff-afc5-9366094e86cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855669, "uuid": "a6c408ea-29ac-448e-a0f3-61651e74ff53", "value": "shell.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf9e3d5-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (DBatLoader)", "timestamp": 1741849608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849608, "uuid": "c8d67de1-3e08-43c0-a622-cdffcf400dbc", "comment": "Malware payload (DBatLoader)", "value": "1a3d4243cf435ec6034f3814551150ed", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849608, "uuid": "8a11e68f-bb9d-4287-8797-ef117dee334c", "comment": "Malware payload (DBatLoader)", "value": "95d10ff038effd4a63c0cdd97b40da1877c01a21d91cf0d72917387f1771d024", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849608, "uuid": "3da78f67-8ccf-47d2-a889-d670a091283b", "comment": "Malware payload (DBatLoader)", "value": "3ee58a6e81c9b43fdceb3d8c1bf7d053f92c7073", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849608, "uuid": "a3843d5f-7344-4b3e-909d-8c71e3c22639", "comment": "Malware payload (DBatLoader)", "value": "d4f9bc93fd49486c66cdc89c4ed695c04926f20ee8138a73e283fc680467b5572a2c70a4f48de7641dc1c951f188f822", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849608, "uuid": "bb6d1316-dc2f-4765-9118-65abb296a9d1", "value": "T11095CF16E1434733C0320A7B7D639FA54C296F2EBDE8A60265D13EC89BF63806B5535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849608, "uuid": "94e6b125-a87b-470a-a52c-2c48c6ac5411", "value": "873e6a2562472b5ce067bd89299ee673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849608, "uuid": "06bc4151-aa4d-4f23-bef7-dd4181aa7de3", "value": "24576:rjA3YMV5l3T9C7XWMJUNHx/4Vmtv+8iFDECySm64Ia7G86dNEHDLGQcxLR/vPHV5:rjo5xXHBviFDEQy7l6PEORJvRWHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849608, "uuid": "c3362f4f-7851-4452-9428-e4f951f460c3", "value": 1948672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849608, "uuid": "9721bfaf-cc13-4747-b033-a277cd7d5d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849608, "uuid": "fb32d584-579f-4cbd-a401-690e6c325b42", "value": "1a3d4243cf435ec6034f3814551150ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ed54bd-ffe2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741853409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853409, "uuid": "788f758e-a1e5-4999-b5d7-9b27668b5ff6", "comment": "Malware payload", "value": "a1765503f1405b24b77a16071e6ea6f6", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853409, "uuid": "d3741ad8-5ad8-404c-b23e-819357b46916", "comment": "Malware payload", "value": "96b9f84cc7bf11bdc3ce56c81cca550753790b3021aa70ec63b38d84b0b50f89", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853409, "uuid": "ff9eaf40-a0a1-4d5d-a339-845ff96a52c1", "comment": "Malware payload", "value": "982c6db5e35382ec49e57f4b0855f820add9a213", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853409, "uuid": "97dac5a0-6961-459a-885a-c407940510cc", "comment": "Malware payload", "value": "796ab79968bf779ac4660f64ea5f475e1d102e6a0793695e6f243c972f22879ace63a7aade9722b4f86aa691652489be", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853409, "uuid": "6f919288-3295-4051-88d7-2c5f37ce43c3", "value": "T19513AED3BD82A37193F3B12D2C028C67E14D1E339DE4E5A6707F46B26FB422985E4685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853409, "uuid": "3428aaa5-10ef-4b80-a2e6-8ebf72b63c76", "value": "192:Tx/tjNHSflisjmXhMdByhbCcQvs0kg6Di6WpFMoyt1xGHfPRLf9WCAm+d9Jiibbj:kbQUnjxezZVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741853409, "uuid": "15e3e1a0-1d6c-441c-b466-b7057a9af381", "value": 43376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741853409, "uuid": "14d19dbd-89cd-48af-b8d7-95a5816d28f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853409, "uuid": "f2af3c8b-8f22-48e8-96d6-1a77b118dfde", "value": "96b9f84cc7bf11bdc3ce56c81cca550753790b3021aa70ec63b38d84b0b50f89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7080bd-fff4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860970, "uuid": "8a60e1be-b734-4db1-bb12-b5998e8fda09", "comment": "Malware payload", "value": "a4b88bf440613390cd32e045a59fd7b0", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860970, "uuid": "c28283c6-f4ac-457e-b3ef-c8f6895d9acd", "comment": "Malware payload", "value": "97193c63a3dd04816007ca71c9e29d560733453136c3ffe5764014dc9c586305", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860970, "uuid": "b88103a9-d007-4ed2-9e01-8fcdeabbb250", "comment": "Malware payload", "value": "d7e93057251e1fbf08c4e3b17841e79452b0be66", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860970, "uuid": "4daad516-06d1-4b2c-a189-c8757fcd9506", "comment": "Malware payload", "value": "3af6d126983cc241e2c9cc47c782ec20726797dbbdbe8f5abc2f678a18ec60854f60c74a28e4bf532786ffd7ddcf0081", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860970, "uuid": "06239cb8-039c-49f3-b380-9ecf101a4773", "value": "T15E5109CA2A43E05B5A4DFCC56C9937CD683C615FC4A42782F8562BCE469C61BC4E3E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860970, "uuid": "4272827b-0a53-46b1-b568-b774709d6eed", "value": "48:r3UEdskM6gsW+AJtiGI68ON0fk7aE1bN0gexrgqYgd1lK/3OJsP:rAkBAgcTaqDwvk/cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860970, "uuid": "eb02e325-ddfd-4c82-a028-e66d3d9ceb3b", "value": 2524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860970, "uuid": "ee788324-c192-4c19-b94e-56dffd7d37b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860970, "uuid": "5bc1ee28-8725-4744-9e47-073e1a16e19a", "value": "97193c63a3dd04816007ca71c9e29d560733453136c3ffe5764014dc9c586305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cbc9f5-ffeb-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741857224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857224, "uuid": "1926cdf1-b056-4044-bd50-0435f7373f56", "comment": "Malware payload", "value": "8c978ee76d617722aa91e4541333aed8", "object_relation": "md5", "Tag": [ { "name": "45-94-31-176", "colour": "#8650E8", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857224, "uuid": "8727b1de-ba42-4380-91db-e27e64976d98", "comment": "Malware payload", "value": "973a40fc27269affe13538285a98317ccdbc0846d234cc7d480621bf3944cd2e", "object_relation": "sha256", "Tag": [ { "name": "45-94-31-176", "colour": "#8650E8", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857224, "uuid": "8e0d8973-89c3-4835-8997-4f81374c9b58", "comment": "Malware payload", "value": "3f5b77c057ef8b64aa0da7e9a6af7508eb76605a", "object_relation": "sha1", "Tag": [ { "name": "45-94-31-176", "colour": "#8650E8", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857224, "uuid": "1e3e92f3-9a37-4b69-ae22-4b3309b69a60", "comment": "Malware payload", "value": "ed128a5828a5ef0e534ed7e80920680a1ee4b4f6df534115e45255b1c35243e05144d106fb30cae7c3a4ff372f9e6f70", "object_relation": "sha3-384", "Tag": [ { "name": "45-94-31-176", "colour": "#8650E8", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857224, "uuid": "6a3a6399-2ac2-4cc9-8106-732546228296", "value": "T1D256333815635FBB18ECD22AD8DF7C793B9E5E8548B16CDF42A51C0F0A8E65B391B804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857224, "uuid": "85ec4f4b-a00b-4b53-b6f1-8e25bdbb98a6", "value": "49152:zyeQsad1CzzSrPqyKyOZgkdwsQNsCp0jAXTWoIVTUKS8ccfdeDRVi1yaOKtMjY:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741857224, "uuid": "46d08f38-921d-492a-a818-fad3ccde411d", "value": 6277741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741857224, "uuid": "e05a375c-f95a-48ca-b95f-7fc092c81720", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857224, "uuid": "5af84abf-dfc7-462f-8c19-840ab421f388", "value": "uy2g7z.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e95acc4-ffa9-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741828756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828756, "uuid": "71311452-de7e-4f82-87c8-c1f48ee9efd4", "comment": "Malware payload", "value": "8360ca2f4ff3de018e56635e5dc797e1", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828756, "uuid": "dac67ae1-85ea-442d-98a5-78b3be808241", "comment": "Malware payload", "value": "97725decb44fc4b194970ce1df21e41536a37939a32226f63c052c59880c76c7", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828756, "uuid": "f83862eb-dc91-4391-a6c2-920ee2b93951", "comment": "Malware payload", "value": "1f4b99e5953ea5ac052118db69bc52231f6f9d66", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828756, "uuid": "a9136dd5-5d00-4f09-804a-9ea57ae66757", "comment": "Malware payload", "value": "8526dba6596c7f1526acc292b6ef02d2ffb835e62607f143aaa0876844b52648b739920fd9e227547e8676c86b17e884", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828756, "uuid": "0d3dbd11-41a6-4fdb-82da-1460ed84efb2", "value": "T1273448C2C14619E4FC790F7541B75C291477BEBA68B8B45CA4ADB8729F732C32026D2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828756, "uuid": "9080fdf5-9cc4-4738-84a6-5a2e6900e2cc", "value": "38b52311fa6dcaecf3485c135c5362d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828756, "uuid": "8b6303a9-c96a-4e91-970c-b11b50574027", "value": "3072:lKzI4pXZVBZtG/3dwHAMpSWRzwFrPkB7pLAOnd:SXv5G/KbRsFI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741828756, "uuid": "9f75d171-bf25-4ebc-847a-b9bcbfe7a288", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741828756, "uuid": "59c81331-6a52-4652-8628-3f5536b9523f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828756, "uuid": "41a921d3-877f-4203-bfa7-f28b2e6471c5", "value": "WinEpic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438448b8-ffdd-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741851125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851125, "uuid": "870a6e7d-4b93-4464-adba-3983d37c8f11", "comment": "Malware payload", "value": "c909f3d9c141207710cd882c67f6c6d1", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851125, "uuid": "fc1dbfc2-f757-4ed0-bb7c-121b2a5e2e97", "comment": "Malware payload", "value": "979adeba5f322b7bad2d2d9ad9ed4284a222ce6c26073c4626238ae368e8bb25", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851125, "uuid": "27701105-c2a4-4292-b1f1-6b81d68ad785", "comment": "Malware payload", "value": "4a49ecc17edddbc0ff6deb0f0afddafa18b878e5", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851125, "uuid": "764b0492-8b0d-42eb-be83-62cff8b5c7ee", "comment": "Malware payload", "value": "160b364c9ef01bf00d60c3f6fb6d9f9a575e4d8931d03bb2bfc70293bc027206dc8a3ba0e3f46d9c9e0d8e42289d6990", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851125, "uuid": "fa200425-901f-417b-b385-c0c472bfdfef", "value": "T1ACF002141A7128D18A99D4826309538C7AEF5BA762690642CB0D7FE46AAD708B41C4AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851125, "uuid": "7b2dddbd-ba12-4023-af43-b6ae0dbaf531", "value": "12:Cz23CMhg/u6JPxD6ANT8NeYfi6Er0JFt9LwuW/5CUMrvfl0KVsLC6CxwE9NNl+QG:CzaA7JPIANT8NVfZErepwc3GKVIC1xwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741851125, "uuid": "1f148760-85f0-455a-a322-046a9e75333f", "value": 596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741851125, "uuid": "1f789b5e-0cbb-4095-89c8-b333c644940a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851125, "uuid": "5af57554-1f78-400f-bdbb-615bd97ece46", "value": "443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b32b51-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849632, "uuid": "a7e0dac4-b081-469b-b5c2-04aed7d7ec8f", "comment": "Malware payload (Mirai)", "value": "51420c0eb6da85ec4a14be22613d679c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849632, "uuid": "70c6e351-7918-4fd6-af9b-92b4ffd48f5d", "comment": "Malware payload (Mirai)", "value": "986252920bf880dc0e664244ede5f3219c2ce5a2a489091c20636791f36e8b45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849632, "uuid": "58374f54-87fe-42c6-88ad-39a4534b9d36", "comment": "Malware payload (Mirai)", "value": "58361f999a5f7e53b2b1498daff88bd5988884dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849632, "uuid": "de48936e-f062-49c9-a308-a5ec076e592a", "comment": "Malware payload (Mirai)", "value": "71a476616a8a1f9292688e59e479aef51e1761e57e796d319c6847ae1e61e70b6ed1602ba8912e8cadb859650ac22e5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849632, "uuid": "e4c31f29-741d-4140-bd9d-46dc63922873", "value": "T10EA2D029D345AEF4DBEF9D9462C2C2C176E547CA2786C8E340EEAF017506042BB89D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849632, "uuid": "6fa649a8-bbce-4fb7-a9e3-49cbcc3c2741", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5q+ohM4uVcqgw05VxJ8:9RxsSVsMD6xiJJE5zRWNQpO4uVcqgw0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849632, "uuid": "341c52bb-06b0-4c2a-b832-1e6de3c0b6cb", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849632, "uuid": "da486411-26b9-4bfe-ba35-b583d4a02212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849632, "uuid": "8b9c112f-e7de-4a51-bd1b-cf68599e590d", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4914aa-0024-11f0-ad17-42010a9c0004", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1741881639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881639, "uuid": "a0d7fd6d-8a7d-45bc-aaa9-4c613a4d70a0", "comment": "Malware payload (CoinMiner.XMRig)", "value": "754b46c3208306d6f80b26fee4e68462", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881639, "uuid": "cbd2c137-8838-4669-9da8-1279ca2e100e", "comment": "Malware payload (CoinMiner.XMRig)", "value": "98a8144cc73588295f749e521d89585dfcd74d808b3a010bc7bcb9def190a370", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881639, "uuid": "226ac23d-a4e6-47b2-9715-4a78cf63f1f3", "comment": "Malware payload (CoinMiner.XMRig)", "value": "196a051d9c6c4700b4fd983bb55869c43eceb53b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881639, "uuid": "ed9bcc92-4a55-4df2-b676-22f372542cd6", "comment": "Malware payload (CoinMiner.XMRig)", "value": "a33e8e4695c67ec427aed7957a7f8401f1e5180767b49c701e6b9873d1ba22346509b76bc75892b3db79eeba1df46f90", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881639, "uuid": "916a1ae6-efe0-4aac-9ee9-d6e24b2721f7", "value": "T16D3722207A89C136E9AE0170393D9F7A953E78700B7045EB63DC9E6D5E31AC19B31B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881639, "uuid": "501b1300-bc8a-4254-b23f-42b2023366bc", "value": "393216:Cv/+03onO8cW+cVvURpecBG9KmctRTIKqLwki9Unp82V8r:Cv/+ahDWCR4cY9gRsXi96p82V8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881639, "uuid": "48fa143e-163c-4017-b672-4173eb3e8414", "value": 23959040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881639, "uuid": "96a47cfc-8365-4859-a132-bf03811585a6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881639, "uuid": "a8b342b7-fb14-45bf-883c-36aae5aff5f7", "value": "98a8144cc73588295f749e521d89585dfcd74d808b3a010bc7bcb9def190a370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c533432c-002e-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741886132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886132, "uuid": "f7a9d626-8fe9-427d-83c7-63348deb7a05", "comment": "Malware payload", "value": "cddf8a7ce505fd41ae193455b79731b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886132, "uuid": "e317dea2-dfc4-42b3-88f4-1b5cfe70aa4e", "comment": "Malware payload", "value": "98c457869d7d66a174e5862c5c3543ecfb49cc56bafae56069f8f7659384eb13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886132, "uuid": "30e4b4be-80bb-4c7f-94af-6b290461a95c", "comment": "Malware payload", "value": "99c62adffc769ce3a60ab4ac7561c954e23b331b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886132, "uuid": "466ea3eb-51a7-4bd6-b725-176eebb965f8", "comment": "Malware payload", "value": "01ef6d28989fb75640ece44853a00666a0c1d2f9c7da95a7ced95f440190f0886d6be2c52f2719d8222a993589075210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886132, "uuid": "9993853c-65b1-473f-897e-9cdc1d1bd85b", "value": "T10095C0512CFF10C97277AB350FD8F8FF4A6AE413192EB5B52141C7458B32A84D9A3AB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886132, "uuid": "59201ef9-b5ad-4670-a29f-4f84ca25304d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886132, "uuid": "220a3588-be6a-4a6d-8a38-e935445aeeca", "value": "12288:CErATT1/g/abTsWz6Srdt7DP3DTkV1ilKya0FOUuQ0gH+kmtbF6W05EJXp107sd:ykGTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741886132, "uuid": "3229857a-327b-49c5-9666-23cd3773fb37", "value": 1896960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741886132, "uuid": "748d3089-9b58-4549-a0fe-19f9afc1be6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886132, "uuid": "849b2f75-7135-484e-9c45-d295719989d0", "value": "DeadM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278ef3cc-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741872983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872983, "uuid": "7b4e8721-a0eb-475c-b675-682f08e803c4", "comment": "Malware payload", "value": "8e1e307e651976396a384550a8ea4109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872983, "uuid": "93d09fad-f179-4fcd-bec7-230f81203aeb", "comment": "Malware payload", "value": "98c69260a19b4700865b5f7ecd9396476582b7bb4ce1e32b2c83adcc5681df44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872983, "uuid": "260c4a55-be05-4bf2-8786-fb2d928f1322", "comment": "Malware payload", "value": "719156cac76675c4f02d8f5c185a66e811e08db6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872983, "uuid": "93c0fa34-20f2-4fcd-92f3-8017257b71a7", "comment": "Malware payload", "value": "ac65ce8f93369cf6479c86484a73e31afc2a27b4cd44c479e1c79ea195d16e5571b9eeb0deb0f18928bb97ca7ed8437b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872983, "uuid": "abb5cf48-42b4-49d2-924b-b9e0408c14bb", "value": "T177A5D047A3F801EDD17BD078C547A617EAB5341403308AEB27E48A642FB37E16A7E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872983, "uuid": "978e0292-30de-49ed-b292-23ff6db10f30", "value": "fee9c57197fd5a073a8543656c1a3748", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872983, "uuid": "0e31336c-7861-4201-9f0b-322fc2446748", "value": "49152:sDbpc+HoS4i1ipPT9Pb8Jne2fUTASHxkXhQur:gyn12xjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872983, "uuid": "3fa92e79-59bc-4cc7-a17b-9d876891b1e8", "value": 2076488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872983, "uuid": "92b77a50-a950-4d2f-a0dc-b104159059b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872983, "uuid": "832fa978-b863-4a26-9f01-9a18159d6840", "value": "rb.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4887b7-004b-11f0-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741898415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741898415, "uuid": "3f8c93d1-094e-4725-921a-cdb91a56c2b2", "comment": "Malware payload (DCRat)", "value": "303f23ad794865eea307bcac80ee2bc5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741898415, "uuid": "492fd277-78f8-4736-aebf-0adb7d2b90c9", "comment": "Malware payload (DCRat)", "value": "98cefe000ff7d0251c60284ab7b33aa2191bc98bb5e2440161799ba9c15562ae", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741898415, "uuid": "f541e7b3-a069-4a57-9526-66a00d2bd4da", "comment": "Malware payload (DCRat)", "value": "35ddf57b51671ee9ba0d6b2911b1a56bdb9e251d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741898415, "uuid": "910afa1e-6e3d-4de9-94e9-c47805fa6c88", "comment": "Malware payload (DCRat)", "value": "07dd199e3fbcdf11c2db5e3bc47ecee2d9bf855081655008d6a59866f082a37b7ff455b2d57a3a335ed176ebd928f368", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741898415, "uuid": "df5777f8-9285-4483-9c1c-31925c2b8564", "value": "T1AF95AF0699524E73C1657F7188D7142E52B4DF322613EF1B3E2E54E6AA86270CB227F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741898415, "uuid": "4dfa3072-78f2-4e44-a91a-605253babb83", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741898415, "uuid": "bf16118c-5fb9-4661-a059-19318aa16130", "value": "49152:IBJMCbtP7O3xgntWyTFWTpBGptq2wHSdk:yCCbtP78pwptL+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741898415, "uuid": "e4bb4eb6-1a09-4005-9925-95dc685cdf10", "value": 1973133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741898415, "uuid": "868607b8-1f11-4259-a5ec-5d5bd66552f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741898415, "uuid": "94e7baf9-fd12-4829-8e4b-1f49b0e7c540", "value": "303F23AD794865EEA307BCAC80EE2BC5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0591637b-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1741833412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833412, "uuid": "a980808e-2480-4903-9eb6-90e262c81e02", "comment": "Malware payload (Hajime)", "value": "b8dd2dd312c1e8be63d9e50129c0c71c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833412, "uuid": "40a42960-ad72-4943-9b6f-4e8294105ebf", "comment": "Malware payload (Hajime)", "value": "99854b860677f2074cc80897edd0b41b1c3b098a051e530e82279cee4a7299c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833412, "uuid": "4a77d379-dba2-4895-9ec1-b335baffe8c4", "comment": "Malware payload (Hajime)", "value": "179618f02ff646471ddb9aabf276630c15f634aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833412, "uuid": "6d52fab3-e790-4e51-9ab9-f87845f91f1d", "comment": "Malware payload (Hajime)", "value": "3c8839e6850ccc31da37eb09250683c4b3bcbdd27d5ffe952c9afe99da956ee02276c8117f29d3964c5f323ee4dcc988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833412, "uuid": "8ca42e12-2a08-4f9f-ae3c-3c6b286bd61f", "value": "T1C213028236A53F72D52188F4D7BCEFCA614A7D94EFE9181BBC113698B47135C28C981A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833412, "uuid": "bc673740-1c2d-4275-a16c-5f6b0e9f37a2", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEsDm1P:yYI0ARqw1qAEW67UIWi7M8gmfml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833412, "uuid": "679645a2-1641-4efd-b979-93afbda47e38", "value": 45184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833412, "uuid": "5c1b9ad0-2432-41cf-abd7-fad395ef7cec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833412, "uuid": "8fc849f0-65f3-444f-b268-da0ad6100a2c", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b9f71f-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830404, "uuid": "b4a69bd0-d868-48b8-b7d5-ccf595ff9423", "comment": "Malware payload (Mirai)", "value": "48fd6e2b9e4214b63e09868df69dd9f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830404, "uuid": "7a7af344-df57-4fe0-a1dd-8f5601fadf78", "comment": "Malware payload (Mirai)", "value": "9b51f445a046d8eff25b1a1066e63f4f195ca15d20743fc5c3f785ed46fbb2a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830404, "uuid": "c941b4a8-47d0-468e-93ac-dea5b089287d", "comment": "Malware payload (Mirai)", "value": "75b5a46475ab98c033527aabd7f59a787629636e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830404, "uuid": "d5b2dc60-681a-4893-a97f-c44ed778ac03", "comment": "Malware payload (Mirai)", "value": "964a50e7e70962d52647a4454f7e2ce4d4b0bfbc791bbc2a2c523808b276d80c8833502b5fe6b6d08cd07f853f75c8e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830404, "uuid": "958d83d8-a233-40a6-8ed1-060d5b4a42b2", "value": "T19541BFF20AA129B397F2A507B297860F1232EA5E5ACF5F88BCF87075B45D6547303D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830404, "uuid": "992be694-da0f-4d5c-bf1a-94076c358551", "value": "48:7DJNNDLrPDNJLDSYtDW2WETDP8P22ijjNDIKdPhD3PhDDBF9DDxVh:7LNLPLLftvTZbJdPhTJTNLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830404, "uuid": "30df12e9-1972-461e-89d1-cc8c1473ee2e", "value": 2103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830404, "uuid": "ab0a85ef-bb40-47b4-8ed1-9f994eb443a0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830404, "uuid": "41620634-8f5d-4d38-9280-43263d0a0cd5", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d862e29-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (CoinMiner)", "timestamp": 1741869100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869100, "uuid": "875184fb-940e-4fcb-83e0-41025700a116", "comment": "Malware payload (CoinMiner)", "value": "15c4b0373ccf36b67c7aebfe2e2ace0f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869100, "uuid": "9d32f381-f406-40dc-a52a-7356f9124eb3", "comment": "Malware payload (CoinMiner)", "value": "9b5f69edc956a4e361ffe36c0758fe43fd8b6aea18bcd46696c7c7a7064aa40d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869100, "uuid": "6f3cba5c-a23f-4b14-94d1-c82110509fdd", "comment": "Malware payload (CoinMiner)", "value": "5507fe730525d7ea2c09d4555de91ee9469147a2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869100, "uuid": "3f1f0e5a-8447-4b07-a1c3-46f65e76a7d3", "comment": "Malware payload (CoinMiner)", "value": "66805d6650adeb784ff165be00f3388d9702dd6037337dad1dc7af452f4c45318485479920ae2da9bde92ab21336c6fa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869100, "uuid": "c3272874-2762-4d9b-bd0d-c124d3692294", "value": "T19CB53373B16B5DFCE25D4B37D570A115166C6A033EFC1B6062BCBB44BA8BD2822C6712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869100, "uuid": "2428d8e0-f5a1-4486-8c36-2a805b0b79bc", "value": "959816635ce4833d5430e0757fa5d342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869100, "uuid": "bede14ed-df64-42f4-a49f-1a586d7b39d0", "value": "49152:VqGLUrKwqpsVdMNAIbr3fYKNY6qCBM4vLjZ:IGLOlsYMuOqBMM4vLjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869100, "uuid": "e7021690-9a76-441a-af20-1d8c649965b0", "value": 2426880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869100, "uuid": "1f6f4109-b7e9-41ea-999c-a7eb5c1d2bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869100, "uuid": "8db76615-322a-4ee4-b1a7-c0cf862c928a", "value": "adobe.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c9c3a3-ffdd-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741851421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851421, "uuid": "f9a0862c-fed2-44f5-bb64-86774c20509e", "comment": "Malware payload", "value": "72284f0436768e2edeca712fa51370ae", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851421, "uuid": "59599928-8e99-4ddd-8d6c-8c3d2bd0c1bd", "comment": "Malware payload", "value": "9c986358556c9b8102eb32eef094d4b113ddb42ea58f062edcec894c699dcfb7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851421, "uuid": "7dd324ff-fe45-4355-b628-54e05067ed07", "comment": "Malware payload", "value": "80314849cc22178e8cf3638e04135e2e0294e18f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851421, "uuid": "22f5d13f-39e1-4688-8c7a-703026d00ee6", "comment": "Malware payload", "value": "73d52c510276821c34d2ea25be64b31d53f06a2100dbf65d835f4d5df28a63769b57ff075d4641e03fc6535d069669c6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851421, "uuid": "1f2d064a-da97-49bb-aee7-0e19764cc4fc", "value": "T188716DA12F9C5278C6655438998B0529F4946582E96BF0DE7037C058CDF68F17BC40EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851421, "uuid": "7276ef05-8531-4072-a30d-946e7b24d4cb", "value": "96:wBBhCsOBpq6LG5AS112r2rR0TvsRiKaW+u:wBCQ7eIitu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741851421, "uuid": "381a9ca6-da21-4b7e-b7a3-65042b6789d1", "value": 3513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741851421, "uuid": "e0515468-ebd5-4bd3-bfc2-fb261a24a5a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851421, "uuid": "a0568875-7c85-4617-aaa9-a0ba57c04ab2", "value": "\u7535\u5b50\u53d1\u796820399201011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33ebd80-0055-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741902879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741902879, "uuid": "858c0dd8-39e5-4d0c-96d4-2baa1726f7d1", "comment": "Malware payload", "value": "0c8385f409c25d27afea98fa449eec71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741902879, "uuid": "96e6a97f-cdfc-4b84-8361-8a3a1769e1cd", "comment": "Malware payload", "value": "9cc6be3d02461e09150332b1b17402290c42d27b5cf95b50dfa053b3bd6a8205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741902879, "uuid": "6dbc9c9c-d310-49ad-9a88-1102618c7c72", "comment": "Malware payload", "value": "1360d165313ef12b83834ed2e1116940003165d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741902879, "uuid": "41affae8-fa3b-4303-9c16-6c80ee4654e5", "comment": "Malware payload", "value": "86b6ba9ffdc27196d95eaf865ce40500e7f2c1fe3d2af8d403bc79f4c8013a666103bd246574d38b3f7aef1e71e558a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741902879, "uuid": "d53626e2-afbb-4930-a423-920016a95716", "value": "T14D9301C40AF80032DB97D67ED6AD67404876B6B8B5077A3F258CA3479502ECACD83979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741902879, "uuid": "f417922b-0854-41ae-84fd-ee2f90c1b260", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741902879, "uuid": "945d7d00-37f0-45d8-b15d-bd8f2b1046f3", "value": "1536:2ir/NE/KOSxBmYcUQ6tOys0+AUyojaPjwiSD6UlydJ8FM3J21sgS:hVWtWnsD0ojGlE6UlsJjoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741902879, "uuid": "1294b587-f5a1-499a-b225-f45e664f6a2c", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741902879, "uuid": "bce60265-4d8e-4d39-8b2e-b0a912d20485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741902879, "uuid": "4dd83a84-ec6f-4a0c-abc8-f99a7d745b42", "value": "general2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76457091-0024-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741881705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881705, "uuid": "565032cb-dafd-45f6-9e40-e405ded8f506", "comment": "Malware payload", "value": "36de18cae7fe2577b24951b0179a069f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881705, "uuid": "acdcaa73-9ef6-44a0-a7ad-9abc3754aaa4", "comment": "Malware payload", "value": "9d0a82592e49a8b6130de00681652746ddc00c8b82e7824b71c42240fa17d4ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881705, "uuid": "c6f3d93e-7bb2-4e15-9100-e582a26b1c69", "comment": "Malware payload", "value": "0737a35a0e2a8b89c1f2161776ccf741885b5447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881705, "uuid": "fead5941-9fab-4e7a-ba02-c231988562c3", "comment": "Malware payload", "value": "d8da3c4625920014cf167328838c7029be00363d3d97f14c7bdd99d2b474acf8e0db9dbf04e0b6fc179a4c771240cb8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881705, "uuid": "64aafc53-e523-4c19-a9cc-3dd7ce5adc8d", "value": "T10E66332539D68056E7641A358772B2EF10FC7F023FE26BA736046B199CF62025DE4AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881705, "uuid": "10844627-7089-426d-abb3-56deda314142", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881705, "uuid": "ec0a493f-5295-4613-8969-11b46ae4e569", "value": "98304:vNvDmXOu/5PpnYvFccQKpf+sI4UM2k81wJ8AoROMPko8ubttGpDDxbiEDdhXp5jv:vN2OS8XQCmsBUM2xl2uJ+vDdpp5pMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881705, "uuid": "f568e7cd-0d0d-49be-b48d-22739e2ecf49", "value": 6659096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881705, "uuid": "15482a8c-cfd0-4ef9-b1ce-493a19c6f417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881705, "uuid": "f04b46f3-c662-4a0d-859a-3cf283169731", "value": "9d0a82592e49a8b6130de00681652746ddc00c8b82e7824b71c42240fa17d4ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f5062c-ffd4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741847205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741847205, "uuid": "1268ff38-a75e-4001-a5e7-647ad469e09d", "comment": "Malware payload (Prometei)", "value": "4e95549e7954caf296960fefbbe89987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741847205, "uuid": "279fc2c2-5c2a-489d-8593-7af8c6133e06", "comment": "Malware payload (Prometei)", "value": "9d0ecfb7fcd678729ff23a1cb19816fbd6acb9c235fef56957166f68341828cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741847205, "uuid": "4448dcab-4d50-4582-8ab0-50c33023c1e6", "comment": "Malware payload (Prometei)", "value": "f18bd27a926dbe63bf452cee8dcee45975b75371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741847205, "uuid": "846ccf87-5369-4bde-b510-ed144fd86565", "comment": "Malware payload (Prometei)", "value": "ac2665818c0a787cc053bfb7ad40edc9bbfc482440965e0af51ea74a82ec5fa5959f6beca530b54afcf0f494af510942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741847205, "uuid": "fbb36828-afc7-4623-b5f7-deb28bdae016", "value": "T1989423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741847205, "uuid": "49c5ef8d-434c-4f2d-98e2-aa4266ff031c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg1:25WOSACZSV6eKRH5EPiamb4DsDwwcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741847205, "uuid": "1bf56e08-b03f-4bac-a619-b728320a5096", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741847205, "uuid": "b7cb3a31-ed1a-4da9-bc45-8cbb3ef8e670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741847205, "uuid": "da426872-2f7b-4c8f-bab6-e11ea78ae2a8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc99e70-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1741855703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855703, "uuid": "1472c3e4-ccbc-4f62-b858-fff611f223c2", "comment": "Malware payload (Cobalt Strike)", "value": "a646b5420f75b00c71ded7ffba66faa1", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855703, "uuid": "bd628742-0ef1-49fa-9251-3f3995543c8c", "comment": "Malware payload (Cobalt Strike)", "value": "9d5e06da22a3c8b527516187f7753ee43a4929465d2c6ca58de0851323c44aa8", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855703, "uuid": "9695ffc9-77fe-464a-915c-7a2cbc61d72f", "comment": "Malware payload (Cobalt Strike)", "value": "4a655c04c6ab2dcca50c46341018ac7f35ace021", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855703, "uuid": "0c116569-9042-410d-b865-0c74b967a9e4", "comment": "Malware payload (Cobalt Strike)", "value": "bbc63eeb18c67415dba7d879c9ced114f3c65cb9b899f7f77ef8997673eff7fedaed7e5213d439dfa7937fe1647e2fd0", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855703, "uuid": "c58d6f20-0a40-4a37-95ce-cbc3988ff1a7", "value": "T13DC19942309BF54F00C607BA3A9863EA4476DA11DACE5404F6DCEEACB9CED537A5D2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855703, "uuid": "7c7512df-3e3e-4f23-832d-88c04fbcdedc", "value": "96:Tcr3PvWaW+s0lc0lPnaPo/fXX/mnDqsMGy0l50lO:ovWIHlrX/mnDqsrUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855703, "uuid": "b7642ef6-b09e-45bc-85bf-3fda2ef9f642", "value": 5835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855703, "uuid": "ad81ba05-2ee1-4498-b5a7-39d88bce51f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855703, "uuid": "8334c63d-01b6-4585-9161-9bfde587eb22", "value": "443_2003_reflection_x64.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088c5635-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830410, "uuid": "511a1c28-d7a8-4c27-ab85-7360f93cd206", "comment": "Malware payload (Mirai)", "value": "c2d16704adfdde938ab1f7ab4712c3d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830410, "uuid": "2750b8c2-b252-43ce-96fe-08aa971ee58c", "comment": "Malware payload (Mirai)", "value": "9dc4754676e5b8e3ae242fd7438e55b45ee2749f572e10cc139004cc879ae5a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830410, "uuid": "f471e621-957f-413b-9797-de9efa677531", "comment": "Malware payload (Mirai)", "value": "4080a8f12623fd32ab0b41fb148c104a097be2d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830410, "uuid": "01993864-69eb-424d-bb4a-df9f3506eff7", "comment": "Malware payload (Mirai)", "value": "f26204cdd49cdf4d44d8d900a6af4678ce4224bfadfb68a5224ea21bfca2667a20d7ebbb795a2b755e7a8366c6e696c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830410, "uuid": "8e93282e-beec-42be-85f0-845befb4dcb1", "value": "T1FD33FA96B8818A12C5D413BAFE2E118E33136768D3DFB2139E106F1477C696F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830410, "uuid": "71523869-94b9-4528-b58f-82dc8e57f44c", "value": "1536:AdnM5V7dJfTYOk8nY6zCRTOgLiIiih52eQW3:HJLrzk2YXd52eQW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830410, "uuid": "341cf50b-8631-44d2-8360-076600dbbb63", "value": 54400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830410, "uuid": "47394bce-c57a-46af-9a49-ab15822357be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830410, "uuid": "2d490f09-04c3-452e-ad74-8eb87aa274c4", "value": "NewAge3ATOarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6287b9a9-ffda-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741849889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849889, "uuid": "fc2fc287-377e-4f3d-ae62-e58a05c47467", "comment": "Malware payload", "value": "08fe1f292d723b1d21328e8c3a435741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849889, "uuid": "6d6340c1-eb54-4e25-895f-0b57a3af65cd", "comment": "Malware payload", "value": "9e553f2151e508a2ef0b7a8e2af669331cf0c7ce524b370d4af1eb1f51d7fe7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849889, "uuid": "e20d577b-67f0-4218-b886-f109966c6d4d", "comment": "Malware payload", "value": "1454a858d5c6e888521ac3004a0c9f593b85be0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849889, "uuid": "1fc83a6f-79d0-4f95-bd51-ec0824bc4892", "comment": "Malware payload", "value": "174c72573169658e56998076bd6ba3e80a2a1b10a53f8b8c5f3f69e047f7e7b592e5c7eae2bb7545b98836dca5950bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849889, "uuid": "f798e335-215b-4ef5-9689-4a413cf72c7a", "value": "T17C467C129CE42B30E8E79A75846F621937727E5CD705CBA3082AD2B5DDA3391FF07648", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849889, "uuid": "b2295f19-6e94-4591-ae2c-a86cff579151", "value": "33b00a09e329c24f86e0b600ae1abb97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849889, "uuid": "b0f0b66e-2e2b-41e1-9cfa-cffb442ad260", "value": "49152:6oDpm4sS5znr68z6w2jfa1yuDpoYkFAPi8oNAjQXKG2BPEWt07DCHtRNTGtNdevx:xhnx6w2u19mFAPib2hKE7egivrDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849889, "uuid": "64c35373-9238-435b-a5d7-ae94fbc60d09", "value": 5631448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849889, "uuid": "c84ce91f-ddd0-479b-8c16-c34cf0297fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849889, "uuid": "e76a71ec-6124-4382-82c7-6f6d8e1d6559", "value": "4advapi32.drv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6178f67f-004f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741900138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900138, "uuid": "da589169-5b85-483c-ad45-28f1a3a3050f", "comment": "Malware payload", "value": "96760a71cab0c762a3a67ed2d900cb32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900138, "uuid": "a8a816b2-d685-40b2-9acf-f9d352a509c8", "comment": "Malware payload", "value": "9e6ce56a793d930a05fc51628f76bdb660ee61e3a4587ce33a2c4514b6ccc13f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900138, "uuid": "65251a05-b954-4a68-9058-9bd7acb493cd", "comment": "Malware payload", "value": "b9692132238fefb211f69d0d57b7528e0e7bc1dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741900138, "uuid": "b7deb1d6-5146-43b8-8fa6-9d9c8f81e008", "comment": "Malware payload", "value": "f66b9ab31a7e3d26a29ba95cd4358d7464e36111d0f74b811aedbce88c1e4fd1cf90820776988f906bc7fff31ddbab15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900138, "uuid": "f5339c78-fcbe-45be-9dc5-fc421d1fffc6", "value": "T1D16670E2956FA880DAC63D3E51507EDDC535BB22078738B8510F2E29EF5125C9EE1BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900138, "uuid": "2cddeb04-b887-467b-be02-75887174b994", "value": "08eea0f8f0832c2439f0cb05ed31d0d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900138, "uuid": "10db22dd-d85a-4683-a142-71c6af81dd33", "value": "24576:TgvB4nNnGKQnzRuhz5RgrwHR+LbIuVrJwG/Z28Gvv1Bzgja7Ch6XZ76GuJBduC8p:Y4pq3MHqbtrJ3U8cN1/28CB8Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741900138, "uuid": "12e14e05-716f-4760-b6b8-dea2af2abf14", "value": 6947840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741900138, "uuid": "ce57061b-180f-468e-8cca-b73843bdb642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741900138, "uuid": "1e6c3c39-ab69-4417-9ae4-af6e7d5b7c90", "value": "Owncloud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b52b45-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883375, "uuid": "7f89d0bf-5f92-4b80-9236-c339bff039b1", "comment": "Malware payload", "value": "07ad0906529dea35b176afab2b85d15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883375, "uuid": "faa1caea-c51a-4d76-bd33-d9fdbece55ca", "comment": "Malware payload", "value": "9ed874868051ebd0151d61bfdbe81747b375784197860e3615b0a55cc422eb7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883375, "uuid": "67c2d870-f608-4e96-8c12-7b6ab0a74f3c", "comment": "Malware payload", "value": "a5047d01e92654a71319d6c0822a750ece2b7088", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883375, "uuid": "03c9341d-3091-43f0-9723-32ef650352c9", "comment": "Malware payload", "value": "6611bec14439bbffdbe85f4cbaf5d7a4338738310ce8dad156e070f21507dc9abbc3c65fc16e1f6214c32cfcd67aa6b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883375, "uuid": "35991deb-8dc4-4fff-bdb0-6a22989d1ee1", "value": "T1DEA5D023F2CBE03EE05D0B3B05B2A25494FB6A616422BD5396ECB4ACCF751601D3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883375, "uuid": "b81268ba-d54f-4944-9f66-1fd9dc0ee37d", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883375, "uuid": "0aaefe03-6aa6-48ac-b2ee-5f39b9f38198", "value": "49152:2wREDDMKtRp/wxLPREKMFJ3ftiaOXziJD+QzMm1RBoBVtYHqgZ:2wREHRpgD473FMi9+Q4m1PQKqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883375, "uuid": "b978e87c-cef2-4230-92a2-432f46a7eee4", "value": 2242240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883375, "uuid": "3f413c25-d765-4b87-8d8a-45adb5133bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883375, "uuid": "0cef7b91-f78e-48d9-a87c-3862ead6627d", "value": "cflinsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cfaaaf-ffb5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1741834000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834000, "uuid": "96387c71-0009-4ed4-838a-b9e16dad4b40", "comment": "Malware payload (Hajime)", "value": "4bc6577126ac91a1d199ffa2ee7b8bc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834000, "uuid": "18a24149-7bf0-4b32-9ec2-4319ef206efa", "comment": "Malware payload (Hajime)", "value": "a076e42329201a0caae38b743d2c5381645cff5d841cc1e7e9a8c9aebca51256", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834000, "uuid": "1e0b0aad-ecb1-4127-8d17-99d79f7e9771", "comment": "Malware payload (Hajime)", "value": "ffde23d67ef7bc83672b45ae6625b8839570ba63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834000, "uuid": "2180a586-117f-437c-8c3d-cda232deb353", "comment": "Malware payload (Hajime)", "value": "c98bef546e76dd3fb176f4843fd185d7cf2202d8cddadd345a8ab971b5cc2fbd101ffe296c975019d9bd7003d3a33ca3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834000, "uuid": "f777393f-25ec-4b91-9a91-d76342990ab5", "value": "T15753021223AA29B586714AF1E7FDBB8CEA493D588FF26C256C113D6CF97235D1CC4908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834000, "uuid": "cb617acc-5237-459b-a50d-42ae048e97eb", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxY:yYI0ARqw1qAEv7UIFM8oJorFquyj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741834000, "uuid": "78eeb9fa-e34b-4f25-a99a-d5551313df57", "value": 64952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741834000, "uuid": "5f31386f-3267-40a6-b75d-9699aacfb783", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834000, "uuid": "147fcac8-0eee-42b5-a37b-8213d1344b37", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2041dd5b-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869105, "uuid": "9f820e15-274b-4a12-8647-6533c2228631", "comment": "Malware payload (LummaStealer)", "value": "1fc9b852c715b010157bfbe0a7672a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869105, "uuid": "5577e747-e2e6-44ec-b373-7e8ebb48ce77", "comment": "Malware payload (LummaStealer)", "value": "a0b67832c1c6a802462058431fa2a67d812623637a894abc6285c45b07b37992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869105, "uuid": "78406089-4973-473d-9190-3d1c0ff8855c", "comment": "Malware payload (LummaStealer)", "value": "4b3d67cf08a25bac6a0f378ef3ff962542da403e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869105, "uuid": "5b0c26fb-8156-4b1d-b8a8-04029c078b77", "comment": "Malware payload (LummaStealer)", "value": "3d34b165de5d3858f86ba27b51a1da8810fa724f5c53e89203d9cebbe853dc079ca80c4eb468bcb7d62ea875437cebc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869105, "uuid": "72023e12-c8bf-418a-b514-c00d9b7702c4", "value": "T1DE55E17270C1D177FB45A67336A9E2B8142BF632CA2D4FC7A2B4E37491087D11B9A11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869105, "uuid": "1daeb584-54f1-4caa-9cb9-6ec0e699c208", "value": "d462aa757f68629e41b3df6e6d4c6a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869105, "uuid": "af513d53-4718-48f2-b2a9-699391af7e20", "value": "24576:8tDu8+zlhIFWnPszfYWLA/im4+l2kt2Pb5tR2A/im4+l2kt2Pb5tR:IujhIFWnPszfzLA/eq2A2PbwA/eq2A2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869105, "uuid": "4b5a2157-cb84-4750-b71f-c12a89a85c43", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869105, "uuid": "cabda182-86e5-4bb1-9c66-396bf084b833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869105, "uuid": "045f24e6-930b-440b-acc6-f168cabd44c6", "value": "Ethelium.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9b235e-ffc2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741839708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839708, "uuid": "6df5084a-689f-4d1f-b43c-71482d3f4372", "comment": "Malware payload (Prometei)", "value": "41a8228b64ca2d4f8f10d6f9cb3a25ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839708, "uuid": "e7f6afdf-47f7-44ff-8340-41fa5913a314", "comment": "Malware payload (Prometei)", "value": "a0d6e314b98de87498d637e269b823dc114b00e8014cc2feb8461f9abf069ce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839708, "uuid": "d5bdf48e-2e7d-4aad-80b4-5f01cbb84e5b", "comment": "Malware payload (Prometei)", "value": "2d1bfff55ef103d68f6eca26ad5e21b50225eaab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839708, "uuid": "fbd19a08-84a3-4b29-948f-40f84ba30f95", "comment": "Malware payload (Prometei)", "value": "313474e84cb2c9e04563f0d4906e5435d7084009ff127fb86e303027d3f3abf6bf764abb15de77c458e6b637df8df804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839708, "uuid": "62561c88-b2f8-4908-9b7b-a2235cb70fcd", "value": "T1FB155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839708, "uuid": "89f4fa4d-f25a-4104-addc-cfc932533a73", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplS:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741839708, "uuid": "601880a1-8ee4-4c88-a6bb-953e5e87e9ff", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741839708, "uuid": "25f25606-a998-477f-883e-d5facc85a001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839708, "uuid": "00e14b35-ad33-4ae8-9933-123167189904", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0853ba-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741872992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872992, "uuid": "5136c421-d3fd-4335-b8b5-04d3594a5d2f", "comment": "Malware payload (AsyncRAT)", "value": "5d963e15d3b0a19ffc51dd8eb6560505", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872992, "uuid": "90fab1db-8064-4bff-a9e4-7cd309fed822", "comment": "Malware payload (AsyncRAT)", "value": "a0de7218ac117e5026b352ecc3f783c5786982af49625ba1b32feb08fe967c7b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872992, "uuid": "4fc45c20-4f12-4f6a-bc87-6b48235fff96", "comment": "Malware payload (AsyncRAT)", "value": "132a227fafd2d630fae7c3b5b34efb5186a50d31", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872992, "uuid": "28e85e18-040a-4eec-9c62-9107cafdbe6f", "comment": "Malware payload (AsyncRAT)", "value": "3c69a4b94d970bf755f657f508607befe3a019bffa4df8736dbb4c50674787627066778bbbf8241f88a9ccf98cf14912", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872992, "uuid": "b2926f3b-58c0-4caf-b7ef-f574c9d96d7a", "value": "T104B3B346F3C7612BE7DE6A7BD4A7F131067FAD0A1917F21E0884F6456B33E850D402AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872992, "uuid": "91071993-9639-4128-8499-1be8a73ae17e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872992, "uuid": "d15e29e2-95cb-4ada-94b5-bac0d6138ca3", "value": "1536:CUqjdGJtOt4dh89YzFh9STOCs1aS5DSyBn1Ct:p9bd6CFh9STOCzK1Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872992, "uuid": "bc4143b1-b383-4cf9-9ab1-d6e74b21056d", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872992, "uuid": "837ba000-f45e-4d3c-8923-bb8954f2fcbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872992, "uuid": "e703a5ce-ff48-47b3-af6b-3774d49324ee", "value": "XClient.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7fd6d3-ffc1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741839410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839410, "uuid": "5bd6cb40-880c-40c6-acc1-decd2d08424e", "comment": "Malware payload (Prometei)", "value": "e77848871ccc01837adacffa7bdaa24c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839410, "uuid": "c01fd0b7-f6c6-45fa-a8a2-ce084adfe254", "comment": "Malware payload (Prometei)", "value": "a14393397a5c7c742816a6d6a36587b18ac70244222ff9ad38669b171d789e24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839410, "uuid": "5aa29226-940d-43ba-818a-e596da5c5459", "comment": "Malware payload (Prometei)", "value": "9b2d28347833bb1482634fd8b7f987b0edbde5ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839410, "uuid": "68dcde11-5fac-4b55-8a9b-946f3f97a2b5", "comment": "Malware payload (Prometei)", "value": "03fcc126cbf57d58bf4a63add599e7f8d111f4b283abd130688a1a697da824195744cd44fd591e9ba368a50f8bc0b3c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839410, "uuid": "63fb323d-06aa-4f81-9e03-4a37caa9283c", "value": "T1F0155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839410, "uuid": "a168e06a-84b1-498a-8166-527e21c7cf4c", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplj:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741839410, "uuid": "e95d7236-21d2-4430-9841-96e1ce8015a3", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741839410, "uuid": "382ff24e-0e80-4473-83e4-db4496acf008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839410, "uuid": "9bc9888e-0102-41b4-82dc-e976498938dd", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad75f47-0031-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741887269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887269, "uuid": "0fcf5bd2-4547-4b92-99a9-815525a0e64d", "comment": "Malware payload", "value": "34100acebb88b526ad2b0097378208d9", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887269, "uuid": "91541ff9-6bc5-4489-b1c9-87cab480adb4", "comment": "Malware payload", "value": "a2ae33ae1d3dd3bbcbac0cb9e7ed4aba71a6ee07426c7463f7a818105090c2e8", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887269, "uuid": "56f64373-7e6f-4b7b-a4f2-d23a1104e798", "comment": "Malware payload", "value": "b775f7865efa1ac5715dc6c365c3f9f0d28779c1", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887269, "uuid": "929840e4-3c37-4da8-ad3c-e02a429db150", "comment": "Malware payload", "value": "e85f11084807a6dd8a1d303920ee82f6a5ea0bee673f335c1f0a8ade2e09015b924b7f07d713f9f6e5313c1b275508d8", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887269, "uuid": "d23afb9e-6c2a-4938-99ef-b02be5642747", "value": "T16DE38C933F40EEEFE360DC3431A2F84303AD7DB26D845C4BCAD925670A754696976B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887269, "uuid": "ce3130b4-7a6c-4822-81fd-a8a874e53adc", "value": "757658f64b456b145bba861d2d8a986f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887269, "uuid": "2b5a80eb-b2b4-4ae6-b481-1db1cea5840d", "value": "3072:ZwWdPP5IPRyjFUAOABOpTYvPCRnlF134:ZlOkjFUAt9vPCFbt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741887269, "uuid": "fd64a319-4dea-40fc-b62b-7dd32526dab1", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741887269, "uuid": "034dc7ce-3388-4870-b0e0-6edfd2ef3555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887269, "uuid": "47b5c06a-161a-42ff-adb1-e09443d8cc31", "value": "luxembourgium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982a1d75-ffb2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741832799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832799, "uuid": "d12edd8a-003f-4cc1-994d-21701d0805ef", "comment": "Malware payload (Mirai)", "value": "321120617853c2b0bff90efc0fe88f1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832799, "uuid": "fd4a6038-c92b-4f03-9291-d51e662f2a1b", "comment": "Malware payload (Mirai)", "value": "a2f2572c3a3e6455979ec3892347faaea8c2dbaa11f2681462b8e8a38b2074e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832799, "uuid": "020f4552-cfb4-4a2f-a25a-5e001fdb3974", "comment": "Malware payload (Mirai)", "value": "c19f357caec3e39abce83908f623017a90749657", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832799, "uuid": "173ca401-ae09-4bf9-8ab4-1f193a15734d", "comment": "Malware payload (Mirai)", "value": "6b674c8c3e42011b64cb15a1ec8a0a887487b902927590b2407d8cdf77c84ea2863a589a3d313b7b5628d37aa288d332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832799, "uuid": "03e1f8e8-9e72-4ce2-a271-5405ba6a9bf6", "value": "T12973A61A2E22DFADFB6C863687B78F209748339126E0C585E16DED015E7074D641FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832799, "uuid": "219400db-b6ce-4029-a4f7-f101ab3ca852", "value": "1536:974r3wfm9s/eqjGGYNsl5R5bonpRWyO7y1txzu2cSgzXbBRK:Or3j96zENg5R5bonvWy11/u2FgzXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741832799, "uuid": "00956140-b0e7-49ae-b963-461d9ff5bbb7", "value": 80216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741832799, "uuid": "db20cb23-2631-4d38-8660-9c8908d8b2d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832799, "uuid": "f3bac887-4384-45b5-87e7-52f6c7021420", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b9278d-fff4-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741861083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861083, "uuid": "7ce66b32-cab0-4899-a599-ad4fecd543b3", "comment": "Malware payload", "value": "0f1b8aa83e5f9c40ad32561a95ed2c67", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861083, "uuid": "5e758abe-dfb9-4f60-9d9a-13218363e283", "comment": "Malware payload", "value": "a30ce9c01652a044920ee121c9b56231d35594ca31d1ada10f5c65c7cd69f6d2", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861083, "uuid": "198f6c0f-f726-4efe-a982-5d927922fe68", "comment": "Malware payload", "value": "e1ebdf56163f177f861d4d4583e55ed7183ab795", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861083, "uuid": "379bb6e7-52c6-497b-ab50-f5cc02c55fdc", "comment": "Malware payload", "value": "a77fd22a6b16d4be2b812c1890ce5017707a38a544074cf988e89f98f0d4912ed41ca12779346d48b5bb75d18819d885", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861083, "uuid": "5b4c0b11-3e62-4da7-8145-b1b1cef88f20", "value": "T177417B97FDB81590D3B6D4294525D14142833A536F0B8439BEACF7842F1A170A1EAADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861083, "uuid": "83d390b4-46c4-4069-96e6-888284ea43db", "value": "48:LoZK2LGx+DMBSUp3Qqk9CSUKzFWFhchxqzj4qeDgOK2t:LUK2o+DMBhpAZ9ChKzFWTcS2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861083, "uuid": "c17d53d1-57fb-4ab1-bab9-feb34085418c", "value": 1931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861083, "uuid": "4e69a1c6-5981-4332-bfe1-aa1fd64f1cad", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861083, "uuid": "2b65dabe-f1ce-4ee7-a3d1-5dbaadd919cd", "value": "a30ce9c01652a044920ee121c9b56231d35594ca31d1ada10f5c65c7cd69f6d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c49fdc-0003-11f0-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741867499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867499, "uuid": "7c262704-532b-415f-8457-00440739ae23", "comment": "Malware payload (XWorm)", "value": "7466d252168abf99b9d2026abf0709e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867499, "uuid": "6a675add-b560-49f9-bd26-b3fc298e2b05", "comment": "Malware payload (XWorm)", "value": "a3257010e31318e3e95856446e48e23c5071168ffb36aeefbc7ea9e7c3d17853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867499, "uuid": "dfff4644-e4fc-4c40-bc56-a7fab6788cba", "comment": "Malware payload (XWorm)", "value": "c195d8a13815a67bae1880e16cf6e3aaa3d29756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867499, "uuid": "b444f6a3-7a0b-4bc1-8343-d588b8dd0a0b", "comment": "Malware payload (XWorm)", "value": "40b0a5fd8c25d1c0a60040ea2073e8c071af0ca788e1e889b09d14ddcaac9f76bb10c67ba961a13039a13d08ebe02966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867499, "uuid": "1684c544-acd9-43d1-8898-877153944f4d", "value": "T16D84D04A7BED4949F2FE2B3699701200063AF96BA935F36E57C462FD0E727814C91723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867499, "uuid": "c1fa3483-5e5a-477d-8ca9-44174b11664d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867499, "uuid": "312ab313-6df6-4cf6-8361-122713a2bdb2", "value": "6144:u+ydUgAIB6n9OqVyrRDWTNgfdLj9Qjoao7MxBHM29U+bHpuTapD/i9:u+GB69OqVyDmN6gEao7MxBs2VbJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741867499, "uuid": "2558f3e6-bf3c-43fd-ade6-d05ce5b0e702", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741867499, "uuid": "4726cfe2-9c62-4c93-bad1-c284ae4b3dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867499, "uuid": "b9b33fe9-5ceb-4712-bd1e-439ede87a2d6", "value": "confirmaci\u00f3n de pago 13032025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85896227-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825037, "uuid": "f03b8b63-c85b-4c2a-844a-061c11cda4e0", "comment": "Malware payload (Prometei)", "value": "aed647bf9f4f19b28f248b9c7c605dfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825037, "uuid": "1272594d-ba85-4908-b47e-ce034034fe5a", "comment": "Malware payload (Prometei)", "value": "a3af87aeb43ec498949609011014f19f5ec4d7f303735884597342f317f56ab8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825037, "uuid": "c5492a1e-9d04-4281-9db6-a79a0d9d4f5f", "comment": "Malware payload (Prometei)", "value": "e7eb5b7061ca1cfd7bab4183c127dfa978b227f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825037, "uuid": "ae29829b-7c73-49f0-ad9b-7cc8c296ae1a", "comment": "Malware payload (Prometei)", "value": "de95d3cf6fe7e5ff4b1fdf0090e5d5b59e15ba42eff778e3304efd03e570949f04830e00d7959e1d4a3a51229ed8747f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825037, "uuid": "36e539e2-13c8-4e52-9355-868bcc21a768", "value": "T155155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825037, "uuid": "7ca5d743-7e1d-4a3b-8e3d-8e36f9278480", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplZ:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825037, "uuid": "551a186b-0c63-4584-9488-c70714c9f12e", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825037, "uuid": "8403827f-9baf-4c54-b5e9-0b6168a1f088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825037, "uuid": "ce00db29-ea2a-48b7-9d14-e641595218f2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0757c77-0063-11f0-ad17-42010a9c0004", "comment": "Malware payload (NanoCore)", "timestamp": 1741908834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908834, "uuid": "6dcf4105-9d7d-4444-963c-50ada2b5d4b1", "comment": "Malware payload (NanoCore)", "value": "1786673c04714e60473bb159f3772426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nonocore", "colour": "#B542C5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908834, "uuid": "a0f051be-ffbe-4c88-86dc-348e7a0cdd69", "comment": "Malware payload (NanoCore)", "value": "a3f21e7d47d2f78d8487048e2b5e24f6e9a8279d18261405eba4ce33aa98bb17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nonocore", "colour": "#B542C5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908834, "uuid": "2ee2a562-f8ca-4dea-8cf7-1fd4215b157b", "comment": "Malware payload (NanoCore)", "value": "7a6013a6b177950021404e57234d2f8dd9f8b3c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nonocore", "colour": "#B542C5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741908834, "uuid": "b9a5c0d6-74d1-4d65-b45a-68000c54c81e", "comment": "Malware payload (NanoCore)", "value": "2115eb948d05a8083a20169e65b19b0f64bf4bc7fe8dd0bd9b5605b72450d606cacaccded20f9ae95392cae28aecbec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nonocore", "colour": "#B542C5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908834, "uuid": "ac9c56b5-80d3-4fb4-9e9d-c5e6df2f0ed1", "value": "T17214BF2637B88A3FE2DE8679612212169379C2E398D3F3DF28D464B74B157E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908834, "uuid": "1965a387-cbb6-4436-9ac1-21d2674ef683", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908834, "uuid": "a079c0ae-3fe9-4449-8a7d-1826264a8b90", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIyJglrR8foxt42JAym3c5A:sLV6Bta6dtJmakIM5Wr94wADr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741908834, "uuid": "7b6c96b5-48b5-4a91-a52b-8f85abc12653", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741908834, "uuid": "28844398-cd73-46ab-97fa-a5733290190d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741908834, "uuid": "4444259d-9ef2-46b8-ae75-79dfbc4ee635", "value": "bobuxgenerator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dfc5ae-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825042, "uuid": "6ef60850-dd0a-4d00-8061-88991d719ca0", "comment": "Malware payload (Prometei)", "value": "ae7800e60078c2405919b41f969940b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825042, "uuid": "ab1c396a-2b8c-46b9-a18a-3b227b98686f", "comment": "Malware payload (Prometei)", "value": "a41225241b55e9820eb468ca1af3fb95a236883dda68edb02c9fadd96e743998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825042, "uuid": "4f984f08-6686-4174-a87f-4117b07bfe46", "comment": "Malware payload (Prometei)", "value": "a8798b9022fd995b87890cb895627947416cb529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825042, "uuid": "b2b43ec0-ad81-44b5-9e59-04affdfbba15", "comment": "Malware payload (Prometei)", "value": "bb832e303e30fb71c02d8f1ca5771cb5b884a555307f344172d8c5afb2296fe459f5ae14bafe35984f6771f50b1bd31a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825042, "uuid": "32320db5-6695-4e94-ba1b-0b767dfb1772", "value": "T1D09423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825042, "uuid": "c4f13049-82c5-4ac3-99ed-dfc7b0dcf82c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgp:25WOSACZSV6eKRH5EPiamb4DsDwwcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825042, "uuid": "93da47a9-a03c-4526-9247-fcb281c01336", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825042, "uuid": "e1b5e949-1cf8-413b-a82c-8d121675b238", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825042, "uuid": "0e50585d-5069-4d1c-bd6a-7715da142c38", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c7d777-ffe2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Metasploit)", "timestamp": 1741853495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853495, "uuid": "1e303e5d-0d6c-4fee-bf5b-1c4ddd8fc1e2", "comment": "Malware payload (Metasploit)", "value": "653eef717d8a14b4617d676e8bdeb7a2", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853495, "uuid": "3c82ba3a-556c-4a2b-a285-da129fcb623d", "comment": "Malware payload (Metasploit)", "value": "a42d6de2d73716d7dca3ec901502cce8e0f6a8771a00e80bcf5d7c1e109e9544", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853495, "uuid": "dc58bb13-fc27-44da-9cc2-508a559c58d1", "comment": "Malware payload (Metasploit)", "value": "dc1b29470aad493cfc15665492bf9c1d26d6c383", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853495, "uuid": "4e1baf14-3748-4c85-bfc8-d675530fdc70", "comment": "Malware payload (Metasploit)", "value": "b6d324bf064bf3b403ca392437f65a83aeb77e6afe3f9e0f724e1a48b4236a429f143f181cba908a654373d48a3102b4", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853495, "uuid": "3f874007-ffa3-4b3d-a1f7-711634b6a311", "value": "T1DAD3F71DBF4E425407830861A9B6DCCD5A3EC0B459B98C90F56DC621FFE2398816FBE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853495, "uuid": "a9d7c3e1-7403-402e-b358-fb84c914cd5f", "value": "1536:pIQ1dvK//NAgYlL+hksPUjn9OfNwy+tDakdbsMiL/5dPXmwJijZaPPgd3bflL+hr:L1vxs+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741853495, "uuid": "a049210a-b8fe-487d-ae2c-c3974c9390b4", "value": 138863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741853495, "uuid": "7bb89e8c-3d57-489e-aef0-8957cf06a36a", "value": "text/x-c", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853495, "uuid": "5aca54e7-c265-488c-ae27-916bad3a97e8", "value": "Invoke-ReflectivePEInjection.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0504e9ca-0020-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879797, "uuid": "390db30c-a3fd-436f-8e5d-4abb136922d4", "comment": "Malware payload", "value": "715a461a9a8291f16e25f59b899f8871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879797, "uuid": "319fa735-f80b-4e5f-a8c4-85565c8e4897", "comment": "Malware payload", "value": "a53b40421425de9f24d85eb1d45213f6455c1467499a4c23cf1fcf019ceb980d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879797, "uuid": "4c87a105-ec76-440d-a529-ff578a36a886", "comment": "Malware payload", "value": "63351472056ef3ef669c34139d410e2faf9d37e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879797, "uuid": "e088e3c7-4686-423f-b915-bed7642d9d05", "comment": "Malware payload", "value": "3bdec40ad0611d3ecdce664260431da1a9f3527e2d4556ad766d4cc183db9ab9ddbd90bc2e8f2345be6900281d738220", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879797, "uuid": "a0bc1e7a-56fe-46b5-8c09-09beacf9db10", "value": "T1EC31F3472FB25FD4EAAAC03806730706739956B046D1CB0AC1DDE5001E513CE9CBD7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879797, "uuid": "bb085aaf-32ce-4a67-bc6c-23442f5bbe3c", "value": "24:3m/EXC9R8omsxz8omyDVnjmgTcBcdJassRUbMUTAfPluhVoVLsHVNJYkx8WM8UU:2/alSOARSgTIcdESIhSOiVNJJaJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879797, "uuid": "55bac4d8-7990-42db-a117-4ea906d50dd1", "value": 1503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879797, "uuid": "27044052-3437-4b71-8899-9183e15ca3ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879797, "uuid": "3570aa77-6c24-4b78-b313-a73800d4178c", "value": "a53b40421425de9f24d85eb1d45213f6455c1467499a4c23cf1fcf019ceb980d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2638cb-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848720, "uuid": "7f391620-e79f-4c38-a955-5908fdca44a0", "comment": "Malware payload (Mirai)", "value": "03b6ea0fb6fbeba3f67c5d2348a7af06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848720, "uuid": "e37cc50a-9460-417c-b6a5-f5428a1b71d9", "comment": "Malware payload (Mirai)", "value": "a5688c1364985c5f940ab2d77ceec9378e14033e33001999030e06905dc9ac0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848720, "uuid": "8b2f93f7-0775-490f-bca6-feb168239878", "comment": "Malware payload (Mirai)", "value": "1cad293b41518c39e0a3d3fba1d038ffa61c533a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848720, "uuid": "f155afc5-3297-4560-b128-6ceb93182d79", "comment": "Malware payload (Mirai)", "value": "0a39fdae633e0d8c6e8f5ed9cbbc49cb64281e59cec9360a129e0681259bf0944c1e626f0fe27acc18d5cd690541b5d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848720, "uuid": "1e620ad7-560a-4185-a923-8e8f66c456e0", "value": "T142E2E16CF624F48ED19CDCB8A0E51BA86AB2F1D831468F4D53705CC4F789993E9CD468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848720, "uuid": "820e732d-72de-44c2-9fe4-47fbab576967", "value": "768:yI8rE/hON9MkI4bOEl5AUxzcZbFRiPA7KFjDv8IVpWnu:egONKktbNl5xl4FRiPAGFjRUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848720, "uuid": "1deb6298-9093-40a6-8915-a73f4f0d64c5", "value": 33680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848720, "uuid": "9b98d414-cfa6-47c1-97bd-0db590586493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848720, "uuid": "38c76a71-f6e7-4824-9968-091d159f0420", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062f93ba-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741833413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833413, "uuid": "14191f65-2a5c-4d11-9d0a-6e03a136d68c", "comment": "Malware payload (Mirai)", "value": "ae5591dd279a68e440c77514a2d56e73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833413, "uuid": "75f264e7-9f9b-4f81-8302-a960a965a9ff", "comment": "Malware payload (Mirai)", "value": "a5795b9fab470a9ea45c4ac595ac4fa3b57d5deeb8031926b0cf9a79d2fd71ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833413, "uuid": "cf71c207-473b-478f-b739-f066f728e4e4", "comment": "Malware payload (Mirai)", "value": "9ca75e82413985cbefbd998a93c9af1c6127215e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833413, "uuid": "b3c342ae-8977-4293-8f50-eb8e8436cfec", "comment": "Malware payload (Mirai)", "value": "beb6d2537b782c82c5ecce22ae4d76150992f9447a8e060d4ae74c11507a09d625331d86637f13d862ea9305416ac26e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833413, "uuid": "47b0336e-69b3-4e24-92c9-3c08d0cbe2a0", "value": "T19CC2F2E117632649D752CEB93D79341EC42CA15732AA0D402CD1A58FEE0FB2458B6EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833413, "uuid": "946467f3-eb8d-4188-85f9-8d86714fdf61", "value": "384:yb2eX3zAKuiNPZRwwqdvrrduMXbCAk6Y5VvCYxy0kJXPav63BNjbM:/kAKuobq1rduMGAXSEYEYv6DjbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833413, "uuid": "69aad8bf-224b-4dc7-b9bf-2f316b783aa4", "value": 27840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833413, "uuid": "819b02c2-4701-4367-89d7-0ae01fd8c220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833413, "uuid": "a4f4eead-0bd2-4be7-bf08-59b74b6f5dbf", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823d7291-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825031, "uuid": "cc96eb7d-1ef6-4a8d-886e-bd4b77298540", "comment": "Malware payload (Mirai)", "value": "731a29ab826b845222b08dad2e885a1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825031, "uuid": "8e33e810-ed20-45d1-b681-15ef87febc02", "comment": "Malware payload (Mirai)", "value": "a5eee33e81171e736b7ee33b7d7fb0d00853dacb3de82baea208c3fd9974db34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825031, "uuid": "119616fd-29a6-4492-978e-31d50a813814", "comment": "Malware payload (Mirai)", "value": "5a5ea56c2c05d36c6eacb35a67af5e7de77aa767", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825031, "uuid": "8c950123-ddae-4c2f-8e80-7896098f9e23", "comment": "Malware payload (Mirai)", "value": "058b30e3c779d88fd8f4a786afc00d20d616af45669fd68fa5885ef901796ab61e138fdbb9bcb6b36712d87b59b4b713", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825031, "uuid": "44ddb3ef-bdd9-48c0-83cc-4b656348be71", "value": "T18163965D2E219FACFFAC86344BB35E20924833E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825031, "uuid": "e4fb5848-f793-4850-a3ce-284fced06546", "value": "1536:58B83DOpSxUypP+vntvnCEvnNY8GYdMW/ujrcw/j6TOJqm9:qK3DUSqkslujrcw76TOJb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825031, "uuid": "1463781d-8281-4ffd-ad77-6ae030a4af82", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825031, "uuid": "78e10616-7987-4768-8387-bd7d6b69e903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825031, "uuid": "5fe51e0f-d77b-48f5-b051-df16fef44cf5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db3d99a-001d-11f0-ad17-42010a9c0004", "comment": "Malware payload (NetSupport)", "timestamp": 1741878523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878523, "uuid": "cc637b49-a0c3-4ea2-933c-df64f56bbdcb", "comment": "Malware payload (NetSupport)", "value": "58132e49fdb2fa28c4ee6d39eac8e1d9", "object_relation": "md5", "Tag": [ { "name": "194-180-191-17", "colour": "#C1DFA3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878523, "uuid": "f4c308fc-fa0b-4ad2-8e1d-6a0bb2551317", "comment": "Malware payload (NetSupport)", "value": "a64b563c17fda41331340e7149563cc3e992301b3ed6c498f3ccb59c7214a34a", "object_relation": "sha256", "Tag": [ { "name": "194-180-191-17", "colour": "#C1DFA3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878523, "uuid": "3aa00ed0-d7e0-4054-b2b1-8072e7a30617", "comment": "Malware payload (NetSupport)", "value": "42085a5478da3477974d7416a5d2c46a9626a423", "object_relation": "sha1", "Tag": [ { "name": "194-180-191-17", "colour": "#C1DFA3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878523, "uuid": "c12cb5a3-b04b-42c6-a5a6-4071241bc9dd", "comment": "Malware payload (NetSupport)", "value": "22f23325948aacc5eb7301350cef41d1c001a0bd5d53437e04cf07197bae11de1a6e50ab3fd1fb55603e1d67921e4a7c", "object_relation": "sha3-384", "Tag": [ { "name": "194-180-191-17", "colour": "#C1DFA3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878523, "uuid": "e69c9334-dcb1-403d-91b6-d196bee7dd91", "value": "T177163324614D5A45D12995B8D3F485A80EFADF85C0713DA1C9B921C83BEBAB08BB731F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878523, "uuid": "1cd097db-4028-4b83-8a16-24b033511893", "value": "98304:s9jtb/2Gcj/psqqUwbADel4zNhhNaVYooc0+1xhnqe0/VG:M/TI/KfU6ADeezLhN+YJ5+xhnqev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741878523, "uuid": "02ae208a-4f49-4406-8010-54e88cfb562e", "value": 4136849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741878523, "uuid": "c2425d83-9f77-464c-8214-3e8e8562ba32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878523, "uuid": "34958c0f-3fc5-4803-bfa0-20b7383fd9fd", "value": "KBDTAM99.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e97a1ca-ffa8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Xorbot)", "timestamp": 1741828300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828300, "uuid": "a6b9f4fe-62bf-4266-b844-44ec94d512c5", "comment": "Malware payload (Xorbot)", "value": "2d3354e4454c0aa1442c15ae4db570d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828300, "uuid": "c73653a7-3131-48b1-9dab-57927a5fbe6f", "comment": "Malware payload (Xorbot)", "value": "a6be12c3c8dd2355975f18dbeb450c1130df50f893548282b427c4933e1f15cf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828300, "uuid": "92665e9e-3c77-401e-a52c-13d157d994ed", "comment": "Malware payload (Xorbot)", "value": "fa41bc59a61d70fed29d83a9fadcaf5f29a0306c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828300, "uuid": "2ecfd286-1ffc-45cd-9321-f9ee962d4d80", "comment": "Malware payload (Xorbot)", "value": "0360f33dce6f4ff157a52fc64f580c84a8d5de91b825a188a92a61a7f99694664c681cbc34553ebbcdd72a95c74d3efc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828300, "uuid": "6a66af2f-aa97-4d3a-a936-ffccb1cd3adb", "value": "T1B1220DDA1D805AE05581C62E7DF7AEA82853C389ACD2EB51D4EF1CF94C8CEDCB154E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828300, "uuid": "6eb12d66-ef31-46a0-8562-3d6897fc7974", "value": "192:vT3jmvfO3m3C3x3+3e35BNkJpg35J5B5uFpYb+2va224Gm6eQmp9lLWLqLzm+B+k:vT3jmvfO3m3C3x3+3e35BNkJpg3bvJb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741828300, "uuid": "344d7c30-aba4-4b93-9cc0-83a62f33bf04", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741828300, "uuid": "0872226c-87b3-4909-b948-6f885fa6e581", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828300, "uuid": "4b18665f-69ec-4892-b984-36374383dc08", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038050eb-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830402, "uuid": "285b4d7a-3441-4803-b2b7-59a267358167", "comment": "Malware payload (Mirai)", "value": "b02abc90e3b73b8783bd43bd74f3b3e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830402, "uuid": "d37257d8-dcaf-47fa-8727-27514ca62f3b", "comment": "Malware payload (Mirai)", "value": "a7ab8b4ac82cbcba0d20c5147aa5175aca4c4ce21aafd5a8bd8e8746c63160c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830402, "uuid": "55cb940c-0dc3-433e-9723-85685be9c9ee", "comment": "Malware payload (Mirai)", "value": "b0d4bf517fda797d1d9a3ed5ae1394e6122387c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830402, "uuid": "1b0b5b39-f3c0-4356-9e5d-1d4fd4cbbed5", "comment": "Malware payload (Mirai)", "value": "4b24de63140f16e3bae453c826efed557e6ce1f5b4fcd8eeed65f4c8ab5d3485cc6d930f4798e49c5bfa2669418d0248", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830402, "uuid": "ef6a9aee-0eac-499f-b5e0-35adb24f0fc3", "value": "T17F63940A3E219FBDFBAC863847B78E20965837D616F1D580D15CEE015EB038D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830402, "uuid": "5272ed9c-e19c-4c44-acb3-07e28f33a92d", "value": "1536:AlSUpwC9CbJQaJW5Tr7h//StCtjqMwsTy2F:AlSywkh79rtPtjqMFm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830402, "uuid": "d14a6e37-7077-4154-802c-eecd79f25033", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830402, "uuid": "8d7f2243-f20b-4377-a0ea-ed8b7d007a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830402, "uuid": "c8448691-4f65-4252-aa04-27821a46a68d", "value": "3atoNational.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636622d1-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824979, "uuid": "ca6e4337-5d5e-40bb-b6ec-fceaa3824900", "comment": "Malware payload (Prometei)", "value": "b7a932688a1a3b7306e9e2adf4468c72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824979, "uuid": "e4fec31e-f88a-4db8-8c82-72cc2635e9ac", "comment": "Malware payload (Prometei)", "value": "a7bf0235d1cca1dcc8b55924c3a77ae8c4e35c9737359a3ade346b2d89a47a80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824979, "uuid": "8d1f10de-6413-4df9-bc53-d2908f24681e", "comment": "Malware payload (Prometei)", "value": "0894e5f18892bb380a105d0413da577e5763cdcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824979, "uuid": "e9d39fd5-7b71-44bf-b8a7-dea9cffbc324", "comment": "Malware payload (Prometei)", "value": "688a6c83dde7be0ff5def3cc302fa127c414c7bfbf4be8d0fd6c5cae9d57a8a1d5c031695f831b3c359ad4e4512b68db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824979, "uuid": "aeeba1bb-3137-4f5b-94a9-554c5f3f9521", "value": "T12D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824979, "uuid": "67524f2c-f217-4050-8470-fceca9e2fe66", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplc:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824979, "uuid": "1f480307-1e3a-46ab-ba8c-68a04849af0f", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824979, "uuid": "78c6014a-18a5-4e2b-a972-76812a33f8a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824979, "uuid": "c540a051-4b79-4212-a06f-74da3f6f2a3d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e00d689-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825051, "uuid": "26767bb2-0b2a-461e-ada1-eee23a7102f2", "comment": "Malware payload (Prometei)", "value": "562e05ca91dd2a0cb8022f2a79809e0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825051, "uuid": "2d4f14c4-3b03-4c68-b8b3-f8a2c17f48e6", "comment": "Malware payload (Prometei)", "value": "a7dbe3b4a9496d373f639913c5220c26bd0665fe022cfdc79c3371a51dfaeabb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825051, "uuid": "6f282cdb-869e-4f21-82d4-d92093ddb912", "comment": "Malware payload (Prometei)", "value": "4698d96a0bdb15fa2f7a80053c2eeb0775b9d005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825051, "uuid": "ad67dd3c-af61-4e24-9372-ec6c57a606f6", "comment": "Malware payload (Prometei)", "value": "e05c49c684c7a2a91805409c2a45071235da0d81d5cf0026192f096e050674a2aa693e32218ac546c797dded9c3b905c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825051, "uuid": "f44b6f2b-e8c9-4f5b-aafa-c3eab8d55d90", "value": "T157155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825051, "uuid": "efee4691-3f57-48ae-92a0-1cb05549b790", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplX:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825051, "uuid": "abe32d86-ecc8-45e8-aa78-c66a194888b5", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825051, "uuid": "b00fd49e-5498-42f0-a08c-08604d865247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825051, "uuid": "b75e2070-feef-457c-bd15-1ab854bfc659", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fea6e9-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830398, "uuid": "5f9b1662-3e37-405f-9903-c7ebb5677156", "comment": "Malware payload (Mirai)", "value": "e433b93b261925a064fdf5c6175052d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830398, "uuid": "88b270d4-21f4-49bc-ab0b-601d95ad86ab", "comment": "Malware payload (Mirai)", "value": "a8832c65713faa394b9cb6153ff54ba9cfec58a09af3085a11aff332f3991da9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830398, "uuid": "18f53476-ab95-478a-9099-c42e61c3166e", "comment": "Malware payload (Mirai)", "value": "b71166abb9c448101b8ab0eda85911c2a984b9ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830398, "uuid": "13d695da-4c69-4a41-9f1d-e0fef4e071cd", "comment": "Malware payload (Mirai)", "value": "b62da7e83c4fcc67554c26977c2cbb926e577e9021f07a833ffbc64ef9036c889156dfb9dca43669459b99586e36e463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830398, "uuid": "4457e21a-9e64-4248-beca-471e17a6cdf9", "value": "T12B234A21B9392F17C4D4A8BA62F74768B2F5165E25B8CB4E3D320E4EFF14A8095173B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830398, "uuid": "6fc3d3d7-4464-46aa-843d-7ae700066d9a", "value": "768:yzomnlRq91dCPgsYrU6Tabz2rlhGqfrnxoO+6E0RM:yzVnlRS1dCPgsMU6azw3nxib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830398, "uuid": "f527cb0b-da6a-4d39-88d0-ef3914f2a386", "value": 46820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830398, "uuid": "195a7229-7141-4555-b252-18ca4ad3f140", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830398, "uuid": "59de6435-ffb6-4891-b79a-ce5fdadbcc08", "value": "NewAge3ATOspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac277435-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741873205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873205, "uuid": "13f278f5-e2bd-4907-9f45-7d3cc06fc5dd", "comment": "Malware payload (LummaStealer)", "value": "0baef79b1d953aeb7f7d1057f7f67478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873205, "uuid": "b5aa9a1b-4a31-4b34-b53c-4dd5db4e4381", "comment": "Malware payload (LummaStealer)", "value": "a921e16cb0d410bf38d46fd36bcd80875bfa805a1165172f843c61d3754b9cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873205, "uuid": "c269d822-1a55-4fb0-ab96-22bf7fc9ce48", "comment": "Malware payload (LummaStealer)", "value": "5446c1a180dc4abca7eaf3b8e64bede15c8f89f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873205, "uuid": "22bb8626-31ac-4085-a343-1380c6bb984e", "comment": "Malware payload (LummaStealer)", "value": "5e58c399e4548f33d72d81eb66df1e64a27c36f3851d6c5db62c57a05a08f66f89e36a02efea5255ce4e0148940aa4e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873205, "uuid": "009f2c7e-1992-44b5-a529-90335e5633b1", "value": "T121553391ACF3C14EF562D3F6D679533A5BE502E4B22083222278DC37F45FBA61A61548", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873205, "uuid": "5279679c-506b-4b33-80a9-8716d9ec29c9", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873205, "uuid": "1bf55ec9-179d-4c27-b9b6-2a30fb850954", "value": "24576:OEeyrVNSAEXRW6LQ3K9OxNWNfmfgIKJpg68yhGk0+c3ITUvwdQQPf+d:lrVNSTRzQ3WhmfXKJphQkZG5pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741873205, "uuid": "e535e80c-56b5-47f9-840c-564c0a0cf65d", "value": 1309696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741873205, "uuid": "4e1557a5-6f06-4130-988c-bb14f49a6b16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873205, "uuid": "37871950-1225-470c-9d59-1a20ab08b8c0", "value": "nbvtiopwadkkth.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8cdbd9-000a-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741870577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870577, "uuid": "e32a7643-63d2-43b5-9d41-0b26df1a5616", "comment": "Malware payload (AgentTesla)", "value": "55591f3ecbc94b72a676c291e52162d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870577, "uuid": "e23844b4-3e7b-46c1-8781-e8069ffd13ad", "comment": "Malware payload (AgentTesla)", "value": "a9ad45025dcd9e6cf6b61668033310fd7f72aed9cd5193cc9dff7dfec56ecd61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870577, "uuid": "eca89ff2-151a-495b-a0c2-36f6809e6cf1", "comment": "Malware payload (AgentTesla)", "value": "281ea790d893650b6c8d556e30b6cc95d4dfc3f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870577, "uuid": "5d8df022-35dd-4648-b856-9b35e8bc5e2b", "comment": "Malware payload (AgentTesla)", "value": "ca3a02e9a0a1c87a63d4d1c6d6c5687eff5e5ae387fa785af8d9e0e8933c9d4985ceb1531a69a8b3605fa57d4dab5bc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870577, "uuid": "86f77bd4-2fec-43d4-b964-9a1cd91e9764", "value": "T16064C4092E55A013C54BC6F5BFC2C1B0C674A843AF529FFA259AF277053E32D48D19BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870577, "uuid": "2210e244-34de-4132-9411-00f752e184c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870577, "uuid": "baa9ef85-5329-4fe3-981d-52e3645bc736", "value": "3072:UIoPRXdTO0jWZP2WBOfC2H6izzI//TjLZnzCOFsvPnnWTis2QH3G:boPRXdTOgWZP2WQKJIc/lnW8wPYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741870577, "uuid": "415a132c-c370-4ba5-bd77-a69cec1d10ef", "value": 335984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741870577, "uuid": "88a9c371-e216-421d-97c1-2e81816a2650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870577, "uuid": "b6e9a029-7466-44de-90d0-4706d5f8f6ec", "value": "purchase order T&B19-20PO128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947a89c1-ffc0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741838806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838806, "uuid": "a66f8bc7-51fe-4116-b6e5-15c78912ea7d", "comment": "Malware payload (Mirai)", "value": "c54870e21a4ce98009b22836561775bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838806, "uuid": "0aad1590-43cf-4f02-aef6-0f860afbc69b", "comment": "Malware payload (Mirai)", "value": "a9e619dd276f0eb049a277db38b284da5aef9f393cab2dacf5de46e9e677183c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838806, "uuid": "e402f9d4-3b20-45f1-b954-d1dabf8540da", "comment": "Malware payload (Mirai)", "value": "333af8c4dcfcff4310814b34e7c5500b8d924415", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838806, "uuid": "c98a2e7c-e74e-4daf-95d4-95673b3620a5", "comment": "Malware payload (Mirai)", "value": "b623f0144bb3c731522a6d70e7f7586e9de8023acb922ba30f66ef144f5dc5955763d5f3cf80084085fa6175aab1dd9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741838806, "uuid": "d718d0ff-7256-4d45-bc6a-2ecb17bc0732", "value": "T18251B28643460D312963AB13F6B6816837C1D4A21CE1EF9AEDCCBEE0235FD247561B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741838806, "uuid": "267b362e-6e71-4979-9334-ef48bdcb074f", "value": "96:vH747N7hHt6GHgVzPHdKWHDoUH7D7o7UHC3bHI9RHvcgHspVHVSOH5+CH6fTHC3W:TuJwHeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741838806, "uuid": "61192690-c795-4b47-8976-64b7beff7853", "value": 3090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741838806, "uuid": "b48dc5f1-5c6b-4302-8b83-60e4a472aac9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741838806, "uuid": "6ce67710-7e98-445d-87f3-cb75825cda75", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc76f6fa-ffea-11ef-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741856938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856938, "uuid": "b4fa5c71-983a-4e42-b660-fa2a7a6911f1", "comment": "Malware payload (AsyncRAT)", "value": "6985ab9ac1d74790610c0ae62c27a082", "object_relation": "md5", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856938, "uuid": "9d4a99a3-3c7c-4392-a319-a63227775a2a", "comment": "Malware payload (AsyncRAT)", "value": "a9ed64eb4b5d9935760b0bf7901bd3e483d21309022c01f199bad339a5f241e8", "object_relation": "sha256", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856938, "uuid": "ffbaa37d-3fc1-484c-8af9-6c5fb82f13f4", "comment": "Malware payload (AsyncRAT)", "value": "8e984362dc45681edc5e1ea52a7270033a9442bc", "object_relation": "sha1", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856938, "uuid": "5c94a758-8a14-42cd-bdfb-dbd2ddcc3f98", "comment": "Malware payload (AsyncRAT)", "value": "8b62f899bf938bddbc6439f6a5630ca5327b9e285acc12df88f697973258cca726a05196a95200eb9f0776d914d1b814", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856938, "uuid": "9cbe4858-f3ea-4921-870a-b281fa0c3f5f", "value": "T1FFE23A4877D44712DAEEAFB12DF3620612709517D913EF6E0CE485EA2B67AC087407EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856938, "uuid": "f7cae3e5-bee3-421b-9c97-07557bb7a721", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856938, "uuid": "dbe42412-d864-404d-aef8-ee0da916bd09", "value": "768:5Va+vNtg+PB93Tw4xqdVFE9jVVOjh7b+:xvNtgw93U4x8FE9j7Ojp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856938, "uuid": "cee523b1-49dc-4b01-bce2-2eef9781cd83", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856938, "uuid": "58718556-591a-4305-9589-72f9103910fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856938, "uuid": "1378aa8b-7699-413e-a791-5fc5d2859178", "value": "92.255.57.221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51f285c-fff7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741862510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862510, "uuid": "ad759edb-f750-4b84-b6e5-517f74a61f14", "comment": "Malware payload (Formbook)", "value": "e80fd97e7eccd93bd26673062dda7e40", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862510, "uuid": "bbcd3c16-f596-4bea-82ac-9b8c6cd27910", "comment": "Malware payload (Formbook)", "value": "aa349231ea23c5b67cffe342631c97dc97fe6e1e02a0661fcb8c1c1d24bbfcfe", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862510, "uuid": "52f128cf-456f-4150-898c-62bcf495ea6b", "comment": "Malware payload (Formbook)", "value": "846b7af655b21b0edb07e27810b6c527eff8b98f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862510, "uuid": "456e8e3d-e77c-49fa-a327-51afc7331549", "comment": "Malware payload (Formbook)", "value": "ed787691a79fde5b6d1a327e727b2cdec744c5c0d529fb5eb8c7c8a87da2e9acf0c99ef765c5bd0794efd9d6e4700b61", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862510, "uuid": "608ba784-a1e3-4b68-a0d3-c115d3d0ea32", "value": "T16A0523D34B5E06971B19923329D5CD3258E3210A2293EA5BBF9FB4F064ED5068FB0B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862510, "uuid": "c28f358f-6214-44bd-ab3f-c71ed0605c0e", "value": "24576:2otvwhra+1rFOrluGcKawqqW4ICnD5nZm:xtaPOrluGcmfQe5n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862510, "uuid": "3372fd37-b043-471c-91c7-380be456d421", "value": 800603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862510, "uuid": "e453f300-94f3-494f-9d3e-b611ea262cce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862510, "uuid": "6a57f933-c2d0-444e-b293-1486abe7c3b8", "value": "SWIFT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c0fc5f-0059-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904633, "uuid": "25091117-559d-458d-ae15-68f1eb20cc62", "comment": "Malware payload", "value": "9d8c8e7951f7b7fbe9f8f6858dd47a3c", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904633, "uuid": "243e0f84-0651-4c95-8888-42c7fd8ddd5e", "comment": "Malware payload", "value": "aa6d22d76c306f953dcb302925bd2b489cf3ca4b4ff6f83ec4e873cecfcbb8d3", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904633, "uuid": "7e31f417-46dd-4690-b1ef-2cb3de7d6234", "comment": "Malware payload", "value": "21fa06bf605e34ba4ed26ec1e812dc2b8aef7664", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904633, "uuid": "d0ada7ae-5d3f-4ed1-8eb3-013d3f01ec1d", "comment": "Malware payload", "value": "1d52b01d937ad175c9e96c9f215f5a8b4cc99476a8e97f6a712ff67ff2a395c0675b414e546bf9f1deb6556e0c6f2dcd", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904633, "uuid": "25e066d4-ca42-42cd-b79c-bb29eb16b47c", "value": "T141A533AB75257B06C68F4D3202C51B8F41F37B854CF6D4EE115362C7AE17B986812E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904633, "uuid": "b28c9380-29c3-410f-8bdf-498e2057f2a8", "value": "49152:oIjBPIW25yE02KKjzmMhjfrx/NalBBcQG0Et//RgLTzWDDZ3zaJX:oKBPINx0QLhfJNalBBcQGVHRXpa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904633, "uuid": "4792a5a4-597e-41f4-9d75-1e0d484daeb3", "value": 2079710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904633, "uuid": "b64b319a-a827-431b-9c33-4e35efbc58dd", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904633, "uuid": "870db4a1-f536-4c37-9613-3312ba0b3a1a", "value": "MSIC97A.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2124d1cb-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (ZLoader)", "timestamp": 1741872972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872972, "uuid": "68081867-d626-424e-97be-5ccd9ff4b60a", "comment": "Malware payload (ZLoader)", "value": "b57e40b039858fd23e0f25a03db376ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872972, "uuid": "9c10005e-b37e-4320-8343-d20db2d1da60", "comment": "Malware payload (ZLoader)", "value": "aa8fc19f16e4e185f6464d2e18ec7731c235d2b0d364f76965cf5967d5eef613", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872972, "uuid": "aedcb3d3-c469-4911-aa17-598137c75b48", "comment": "Malware payload (ZLoader)", "value": "7f3cf3274cbf83233aeda6074362216b91d34cbd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872972, "uuid": "5545f700-bc02-42dd-b5ee-47c3ba20cd4e", "comment": "Malware payload (ZLoader)", "value": "c34d85ae7fa8d820dc57754ae2b6f934b9b8b4178cdad5a4c65480cfe473511e111798ab3996a7ccfa4c822ac49227f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872972, "uuid": "8ab0bfe0-0711-4d6d-b450-4a32ec098ee2", "value": "T166B4D0D12A40B2B4E14F893D9421A07281BCBC652F14D4D1FA878BBB3A374FA9954FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872972, "uuid": "132fc0fa-cbfa-43c7-8a5a-f4abb92d001a", "value": "260441d5ca8d9f18f1b88c86dd5a5a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872972, "uuid": "38fd7c79-fe73-4ed4-9e07-70c15840730f", "value": "12288:uDKxKMk8PhMNo+e8kGOK9ab4ozUWdBENcYcj6D9r6W3FaOi:uDjMk8ZMNYnGOSSjgW41QEv1aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872972, "uuid": "4de20b1c-079e-410a-bcdb-80eb81ef764f", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872972, "uuid": "74ff6e00-4b69-431b-b8cd-a51e397eb365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872972, "uuid": "bfcb44b4-db78-42c1-af17-7ae2edc8be0d", "value": "isen.dll.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddc2fb8-fff7-11ef-ad17-42010a9c0004", "comment": "Malware payload (StrelaStealer)", "timestamp": 1741862497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862497, "uuid": "f91e2b10-5be2-4fa4-b5fc-0a325a42ac0b", "comment": "Malware payload (StrelaStealer)", "value": "fe333f01e64325365dbdd662bee69e2e", "object_relation": "md5", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862497, "uuid": "1b40d480-a437-4de7-b71b-85ff671736be", "comment": "Malware payload (StrelaStealer)", "value": "aab6a168d8cf325e145966da9b8e1e4112fae03471df81d4e0e9b0272a2a4832", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862497, "uuid": "c50f3785-10f7-44f1-aceb-7ad13a5225d2", "comment": "Malware payload (StrelaStealer)", "value": "dbfe4b27d22e57ee14770f014640d17cb9e6e37e", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862497, "uuid": "a3a38b1c-28ca-4007-843e-b310caf45c50", "comment": "Malware payload (StrelaStealer)", "value": "e6db1bbad4aac6082554caeb0af3127e8e37d4acf64fac2805a94c3616b1c4194b9dc85493427b19a1680338cb179d03", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862497, "uuid": "225a703f-5934-4b95-a4c0-6c065782cf0a", "value": "T168742301B50DE679E7F423FCB74BA7AD897B8952DD158B5E38C0126F1A9E6070FA4320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862497, "uuid": "6bebd748-f49b-4626-9acc-fc39601e6b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862497, "uuid": "5bbd89b2-bb6e-4b61-a4bd-7e95a4f41092", "value": "6144:R5NiQXdlkOjBfep9VzRVGii+GBD2XSJzEKikH18f/WUYe2a+hY6:D8QzkMmH6+CfIkV8mUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862497, "uuid": "aeb7d835-8e85-4e61-8993-97214d42ef1d", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862497, "uuid": "be08d012-9405-47eb-bb8d-5231e8d6c7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862497, "uuid": "f3bd25e5-9a1e-4701-acae-67e090d40174", "value": "nigger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8836ee68-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825041, "uuid": "ba51d62d-866c-40d1-b0ea-43f43bfe9a85", "comment": "Malware payload (Prometei)", "value": "3a1389498298a0aa892c4bf2b68d6678", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825041, "uuid": "5f5283bc-e8b9-4b67-8fac-e37dbc976220", "comment": "Malware payload (Prometei)", "value": "abea1b20e33f2762f05e1f1a8a50d625241be0a5bc13dd3f097063ab5eec3021", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825041, "uuid": "559dfdda-112c-46fd-86d7-05265e939e8e", "comment": "Malware payload (Prometei)", "value": "defdf42a823f694ec0cf9760a5aa2733a9615017", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825041, "uuid": "44d1b1b5-d7dd-417a-9d98-ddb511b3e0df", "comment": "Malware payload (Prometei)", "value": "8858c66354eb307f78255244934091f9cf76efe9f177053e13675a473a41532b64d2746fa4640f1198ff133ea065726b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825041, "uuid": "ffe2f7e6-1dd0-4c6a-9172-a7e99afc2402", "value": "T1F2155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825041, "uuid": "1b3fdd20-b04a-487b-bc24-ef1192ae8b8a", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplO:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825041, "uuid": "672771b4-8fc3-4482-b8be-e34967b77bd7", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825041, "uuid": "aa61f9d4-a2b3-4f81-9a55-2794acc21310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825041, "uuid": "2558d6fd-897f-4aa4-ba75-b4820dff7e31", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d0914a-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860340, "uuid": "cad29125-c4a4-411d-8994-0217c63c8265", "comment": "Malware payload", "value": "4f178cefbf3fc66baed13b3c4fa897d4", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860340, "uuid": "a3137e19-3c79-457e-a12a-4bdd07ffb7dc", "comment": "Malware payload", "value": "ac402ab656a315e412c6ad8bcd41de3fee5058ef08befcc4fd0bddfb2e2ba6bd", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860340, "uuid": "15567e47-6864-4303-812f-a1b12dfd5c79", "comment": "Malware payload", "value": "abdcc5e1efbacd8bfe791edde922a44e6927de78", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860340, "uuid": "6a30d8bf-1616-4d9a-ac37-687de7652382", "comment": "Malware payload", "value": "411d20d4be3def71d718638f26089e6cedbafe2765bebfa53d3fd9377dafdba56c9dc4c8740bf3d1fde97e33775351da", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860340, "uuid": "2039f88b-a5df-447d-b6a3-644b23c9bcd8", "value": "T1A62179D1FFA560D1D133485C5007E059F2A9A303572A1C9277AC9A607F355B4E1F29F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860340, "uuid": "a9d57ea6-02eb-4896-b298-f955e93bc067", "value": "24:LJSY9jA8qoYGwXCkOJVH0Zl+N+wffQ0R0uL4mK9djK1AfJ4ilH60b9aQ:NLVnY4jJFQ4fo0R0ukmOdjK16JjlH6FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860340, "uuid": "e2eb7a40-0c66-441e-86e5-f263ca35db8e", "value": 1393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860340, "uuid": "90e35884-193f-4ec6-9d62-e8978893b1bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860340, "uuid": "442c65ee-1ea0-45b8-a195-2654c235cb96", "value": "ac402ab656a315e412c6ad8bcd41de3fee5058ef08befcc4fd0bddfb2e2ba6bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bf14cc-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879362, "uuid": "bb8df04e-d918-45cc-8e20-327d4ececda9", "comment": "Malware payload", "value": "7ec98569bccb06d6a5a9cac7891a5228", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879362, "uuid": "520352c8-47b3-42a7-9a40-d557ba4f5f77", "comment": "Malware payload", "value": "acd44760a750afd0db17ec0b55bd092372aa0fe827b90b891b6b8c19638174f6", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879362, "uuid": "98ecfbaa-668d-4a8f-bbdf-c9ed42e678a2", "comment": "Malware payload", "value": "6bb1f243e0115b79fe3fa590373b3d5040c83d59", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879362, "uuid": "54c6df1c-9494-476c-a500-4bafca37a81a", "comment": "Malware payload", "value": "f4f95444e6587a725c1d14440ad9d7ed95388ad4db90310f0519a3626625930b842918409482e2e3063a29ab0a8f6994", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879362, "uuid": "f0485ef9-2865-46d1-92f0-cc9de0bd609b", "value": "T14192738C739076DFC85BC8B29DA91D64EB60B46B870BD307A05B51ADAE0D947CF501F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879362, "uuid": "9771e5db-e129-42fe-88eb-d12e792e65dd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879362, "uuid": "932a1433-6862-44e1-932a-4561bfc04f84", "value": "384:mfHqZjvrnhxTIAYB+G03Ef4E/vOZ6MjZAMSSVRHTo:Gqjvrn/TI3C00uIRzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879362, "uuid": "316e1bb0-4f4a-45c0-9f19-423cc41e6a66", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879362, "uuid": "6c1d1c25-0229-479d-a441-c80dd26d7b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879362, "uuid": "4852917d-03c3-4529-ab70-fb6c638e642b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0555f6c6-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830405, "uuid": "f8f63da7-3391-478c-bdd1-92bb1b722c97", "comment": "Malware payload (Mirai)", "value": "6cc084f477833494f66c0bdff32b93eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830405, "uuid": "7e9f402f-e137-4f70-b8ba-0547ead7c120", "comment": "Malware payload (Mirai)", "value": "acee550caa65938eb8ac207842bd93151d73048e2b5c137f30bc16b45f5ec02e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830405, "uuid": "41d32cf5-0faa-4f35-837d-b65d8176fad4", "comment": "Malware payload (Mirai)", "value": "3908ea9ceab58b86849d48208721aa62d28b66cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830405, "uuid": "234dd868-db81-45b6-8b19-76b68c79370d", "comment": "Malware payload (Mirai)", "value": "fc126cd158aa6986547b0f95cec4fb9d20f2a82fccece2d37089d90cd164b8e39600de15db63efd87ab245e52836d1eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830405, "uuid": "c326da2b-2bc0-4d2e-8c65-babef37b3153", "value": "T1FB43971E2E619FFCFBAD863587F39E219648339216E1C684E15CDA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830405, "uuid": "4921fcf9-3eaf-41e0-9abd-e5d0bd63b5e1", "value": "768:RaT+l5PNxAGJYmzrEIPfEImKE5jNxEjkCOFym6OCLcj34pAOreBAWslnk/zwi:Rn5FxAGJtzhkH5jNCtLcj3EzCwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830405, "uuid": "2c0ee573-93a1-4bc3-9a35-81bd4ece1e39", "value": 57108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830405, "uuid": "6853869b-c0db-4fce-bd2e-c4c7dcf85731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830405, "uuid": "c74c4a0f-4e84-4e44-9dac-7f9912d5bf6a", "value": "NewAge3ATOmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cefbf73-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1741849423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849423, "uuid": "963bbcbd-248d-4119-908a-d71fdf803648", "comment": "Malware payload (Rhadamanthys)", "value": "19d57e03e2f9d5da05a8f6edd5eb1e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849423, "uuid": "c39d9d6e-961e-45ad-a373-8c2f680d1f3f", "comment": "Malware payload (Rhadamanthys)", "value": "ad6e391c61100fb92f8ad56d95d84b4cd6f08f0a258d0ff7977ae0a73e8e1eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849423, "uuid": "e94c01fa-e9eb-41b3-a854-c784b074fd9b", "comment": "Malware payload (Rhadamanthys)", "value": "cb7a967403e4d364121ceca87e6c64f67b811f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849423, "uuid": "ce27462d-2163-4db2-9083-636b2f5d085a", "comment": "Malware payload (Rhadamanthys)", "value": "4f02d5cfe799e0fa1c234b0a274925caed2d013c8cbdb5cab88deea8512ad9316bcb9363d66211d155a51ac3183e726f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849423, "uuid": "0fb72d9c-72ee-47d6-8621-a62d51921998", "value": "T14B85383439EA502AB173EFA98BE475EADA6FB7733B03645D109103864723A81DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849423, "uuid": "06287d0e-d354-421f-8f1e-6cd89240dade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849423, "uuid": "60ce3d88-b882-48a2-b91d-33d45eea7167", "value": "24576:OqAEKzzJuGKGkpYrsPEvH1AXCL4ZS/l9y5AYQgVi:r7KJuGjJPlIuYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849423, "uuid": "0e109c6b-8244-4a8d-adc7-8598d76c6f07", "value": 1842176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849423, "uuid": "f329b736-5391-44a0-9d17-141cb0e380ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849423, "uuid": "41f1b39e-7551-4454-b491-0c4f8515972d", "value": "19d57e03e2f9d5da05a8f6edd5eb1e95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209c6375-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741879413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879413, "uuid": "4c20f4fe-a799-4013-aa02-75fc0f70d7cd", "comment": "Malware payload (MassLogger)", "value": "855bb87420f8dbe945a1ffa4abbb23f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879413, "uuid": "1f0c93b8-3693-4404-b2ed-9902dc89c29a", "comment": "Malware payload (MassLogger)", "value": "ada32ec7d1868b4e082ae007138811e58e8b44dc748a847d8e055adf4cae25a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879413, "uuid": "61b346c2-e472-42e1-9a96-3b13d07ad42f", "comment": "Malware payload (MassLogger)", "value": "8115793b368fc257780e8ae00bc3ad568adfbd60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879413, "uuid": "db4bba8c-0c06-48f9-9b89-237eac65b0e1", "comment": "Malware payload (MassLogger)", "value": "c2f4fcec32a8930ac15085596b21b1655cb3679fa69dd4bbcdc3dd31a1e0a94cbb4d41f4c18107fe03071a05565e6008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879413, "uuid": "92b288b5-de43-4f2b-8e47-0c0308f68263", "value": "T10C25AD2273DDC360CB669173BF6AB7016EBF3C614630B85B2F980D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879413, "uuid": "4cc1792d-12d8-4687-bcce-5191df7e90a6", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879413, "uuid": "56896577-ee94-4a66-aa0f-3a763e1a9d72", "value": "24576:lu6J33O0c+JY5UZ+XC0kGso6Fa5S4L2BKEPMqWY:nu0c++OCvkGs9Fa5TyBZsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879413, "uuid": "7562e566-326f-4cef-b1fe-cfcdefb0680a", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879413, "uuid": "9749ae7c-5f51-4195-b912-725f2c4b84bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879413, "uuid": "aedceaf3-6847-4649-91f9-3a32e961d09c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bda7984-002c-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741885177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885177, "uuid": "bb73ca9d-ecdd-45c7-ad42-aa4f99955192", "comment": "Malware payload", "value": "38a1df886c484d75f3d1bc253a9455ed", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885177, "uuid": "1b9345de-2cd7-43d2-a01a-b6497ec286c7", "comment": "Malware payload", "value": "ae48d27e7b7f3193f5ee09df9dfbed2414ea44a188f92ec30f46f682d4a41e06", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885177, "uuid": "ce49856b-3e88-4ae9-9b22-49d130f3e346", "comment": "Malware payload", "value": "04933f68a304703d7463baa9122fc28dbb68e234", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885177, "uuid": "7182bde6-f99b-4bcd-bb07-00337ca0717e", "comment": "Malware payload", "value": "ebe3fd876f3cc3e043e8c4d645d797ddd3f924580d8a883f992d0818ab6dbedd93f88896bd918d057308d93e83dcaabd", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885177, "uuid": "4a3c9cae-87e4-42da-ba86-8c67a13b0f75", "value": "T1C9A533A8E918C249CA7FD9D17155B331C166A3BC079C6FE1D48CB97C708FD5E28AA342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885177, "uuid": "e8532964-6af9-42c9-a3e1-cd03c1850c71", "value": "49152:K8CKPxg4IGrB2/bRld7eULSjBvOVqUZR5NmsQOR3usY:rRg45eRld7ejvOVvwsQOR3nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741885177, "uuid": "11f5951b-4767-46b2-9999-6fdfc95c7f05", "value": 2104673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741885177, "uuid": "8865a111-0bf5-4d1d-84df-371cd1718c1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885177, "uuid": "e376dbea-2b84-4443-8e92-dcd3116be6ce", "value": "quadquad.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3af6be-ffa1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825293, "uuid": "6f31fc12-64e7-4755-ba39-f446e7a4311d", "comment": "Malware payload (Prometei)", "value": "b77866c820f7b35521e745e3e104556f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825293, "uuid": "f9e8d4b5-d50a-47ff-893d-43d1873aee00", "comment": "Malware payload (Prometei)", "value": "aefa8824aa2b871d2166691ea8c6a21b7bccaa521d8a795221484feafff934c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825293, "uuid": "a69d2f04-c192-42c0-abcd-e7e495b8557d", "comment": "Malware payload (Prometei)", "value": "16bf0245fb8b906ef2d69f4fc01fb66af98951e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825293, "uuid": "86c07383-99ed-4d59-8351-6a4f7a4b9ba2", "comment": "Malware payload (Prometei)", "value": "294666a6ae1d1db6ff64595cab7072f76b3cde6cab7b81182646915f4cc57697df58fb221022e4cff53d4f93f5f006eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825293, "uuid": "7fdeb149-0683-4cdd-9e92-0145a8e13cc0", "value": "T1FE9423F8C83D2E3098169B3CBB5A826CF0A15772D9562B7AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825293, "uuid": "ebf9ac5c-5696-4f5c-8b1c-cc069d727c42", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgp:25WOSACZSV6eKRH5EPiamb4DsDwwcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825293, "uuid": "a11fab6c-72e8-46ab-90a9-d2d57eec5653", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825293, "uuid": "5a922956-426b-4739-8f9e-e49173c3095d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825293, "uuid": "d418cbba-0b51-4876-abe7-1537dc69762a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27036c14-ffca-11ef-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1741842917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842917, "uuid": "ca0a98aa-95d0-411f-8d83-43894a9ebef4", "comment": "Malware payload (RedLineStealer)", "value": "d89407ff1c7e68212ea29e5d7da5fba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842917, "uuid": "c56219c3-4a3d-4c17-88b7-fcae34c4e896", "comment": "Malware payload (RedLineStealer)", "value": "af621a0196ca315b44e889e295e0b227a1ed3afc3e2f1b266875436874138fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842917, "uuid": "a1cb40a6-b8db-4b5d-acc5-c1895cd78af6", "comment": "Malware payload (RedLineStealer)", "value": "8def9ed32436c34b27fcee48b9b10e4f4b519f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842917, "uuid": "7b7d9718-2b70-4728-babe-289134b5da4a", "comment": "Malware payload (RedLineStealer)", "value": "14d15dca9cb0a7107f0305f7b32e541af1de4a56b9ce387f18813d70ac7327ef002ff7473b376df413677a68ccdb375d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842917, "uuid": "80ce4dbe-f175-4264-97c7-c39efa274fec", "value": "T1DD45CF22B3DDC360CB669173BF69B7056EBF7C214630B85B2F880D7DA950162262D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842917, "uuid": "9537d420-7681-4f7d-96ce-bfb2a0f645eb", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842917, "uuid": "9e0616c5-73d5-4215-844f-7f258ce9919d", "value": "24576:vu6J33O0c+JY5UZ+XC0kGso6Fa/IkNPfDkQJMJP2WY:Zu0c++OCvkGs9Fa/ZwbfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741842917, "uuid": "7807ff75-9cff-4ac1-8689-fdc053b29e46", "value": 1247232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741842917, "uuid": "4489af33-87d2-4a13-b87f-f5a569ed43fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842917, "uuid": "2b328139-0be3-4b76-a188-3889e0af45db", "value": "d89407ff1c7e68212ea29e5d7da5fba9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e716d24-ffc8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741842124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842124, "uuid": "7ea1d5e3-ea45-430d-a252-b7ee6a938bf9", "comment": "Malware payload (Prometei)", "value": "66e28708d3d722839d680cef8e05f4b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842124, "uuid": "bc02305c-fd49-436a-a8a4-e266662cc3e8", "comment": "Malware payload (Prometei)", "value": "af81552009434147bca4e5c01d684b1f6b8d87ca049d48e1a41eb2263f27c55f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842124, "uuid": "7b05f1a6-376d-405a-9c27-30597ac3a8cc", "comment": "Malware payload (Prometei)", "value": "2c3e90e34cd18e896ef3d0fe9cae78f52621baf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842124, "uuid": "a681620e-ca39-49cc-be20-3c4b0f160253", "comment": "Malware payload (Prometei)", "value": "99f20c815329f0d95f2cd5f042ec6bda9cce174e84e4e574aee47a298ab773e1d0441901aadab707611f8453f0328c0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842124, "uuid": "34390d9e-561c-46d2-a027-a10585186b2c", "value": "T1629423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842124, "uuid": "ed666ec3-4d2f-4f03-81c7-d9268d2d1627", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgJ:25WOSACZSV6eKRH5EPiamb4DsDwwcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741842124, "uuid": "93276dfa-e8c9-4c7d-9492-7b0112d524a6", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741842124, "uuid": "b4ce3c27-fb7b-4e23-b0e9-5e1d27674803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842124, "uuid": "c7eaefee-c286-47bb-bfa5-aaa20aeeb8db", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ebc6fd-0020-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879924, "uuid": "9481767f-c08a-4103-afd4-0262a8818625", "comment": "Malware payload", "value": "b0903f0f4cadbed79d66aeaf676721b2", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879924, "uuid": "8c074a6f-7285-4b4c-bd7e-f4ff8c1871c9", "comment": "Malware payload", "value": "af83b3ca46575a0da51b9303cdc578b5812401bbc18065346ef7e6ae32e0f8fd", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879924, "uuid": "880100d0-0f4d-40b8-9c67-993aebbb080a", "comment": "Malware payload", "value": "6b07912080a014b7602c75510c178f7db76a1577", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879924, "uuid": "24cce8f7-e8a3-4916-98fe-9266a86ab376", "comment": "Malware payload", "value": "4d132130825236f23fc59a525a015a01785eea4eafc6242db647b58359e89e1f73b8441d032a0e0370d07dc938286dce", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879924, "uuid": "401355a1-7376-4da4-812f-882546a243e0", "value": "T19C2733C6F2BE7CE3812E79969148AB4980D2388193ACFA74E309D5CC534D9F14B75B78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879924, "uuid": "0c98f04e-c854-41f5-b343-95c5ad26dfac", "value": "393216:Gd/j2mRhkpcgth21IQNHb9hhmj46MgW1mpWKgTNjepQY0KpveIAX:GV2w6p9th21IKHgc6u1+q1WQzKpveIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879924, "uuid": "ca6150e4-bfad-4477-9cdc-b09fe5c715f9", "value": 22064910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879924, "uuid": "78005a76-e1d1-4d1f-afaf-ee46ae7abdea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879924, "uuid": "2cc302a9-9617-4d15-9409-d567526ec58d", "value": "ExternalUi.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b08505-fff1-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741859850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741859850, "uuid": "47d8e493-6d05-450f-9a99-2851c9686c7b", "comment": "Malware payload (RemcosRAT)", "value": "a960ebae805c8841c3af97f9fc7407fa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741859850, "uuid": "edccbdc7-0caa-4922-ac1d-a80b383ab22f", "comment": "Malware payload (RemcosRAT)", "value": "afc2ada857985bcd938784236a51e455d4e2f94ac489161155cbfecaa80fdbd7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741859850, "uuid": "cf5b12b5-99c3-408a-9bdb-dc97df0451cd", "comment": "Malware payload (RemcosRAT)", "value": "9354d8a48ee96b6c06c4a9b2ff0a019b6315557f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741859850, "uuid": "d37a6c2a-3e1c-41cb-8c7e-d7304975352b", "comment": "Malware payload (RemcosRAT)", "value": "8b504ca8d56445359a04f467cc029002e3b9980529475326c0dea1e92cee86d4135546aa97cc83a4308cbe4c50cd6907", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741859850, "uuid": "929c3dc3-121c-473d-9507-e86025a5d47b", "value": "T1A3F4123ACBF0ADC4031B71E0657E3F9E20982B43A5BA179DF9D50C6A9419E45EF3924C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741859850, "uuid": "5737b3ec-5ffb-4953-8195-e8a4294f6488", "value": "12288:A9PgmwvS3YgtaO+Wi5X2RP77BBNLOTzNEmWA4fzXKkz3k+QkdFg5y1AF0J3Hfw:aYPSHBEyDLNg5TerXdYIOyqGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741859850, "uuid": "e89eabdd-a3ed-4377-af5e-9f6d6318677c", "value": 726564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741859850, "uuid": "ac39fd96-d729-4c7d-b00f-dd114456883a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741859850, "uuid": "3bef6921-bd9d-4854-895d-678fbc0cb732", "value": "SOB,pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a37cbb-ffec-11ef-ad17-42010a9c0004", "comment": "Malware payload (Amadey)", "timestamp": 1741857632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857632, "uuid": "ba3ad8c9-4119-4d79-84b5-f51536dd473b", "comment": "Malware payload (Amadey)", "value": "d91b1e9db00162b86d2d3c14e1a943ce", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857632, "uuid": "09cad79e-caf3-40cc-a96c-d6ae080f51a8", "comment": "Malware payload (Amadey)", "value": "b1938f21d058442903d3d4c4a2aed153d59300cffd933e213acbb9b5e7d7a4be", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857632, "uuid": "518690b2-0f5e-4cd1-a8a6-195878cceaf2", "comment": "Malware payload (Amadey)", "value": "e487b841d7c5f6eb48d0cdd3d36b340636591abe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857632, "uuid": "195aee83-ca9f-472d-8ec1-d4fec1536a9b", "comment": "Malware payload (Amadey)", "value": "d2f3f65fca34f5102fed3480f2d4ba772b1a268a06ce1cebeda01a13c1153537f1e011731f413250b809bae90f4d5038", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857632, "uuid": "fc6169b4-4201-4741-8db9-934b8806fe33", "value": "T109C76B4266EB0891FDF7AE3095F652274537BD066F3184CF620C1B2A1F732E08A76766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857632, "uuid": "c2bd849b-b24f-46f1-8ce6-aad5e8754157", "value": "ee64c5fb6753284b1bbed67420bee03b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857632, "uuid": "597d4b87-39f7-4e57-b388-e4bff8347391", "value": "393216:8Zh0Gg4+7XkAbSvGpTNGbT8KbbNaK+o33irYVI31BLF8diXUxDm7JlIWlj3iUl2M:W0GgZ7X1hG8KaICrYVKAGcjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741857632, "uuid": "a36fc169-37af-4d76-b078-8d4f994cee86", "value": 57894039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741857632, "uuid": "d6e6a84a-0c38-448f-9c86-7976304078c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857632, "uuid": "e6130908-1ba2-48f3-a085-286a8f2c778d", "value": "New-inst-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898b414c-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825043, "uuid": "496ef907-9aa5-4c46-8cef-873366c14307", "comment": "Malware payload (Prometei)", "value": "52ae14efca302ed2fd0ea28056943fca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825043, "uuid": "1b695630-967e-47a0-9a49-1eab04c8f966", "comment": "Malware payload (Prometei)", "value": "b2778048bc0b7cf4c0fa1ef30404819035f5e86325cfe4376da566bdbc598a71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825043, "uuid": "d80ec05e-26aa-4141-aee5-83d071acb658", "comment": "Malware payload (Prometei)", "value": "1c5933890cf136431ead959a2858a039a6d11c6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825043, "uuid": "e9422181-3624-45eb-a687-d4315958048e", "comment": "Malware payload (Prometei)", "value": "e7d75d61f814308938709b8693b219d733a53e98ef3375972f0c5bd18684bf7b1f15cab3ec9e8a2959de8ca989caea04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825043, "uuid": "11b316bf-baea-4568-ab00-ad099978d760", "value": "T1E39423F8C83D2E30D8169F3CBB5A8268F0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825043, "uuid": "64c7d738-90b3-476f-9870-47905380843b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgW:25WOSACZSV6eKRH5EPiamb4DsDwwcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825043, "uuid": "5fef921d-3df3-4fbc-8755-e021495adcad", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825043, "uuid": "56bf03c9-9e2e-472d-8256-271a33c5ea62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825043, "uuid": "fdbf5156-491a-47fa-a73c-ab76fccb94ad", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0007e1da-ffef-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741858743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858743, "uuid": "d564a876-3bf1-41f0-9a96-53ae2de25a17", "comment": "Malware payload", "value": "f1b5f6edfba8bf1312f65e7f2787c72f", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858743, "uuid": "df3d826e-87c9-4d1b-84dd-20930856d134", "comment": "Malware payload", "value": "b3318733a04a5e1a0fe1e1c006d51a661d85caa850ce5d39f126a891a820f9c3", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858743, "uuid": "c5527a63-26dc-473b-bff6-c2e0b8ea9cca", "comment": "Malware payload", "value": "9c40267f7a3003219ec11567241a6d966ef46971", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858743, "uuid": "acc26cbe-667b-4672-94ae-a1a5b38ee77b", "comment": "Malware payload", "value": "b908ca874b297a2ac22617f27026c18afebe647b9b0116c18edc7d47f8e8cdb1f535eb95d5c52cc79cfcb376fda779f8", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858743, "uuid": "ea0e220d-e6c4-44f7-a45e-d1c72625c556", "value": "T12131AC62DD1E8AACAFE785E144F3ECA5063D39173F820625BFA88340DF0696671A51F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858743, "uuid": "5f29dc10-0dcf-4351-8b3c-5f6fcb7ca24f", "value": "24:2dHaPePKm5Kfzpj9qlyfoIre7heJU9CcubFF+enPkZAb0aJtJUc8FVeJta7prpAW:+6PgKmmzpSyAE4AJyCcMRnPtptJQkm0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741858743, "uuid": "0c5f86fc-ff0a-49dd-8db9-89f815a3761a", "value": 1469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741858743, "uuid": "efe5577e-1033-4eeb-94e1-e6117c81b4e3", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858743, "uuid": "1fe88752-e3f0-4545-ab71-d0fb93e73ec6", "value": "b3318733a04a5e1a0fe1e1c006d51a661d85caa850ce5d39f126a891a820f9c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d91afb-ffb1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741832209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832209, "uuid": "3d124e36-c7ad-4539-81bf-3056eab3d901", "comment": "Malware payload (Prometei)", "value": "622fc0faae7065aa4b4a0bdcb289a603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832209, "uuid": "9c928a62-ef96-49b9-84f9-c5dd9636aaad", "comment": "Malware payload (Prometei)", "value": "b3650ca9e55be4e4855b538d0fdf670d2f29da65f3fa5582bb777444fb4f96f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832209, "uuid": "fa1553e9-9750-4de4-8f0f-0e775f0e785b", "comment": "Malware payload (Prometei)", "value": "a4b6da90d9a6cc3e2b413886d009b4c4256864b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832209, "uuid": "601e7c27-a15f-4e36-b092-4149385ccc34", "comment": "Malware payload (Prometei)", "value": "d5822af5652db100e25858814fdd2e9594124b86955ec23d0874db7acc19633f9532870231aca890b782f15c5c46d53b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832209, "uuid": "337c365c-9e74-4163-ac11-0d8bc91820e7", "value": "T1209423F8C83D2E30D8169F3CBB5A8268F0A15772D9562B6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832209, "uuid": "2ced42dc-f1da-460e-b821-95f6cfaa77d5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgi:25WOSACZSV6eKRH5EPiamb4DsDwwcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741832209, "uuid": "7faa0ba0-d656-4960-8927-609dcd9f2238", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741832209, "uuid": "137cfc65-e1d2-4101-93ac-fb33038ea249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832209, "uuid": "13668672-2d64-49c7-b7d8-57e8a209a6a6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac7ea2d-0043-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741894839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894839, "uuid": "594c40c2-2aae-48a2-abf9-a47bd3f241da", "comment": "Malware payload", "value": "21dbfb9535dc7840e72d778c76dfb372", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894839, "uuid": "99f9e746-89bb-4ded-b857-5af3da5c0325", "comment": "Malware payload", "value": "b3f713a32fd048208b972c2ad4e326ba9d7779c101c35cb75b4313c13d9bc657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894839, "uuid": "eae7cf54-57c4-4d23-96c9-7aa222e92705", "comment": "Malware payload", "value": "0127a9ab0c8d4de75d06fc5fdfbea7d39a39892c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894839, "uuid": "754f0afc-0485-47e6-b535-80f388aa6c58", "comment": "Malware payload", "value": "4e7e805bc48ddc8ad63c634ff594a0ba99891715a76da12ab34acc1078065be5dc9dd30ee43a9495a187dbb8f38a3ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894839, "uuid": "7264dda1-3ab4-482e-966a-2ba9baa0ba1c", "value": "T184165A21B68EC42BD56605B01B2CAAEF912CBD260B6148D7B3DC7D6B27755C30233E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894839, "uuid": "146798bf-e40c-42a0-ab54-4db693e6630b", "value": "262f7b623746b414d0e9c48c1d61145e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894839, "uuid": "d12ba31b-afa9-46ac-bdf2-82c43d0099f1", "value": "98304:r0Fxb8yuO+WFwLId3DUVxaZumRdhfCqcqmP/Op:r0Fxb8yuO+JLA3DUub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741894839, "uuid": "3646451f-f2ee-483c-b520-0d3c93414e73", "value": 4118944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741894839, "uuid": "9cd866b8-5033-441b-9132-9fa676737065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894839, "uuid": "ccc012d2-45de-4f6a-be00-0a57de8ff858", "value": "Distributor Software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b060f0-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855605, "uuid": "6a4e0cdc-b7b1-4b89-a101-4271d690dc2e", "comment": "Malware payload (Meterpreter)", "value": "8d9c0f42baf129d1b430a01463dd7870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855605, "uuid": "5e59c804-da52-4f15-944b-8f28a95f077c", "comment": "Malware payload (Meterpreter)", "value": "b3ffbb213580aac6f9dc8d7ea321bd61be3e5cd41647e29aabeaedee2bfc4b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855605, "uuid": "f5d6190c-d64d-426a-9ec4-3a709377693b", "comment": "Malware payload (Meterpreter)", "value": "4054be8879b458c034340b19311baa42218c216d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855605, "uuid": "7b1e4324-67ce-4268-b909-eb83a00abc3c", "comment": "Malware payload (Meterpreter)", "value": "b0d3c92e7156d887456063c02b3836e43d29f72f4b60c7815f6e5bcf61943b3de5049464564994b90fd50a1fb0e9911e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855605, "uuid": "d3e2e1f1-9b97-454a-9298-2993261edb5b", "value": "T1D2E1B32372391CF6C89C463B4A63D04B65489B347F27E3FA8B14020FB9F201139B1C86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855605, "uuid": "b86407f6-1c56-4c88-9f4f-b6a0aed1584e", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855605, "uuid": "adec4ba5-6a2b-4f9b-ab94-2b8835bea087", "value": "24:eFGStrJ9u0/6ikY/nZd8rBQAV2G1Y+HKkn2DOIRwQ78IW29buoR9svcJBepmB:is0mYb4BQWq+H7CO1Q7PWAqoRikJDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855605, "uuid": "b7e0de8b-bbef-42bf-ae26-442d88200ff4", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855605, "uuid": "edc9fa5f-e6db-47fc-bd18-859132a17327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855605, "uuid": "94b7c33b-f435-474f-ada5-a8891adca402", "value": "443_2003_https-df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fefb379-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (njrat)", "timestamp": 1741872970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872970, "uuid": "56686d33-7ac9-4beb-9735-467e85b10f34", "comment": "Malware payload (njrat)", "value": "9678b6e7978417ea44b678bcc9095b4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872970, "uuid": "c43b4290-1e06-4e8b-a192-526408a3f003", "comment": "Malware payload (njrat)", "value": "b4555cb9d2283ac65354b8e500a9c77016296ef0088ce8c2dc5fb83d0dd233ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872970, "uuid": "631a8e46-1403-42f0-8f68-de87fcb2e05b", "comment": "Malware payload (njrat)", "value": "7068c38dd0bf0a2da3813b7fb9e9718a812a5740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872970, "uuid": "07ea37a9-3292-4680-959f-c016a7c3fbae", "comment": "Malware payload (njrat)", "value": "84056fc79866ff52478fe4669119aecabf20e9e1471439462c620770b05b5f53ed8bfbfbffce4339b37ff3a28c27330b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872970, "uuid": "5faea8a4-e034-4258-b49e-e04a949ab3fa", "value": "T144432945BFEA4A05D2BD8F3468F645160630BA63E932DB1E48D668EB17327C68C40FD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872970, "uuid": "9fd73143-ae89-47b5-9d15-fde036c37eea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872970, "uuid": "5e59288f-f727-488a-bdfe-08b972bc6cfb", "value": "1536:VgY2DnJNbt+tKFDSSLYNEUDTXExI3pmam:F2Dn7YcFDSSYNRDTXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872970, "uuid": "edf59bfe-7ab1-4ce3-9627-3149c5aa4dba", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872970, "uuid": "2f0d60d0-0a95-4534-af10-5c010c976918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872970, "uuid": "5acdb915-a09c-4438-aa3f-51a01c88b491", "value": "installer.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df3d580-ffa8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741828299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828299, "uuid": "b5921817-dc90-4d02-86a3-6d470054ed50", "comment": "Malware payload (Prometei)", "value": "59c5d47cc8a78269d9fc89fdc1783654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828299, "uuid": "951689ad-652f-4cc7-9b01-bb50306178a3", "comment": "Malware payload (Prometei)", "value": "b45593caa0483c335404310d156e9e3cd77f2e0d64922008d8c17eebcacc1e04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828299, "uuid": "41928006-b80b-44c1-92a7-14997eca40de", "comment": "Malware payload (Prometei)", "value": "f80834fef55b44977f50570aff15f74c278f74c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741828299, "uuid": "4df2f337-814d-4d70-99e9-fdf33db1c871", "comment": "Malware payload (Prometei)", "value": "a63968636c9ef02c3f7c38558cedea35fd457a4f0c902b8677c8b11023cb0c4aba59fc5d8c4b5219f90fa7b6cbd28672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828299, "uuid": "c436e220-f490-4e9b-ace7-6c56b6f0511e", "value": "T1C0155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828299, "uuid": "0ab25bcd-c6ad-48b1-babc-e55075041b84", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mply:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741828299, "uuid": "b95b6e0b-57e9-4ad6-8a08-dba4aaaca411", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741828299, "uuid": "2b0a3ed5-5cdc-4e32-bf1e-540dee63fb32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741828299, "uuid": "fe795bb7-ec1e-4a16-b332-ecab68ade382", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2311aee-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (MassLogger)", "timestamp": 1741849593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849593, "uuid": "894f337b-9d79-40f3-9e94-30f03b47fd03", "comment": "Malware payload (MassLogger)", "value": "709a4ffec76d0c7715cb6a69a3610ede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849593, "uuid": "f422123e-145e-4b37-be32-1decfc5cfb7a", "comment": "Malware payload (MassLogger)", "value": "b46c0a570d881198169c6cc53bb5e525e294fbc86e527e214926a9fc44e96981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849593, "uuid": "5f4196b5-4ca0-4316-8c95-d9e2cf62cbeb", "comment": "Malware payload (MassLogger)", "value": "172283b9521e8530d1d35d6ebd3e58b448949a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849593, "uuid": "aba4ce68-d4ad-4c33-aa05-6a1f1f301d88", "comment": "Malware payload (MassLogger)", "value": "0ad8c56d4124148c46dcab97d198fd27fdd7b3e3ce729b5cf6ea9b17bc1e5615f06c31e60bb59fa2e7ec1b360ddd671c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849593, "uuid": "2d307009-d395-46b7-9b43-3fff61f1e44e", "value": "T1CA25AE2273DDC360CB669173BF2AB7016EBF7C614630B95B2F880D7DA950162162D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849593, "uuid": "a776d909-6f66-455a-80b9-1ee5c2fee3d9", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849593, "uuid": "297ff63c-902c-4bd2-86ff-a5c8f1b63409", "value": "24576:ou6J33O0c+JY5UZ+XC0kGso6FaiJu9OAuWY:Cu0c++OCvkGs9FaiVoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849593, "uuid": "6f3dccf9-771a-499b-b9e9-ad9041b12d5b", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849593, "uuid": "90dccdba-21e3-46ec-8905-4971b5863883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849593, "uuid": "4a2db9da-0467-4548-8022-935fd4592f8a", "value": "709a4ffec76d0c7715cb6a69a3610ede.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae75723f-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864190, "uuid": "3625d2a2-599c-4d9f-94f4-6886e2e0ee8a", "comment": "Malware payload (Mirai)", "value": "bf1ea4827d45b4c138078709099320bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864190, "uuid": "40e30ee9-1ba5-46b5-9295-8b18eff39ce6", "comment": "Malware payload (Mirai)", "value": "b48f4d2ba28a2b425097c82f6f674279fc45aeb71568be045f4d926689a10f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864190, "uuid": "9a4d9b8e-2e7f-4b8c-aed6-f18a151250ed", "comment": "Malware payload (Mirai)", "value": "e17b709ed6a978c1a082581028b9b4d65fb949bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864190, "uuid": "9bd27f76-5f8f-48bb-bbc9-e390aec973b4", "comment": "Malware payload (Mirai)", "value": "9dcd69e7d2df1dc9ed03a97591c14f2af495e4abff1d634786cd0c3aa3a22a718a4ac7534350b129ac031d086d21912b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864190, "uuid": "59fb60bf-65a7-4f38-bcf2-4450abe43e25", "value": "T16C33F1A2FB57CF34D1BE10314D099FC5FC33E95B6665C52302B508DBACD4A8A6623A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864190, "uuid": "35ec144d-64a2-4def-b24a-7da2cb5b5749", "value": "768:X3K0VGnwZzEcTZiVQvkV4nN/H3EUo56/andr/bLecietWZtjEXoOAqx0VX:hNZzhTOHAXm56/S5L9BWZ5f6eX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864190, "uuid": "c6ffba89-eee4-4482-8f18-03ce0f35abe6", "value": 52664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864190, "uuid": "7d603994-4644-4a1f-93c2-1845c38a3b41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864190, "uuid": "3798e7b9-6cbd-464d-bc2e-1f2c679bdaf5", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac850032-0053-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741901982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741901982, "uuid": "0a0c4754-cc18-43f4-bf4d-5d4bf2994657", "comment": "Malware payload", "value": "010c0b94dd56c7c3b390044f1f8e4e76", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741901982, "uuid": "ab954551-8e6d-46d2-832c-f578754b0fee", "comment": "Malware payload", "value": "b4a4ed546d74556bd002a65b9a1192e53280aad6c927cc51cc89b0586d98c0bc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741901982, "uuid": "61607a7e-5759-4643-bc06-973f3a4629de", "comment": "Malware payload", "value": "25e8406535dd73855f77b978417510a09a1aa7e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741901982, "uuid": "3ff02092-2192-4ae8-b796-1077d6f38794", "comment": "Malware payload", "value": "e3612c8777ae5300eff15344be5ef1fbc5656567638e6eede44fa3870893b1f28a5cd4443bbb843d65b7179d00211133", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741901982, "uuid": "78f1f627-8993-4b5a-ad21-1d405069f09d", "value": "T151742327885D5702CD4994B11DBE1CFC93C2BB8AE32769494F1837EA941FE8D3B4B254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741901982, "uuid": "c2aa3b7d-3dd8-4b1e-b835-7af08cc3fc69", "value": "6144:1Nyk580vn3MPZjKop40skiOIuUPsgJV8ZHLO2Y1RZbDGFIPMKseQnJ16DXbfEnmE:1xq0v8lfhiO9+38ZpY1PDGmPWerrEnmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741901982, "uuid": "d4c8c01c-57bb-4607-bb8a-0bb3e5bf07db", "value": 360282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741901982, "uuid": "0e97a1a2-8233-40f4-b32e-88cb4871e305", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741901982, "uuid": "d4b7f2f2-37b0-4e06-b275-e5f4b69b2eea", "value": "bypass-hwid-spoofer-v1.2.6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a951ea9f-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848719, "uuid": "3e3dec32-f056-4837-be89-804cc88a4c8f", "comment": "Malware payload (Mirai)", "value": "a6135ead8459f68934158d4c354a7a20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848719, "uuid": "0cc542c6-ed33-4607-a27e-29bc8442f396", "comment": "Malware payload (Mirai)", "value": "b54b947d43ec150c27c8d579e5988a0c91b9f0b94f7b0a2210290dc0a8524038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848719, "uuid": "0026f521-7120-4830-a8b7-d24597e9fd3b", "comment": "Malware payload (Mirai)", "value": "bc5ad322e387aa44031fb4222eb9373f4dc0bb41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848719, "uuid": "caf97ccb-e528-4dc1-a9d4-60cf6701bcee", "comment": "Malware payload (Mirai)", "value": "c46a53cd1c6f8a3ce20abcdd653dc24f06624eb7d98a0e483bee99f0e525b4e9b15d713407ba8672e7878bb37ff37885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848719, "uuid": "9053aaa0-45cb-45bb-bdf4-7af9ca2e5571", "value": "T16B835C21B53E2B13D0E1F47E21BB8755B2E16ACE26A4C64E7E720E4FFF2155068439B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848719, "uuid": "caf6f369-4b8b-4617-ac38-bfea809a8558", "value": "1536:TKHfnkeTVw0gnTSajpuHrcSHC1UlbotP0RnHLQ5BrKgk+MLZEm+K:G/k49LZi1UResrQ5VKgbMtEm+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848719, "uuid": "6ccbd2d1-c306-48e8-b842-e74791f274d0", "value": 82952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848719, "uuid": "68422a8b-27c8-4b5f-82a0-d393e1df37ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848719, "uuid": "25a64ce5-53e1-4e60-a047-ebb87e713103", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186be538-ffb6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741834303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834303, "uuid": "3c134d18-3134-4fb0-8823-a5f7b5ef089f", "comment": "Malware payload (Mirai)", "value": "5a530bee93e90dfbeac67dfab2d8ae5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834303, "uuid": "c4fce330-27d0-4d40-bf2e-655c73bd1659", "comment": "Malware payload (Mirai)", "value": "b56af7bf73fffed7fcc7bea4f684591e16b502e4fead7f67878e24f9960b855e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834303, "uuid": "3dc1b9a5-fadb-436f-b60f-eacbc6dace7e", "comment": "Malware payload (Mirai)", "value": "93699f48a3f1da8828ea6d3e98d21e75f508e104", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741834303, "uuid": "02f8725f-d035-4b55-a0a0-aa7c221df32e", "comment": "Malware payload (Mirai)", "value": "c4e8fe14ee8d419f17eaa3e07d1d7f8ec6ee1207ed01718e40034d50be8fbab88a29f720335be7803310153143c9cfd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834303, "uuid": "7e8136df-b257-4cbd-b535-6c8ead1d3831", "value": "T142F2F1D11361178CC766DB783DBD7019C838111B32E90E402DD3A68AEA0F724A87AEFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834303, "uuid": "35c18d5d-5068-469a-ab4a-e68637bcb486", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQTF:87vbq1lGAXSEYQjbChaAU2yUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741834303, "uuid": "4307d297-9330-4635-b234-2a6b9e11897c", "value": 36712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741834303, "uuid": "40d12cd3-a010-45e7-aaa8-067c3b788b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741834303, "uuid": "ef2ab2a7-cf8f-4bde-8a4b-2131c8ec20a8", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ed0132-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830409, "uuid": "44ea8af5-98d7-48d1-8b77-ef94b34304eb", "comment": "Malware payload (Mirai)", "value": "dca7ce455c8d6efded021753c99c1e15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830409, "uuid": "a4a9a860-97d4-4307-a368-9f5ffbcc6c19", "comment": "Malware payload (Mirai)", "value": "b61fb0c0f0d4bb4a094f46f6d7664391d731190295bde51b2dcaf3904ab320c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830409, "uuid": "0315c7c3-9bdc-455b-a52b-de99dad03fd5", "comment": "Malware payload (Mirai)", "value": "c1b1d5ebff80e3af9298ee1c883e014e4e845930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830409, "uuid": "9d0ee4ae-0f52-487d-bd7f-ff67741363a0", "comment": "Malware payload (Mirai)", "value": "b1ec5614cc49daffc1811e252df6782152c3dd43135abe1607efa0af6bae54bf4f19726ac01a809e6d5d4afadc674d8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830409, "uuid": "3713107b-a252-4b08-9179-d238de2ebb49", "value": "T16B337CE6C0A9ADB8D2544A78BD298A749713F00086933EFADB858696C047DFCF6453F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830409, "uuid": "48105386-18d7-407e-8dd0-cf985d516028", "value": "768:CaJqx4VB9wtvHe31Q8QlsYeyd0oTigx/evKv5yx2Nu9MCdoWnfdCOib:CaJk4r9wtPlfhB3vYENu9MBQdCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830409, "uuid": "b256e4f7-d63a-4c3e-b4e7-45c9eb34cb87", "value": 52340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830409, "uuid": "b2b8b3d9-5252-46e6-a19a-ba4bd007dead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830409, "uuid": "8c10a5f4-2c2d-4f41-85a5-b8ae72f44d67", "value": "3atoNational.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7ecfe3-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (BlankGrabber)", "timestamp": 1741872962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872962, "uuid": "b688a15b-e796-4f46-964e-594ab61d82d9", "comment": "Malware payload (BlankGrabber)", "value": "8f0135bb7fc8efddb916d59b94b86196", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872962, "uuid": "cf4afaca-5e74-4078-a156-7e0c79d0b1ec", "comment": "Malware payload (BlankGrabber)", "value": "b62077f106e0f99bdd28823fde84286a75aba34be1bff78468f3423683b1bb59", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872962, "uuid": "b2810c31-8152-483d-92f1-3b5d57f54a6d", "comment": "Malware payload (BlankGrabber)", "value": "eadffebc3f04e721acca0b051a7d01e353ec9774", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872962, "uuid": "ef3d3fb7-1240-4b62-b403-52f9a5bbd607", "comment": "Malware payload (BlankGrabber)", "value": "415fd3bae03d18f4922e58bf1ee283ab7db65261880f0d272bddcd95139381e77f8496c6d598e423a8261c1668f0a66b", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872962, "uuid": "2b94b45d-646a-44dc-bd97-050cba833cb0", "value": "T18976338257940DE5FCB3923A8436D8AEDB36B51C1BA4C6DB43A8171F2F036F05936B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872962, "uuid": "fa0e07e1-a967-4fa2-855f-32ee8f13eda5", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872962, "uuid": "c3b24780-f7bc-4d83-a40e-acff3a52d7f2", "value": "196608:LWlurErvI9pWjgyvoaYrE41JIuI9g48hA:YurEUWjdo/H1Jd9hA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872962, "uuid": "d0d2efb2-f0ea-4ce3-b06f-d7347872c96b", "value": 7756848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872962, "uuid": "f45cc1f0-3104-4152-941c-1aafab7eaff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872962, "uuid": "fe51ebca-5c66-4f2f-bdda-a6a1c92591e6", "value": "Built.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fab7c13-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825027, "uuid": "09df3b82-c708-4761-8474-ecc1b4082684", "comment": "Malware payload (Mirai)", "value": "ad4504e72f8c8b7f966611dc8888fafd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825027, "uuid": "7a56f899-360d-4d0a-876d-ea004f78c5a6", "comment": "Malware payload (Mirai)", "value": "b6278a754fc58492c2ed7c9eb377dddb076c6c00bc83617fade0f4772889e744", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825027, "uuid": "ba4c338d-7e84-4b1d-988e-3e56f3988529", "comment": "Malware payload (Mirai)", "value": "754dc6277738d55300520aa7bcf1c9871d25c8a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825027, "uuid": "145cae7a-5e8c-4ecb-aac3-ee391f4aa19b", "comment": "Malware payload (Mirai)", "value": "299f3ea7c4f72d8fdac88a9d3b8fe3027d6afec9ff53bd561c6fb045dd7fc74c541ca4b25410bc849f27cffb26ac7001", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825027, "uuid": "ff634fde-f19c-4197-ab21-bc2317842375", "value": "T1D8531946FC818A11C9D413B6FA2E118E33136768E2DF7212DE116F2477CA96F0E7B912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825027, "uuid": "e89312eb-1e2b-463c-8103-305e4e6ac4ee", "value": "1536:ccn2HPgGCeyJo4wRi/J6XmUx4ZNdGUnEMvi278phlS:iPytXwRu6XSZNR78phlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825027, "uuid": "7fabb44d-0d1c-4c87-86e4-8dde5193aca5", "value": 62848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825027, "uuid": "e723a83f-9d50-4c6a-a711-a9b040afd0b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825027, "uuid": "2dddab56-e9b0-4b2a-8597-5c6ac5f7ea8d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a7dca6-000d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741871822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871822, "uuid": "4d47a631-3a80-45d7-80ac-be41cbd863ca", "comment": "Malware payload (Formbook)", "value": "3bfb7572c7c7954243b8a32f364e4a80", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871822, "uuid": "64c3fa74-2303-45ab-b3f4-6b21bc8cfbc8", "comment": "Malware payload (Formbook)", "value": "b766946cb0afabdf07a8710c4a25db89f55043059f655d826afe4f98cb4d9b58", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871822, "uuid": "bb277b59-1b27-459b-adf2-ac78b4732c2b", "comment": "Malware payload (Formbook)", "value": "8e7c917372338e8ce32cdc3b177afe38a3570fc3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871822, "uuid": "a782a88d-d571-4bd3-afd2-8da9bb570239", "comment": "Malware payload (Formbook)", "value": "9987f112afdc9c320a5a00b19b9484a31dc145a18b5f563803f19272e386f225ddee8c912f4894ce51e65eb4dce14119", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871822, "uuid": "876beeb0-fe30-40cd-8031-4f2aa460345f", "value": "T1D05533AD8CD6D192C02837398683ED156FE7D6608607D4B767B2C29C6D36BADF05183C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871822, "uuid": "1135e282-a709-45ca-8e3f-a4274301be96", "value": "24576:WOQu6+W0lTnsmikccODdAn0QzWwUrEmKiEo4ccnQ7DdC2wOGXe8PFd7FjDzeYxR:fR5ixD6DWYccnSDE22XR5DC6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741871822, "uuid": "00ce1b89-e40c-4964-bb98-cebc73c2a620", "value": 1384365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741871822, "uuid": "373d7ddc-e368-4ef4-96d6-7baaf5cf44f5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871822, "uuid": "d71404be-c88f-4a05-86eb-36ec1fbd8f46", "value": "NEW_TENDER_LIST.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2c6b27-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879518, "uuid": "86474bbe-9b66-47dc-8049-ba472870f7a8", "comment": "Malware payload (LummaStealer)", "value": "2002fdf412315d31fcdf5b6acbcaa53c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879518, "uuid": "75f6545b-6d8a-49ce-963a-42bd2049e13e", "comment": "Malware payload (LummaStealer)", "value": "b7bec68290b285cdcec37f9558f1488c36e971aded4b995b3a45a40ddcaf00dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879518, "uuid": "330cf76e-b163-4ca9-b1df-ebe9e542ae90", "comment": "Malware payload (LummaStealer)", "value": "c3d77ad74a3c01eba18fd19eda94789cdd7b9cb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879518, "uuid": "832c2a53-504c-4690-9738-c6910515876b", "comment": "Malware payload (LummaStealer)", "value": "56fe0be966f47b4498941c66f6988576f8f18df91c8c4c142c563602b777f08c7450c2d5a488205b99f6bf0fa1f40d7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879518, "uuid": "bc6278bf-ddcb-48ab-9e84-e490840021f3", "value": "T16255E07270C1C073FA4199B23598E3B5446BF672DA2D4BC7E2B4E739914CAD017AA12F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879518, "uuid": "4c1bc241-7247-4c6c-946f-593279fdd25e", "value": "d462aa757f68629e41b3df6e6d4c6a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879518, "uuid": "5239a007-75d2-425b-8d69-1f3d553c5a27", "value": "24576:uAi/c6dNtEWZ4B+UsxoxbzmXDpssjHdm+IFPJRpssjHdm+IFPJ:I0qNtnKB+UsxoxbzY9Tg+Ij7Tg+Ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879518, "uuid": "b47eec0e-d486-4147-8a79-e31c663ac524", "value": 1366528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879518, "uuid": "584e3590-2f04-4037-8c74-6dedf51fb6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879518, "uuid": "e5b91c37-4728-4a1e-aa6d-57a8d610b9b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b252015-0025-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741882115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882115, "uuid": "e0b46cc8-845e-4d44-b78e-2df927b709a0", "comment": "Malware payload", "value": "2bcfe7d878e5115e12d4355ad9ce25b4", "object_relation": "md5", "Tag": [ { "name": "85-193-81-154", "colour": "#F67120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882115, "uuid": "46a8fdfe-5b6f-4ebe-b857-51d140e46d1b", "comment": "Malware payload", "value": "b7f55fd778fd6066d3236cf6cca4214a8949226e05d414e6707b107918127c25", "object_relation": "sha256", "Tag": [ { "name": "85-193-81-154", "colour": "#F67120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882115, "uuid": "94552b91-1529-4672-9be5-f984d332a818", "comment": "Malware payload", "value": "24121b55b90669a982fc03bbe642c911d2f70929", "object_relation": "sha1", "Tag": [ { "name": "85-193-81-154", "colour": "#F67120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882115, "uuid": "d7d37e79-6ad9-4965-a5d5-0f8b1388c045", "comment": "Malware payload", "value": "8776ecbc8e80f3a7a6d9f0a742a5261c1ba1a2d3c8ea3a9ea2fc0eea7670e9fed2bcbf3e618d14b68f441696bb545e97", "object_relation": "sha3-384", "Tag": [ { "name": "85-193-81-154", "colour": "#F67120", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882115, "uuid": "168e73c9-7c1d-4a15-a9be-96ffe06e7d44", "value": "T1FF83CB03F19DC35DDA788AB1303A42709199EF2B8510EAD6F8DAFD3F857618D1B152E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882115, "uuid": "0a5f0724-f833-49c6-9dfa-d9d85e027116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882115, "uuid": "499eecfd-d4af-490c-9af5-54bc79c570f4", "value": "384:MuCC41zczKJ3bE2XSueqywUOroP8X1TDeUzpNGkrdwTXCZB9i3oN6anxOPz0GwJh:MuCh1l8AyUfi3yLDTV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741882115, "uuid": "baeabf8b-cf69-4f86-a907-04aadde6bb98", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741882115, "uuid": "afc556f5-8431-44d4-8686-0d3708dbc1dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882115, "uuid": "71e9811a-53aa-4918-b227-dced65223adb", "value": "b7f55fd778fd6066d3236cf6cca4214a8949226e05d414e6707b107918127c25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90d6102-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849631, "uuid": "c375b7b0-8f0f-4353-b43c-5f1ddd4ac044", "comment": "Malware payload (Mirai)", "value": "def0caebde8c8c69545f00bd4adf686b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849631, "uuid": "aab3f087-b030-4395-a752-7e1e660bb604", "comment": "Malware payload (Mirai)", "value": "b8cc70b9440bc419b9800584fb08905b0d113fae421789c6e6ed24cdec16b6fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849631, "uuid": "cb32342a-a977-47f2-9702-9345857d0d8c", "comment": "Malware payload (Mirai)", "value": "afb50192833ad21cb9259464887013adef9250c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849631, "uuid": "b634723e-0bb0-468c-92a9-4cd28ae96349", "comment": "Malware payload (Mirai)", "value": "7f95bf5301a297998493bab63928d872dfc3af4d8937d31f1c36d8fce20c6c6b52dc362fdd97ac1b50871dadd48a219a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849631, "uuid": "8cf0d2d5-2333-4a14-8891-6bb6e183d119", "value": "T1F8A2E019BF28818BC832297555E9E5D21397FC61F2EDCC096540C16FF5A33AA6834F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849631, "uuid": "a7dd97ff-c01e-445d-9df1-b98c23b79002", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTQ:O98o08kxofBE+ZkXaITbp2F2TWul0c5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849631, "uuid": "decfef1c-0218-4857-8b01-a6fec932b461", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849631, "uuid": "d243144b-a043-4493-8160-56ebce6edda9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849631, "uuid": "21194be5-1b2a-4d74-9701-191ab8858710", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ff647b-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825006, "uuid": "62ae7eb2-f860-4b02-b6e9-d8f454aec5b8", "comment": "Malware payload (Prometei)", "value": "aacea751c7294d08b9493bc38fe325ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825006, "uuid": "b814afb5-0428-4cea-92bc-7b4aa4ef05e9", "comment": "Malware payload (Prometei)", "value": "b90bd2112bde4a113af119d86955972d1cf390895e9ee968ba3bb2e8fb8bd99e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825006, "uuid": "79025ef3-d5c0-4489-a2d7-52b0bbf7b667", "comment": "Malware payload (Prometei)", "value": "6f41d492bac786d6bb869db891726862884e8d38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825006, "uuid": "e1a7326d-eb84-46a8-8cc9-c157d6800455", "comment": "Malware payload (Prometei)", "value": "cf3384429e9e87393900842bc68ca7d35e01b2050c6a1b0bf628bfb2a23597dc008cc3957ef9d94cfdbe290b11e15458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825006, "uuid": "f89df60e-a487-4190-902c-8bf6da838247", "value": "T1F89423F8C87D2E3098169B3CBB1A8268F0E15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825006, "uuid": "69493e36-1f5f-45ab-a436-065f19914dd7", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgQ:25WOSACZSV6eKRH5EPiamb4DsDwwcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825006, "uuid": "9ca13282-cb2f-4371-8e99-dca82189a368", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825006, "uuid": "364664e3-214c-4644-9515-56d450d1653c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825006, "uuid": "400875c0-2f5d-4f4a-973d-4dad280ad499", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005a67a4-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830397, "uuid": "65850b05-bdce-4c66-ad48-60ec531aa057", "comment": "Malware payload (Mirai)", "value": "e88097053fe04cd6fdf7feafe58ebbf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830397, "uuid": "63c5ef36-19a2-4a93-bd4e-911f955ad350", "comment": "Malware payload (Mirai)", "value": "b91ec457a2ec184575593c067b922cc1896ae8ca2ea82bba05f2df46162ce91e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830397, "uuid": "510a17dd-c034-4b67-8c46-057a9b07a3e9", "comment": "Malware payload (Mirai)", "value": "1530fc58aacba0044e69111852346f56a74ad78a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830397, "uuid": "4f651a74-4dc3-462d-b968-05437fe52070", "comment": "Malware payload (Mirai)", "value": "d7acb010974b09361bea000749aac63b445244e7280a37781575e04354814767876d7d3ad29f44f3e39d95b08573c148", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830397, "uuid": "64cabb7d-2d57-4132-96b3-0b1cf8f105ae", "value": "T1DD1308D7B405AD7CF85FE6BE9513490DF631375510830B2667ABFDA36C321A48E22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830397, "uuid": "44780360-1b80-4321-9d64-64a497a66203", "value": "768:lreLCNLwpwQuahvqdCXRt7PJ7tzhJ0iqw9iPSsQ8zXSu:xaCNwpGPdQRt7PJtP0iqwYPSd87F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830397, "uuid": "94336578-cfdb-4856-a3bc-13957e391cb4", "value": 43616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830397, "uuid": "b0465cbc-3dfe-4037-a2a4-953ca8368044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830397, "uuid": "54f0c496-a5ef-450b-b15d-4be6e593acf8", "value": "NewAge3ATOm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f4fcce-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864182, "uuid": "57624aca-93f6-44f6-951f-6b966fe4ab92", "comment": "Malware payload (Mirai)", "value": "4b7e1c882a08fa9b0ffd75c737d7b33c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864182, "uuid": "b856e860-b44a-4cbb-9bfd-3549e4df5e9f", "comment": "Malware payload (Mirai)", "value": "b96eb970b28e8c2471edfa4fb7dd47b82025bffdb45dd164a5a286d2cfe4d1cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864182, "uuid": "60bef7fb-4c1a-465d-b25b-d153e2feafd0", "comment": "Malware payload (Mirai)", "value": "36c9dab274c4827e346083261a945ab091d51bb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864182, "uuid": "524e64c5-64fa-4a5b-ad1b-1a57300bbec7", "comment": "Malware payload (Mirai)", "value": "f143650d053354634a0812d5c823377578c7bf6ecb2d89a39de8ab562b8ef4631536a7c4ebefcc8d336b4eff9b3dd338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864182, "uuid": "f34ba76b-3938-4fd9-8a04-69b099d4a6ee", "value": "T195B34A77C8296FA8C259D5B4B0B09F792F63A58182471FBE54A2C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864182, "uuid": "06fa8bd0-dd87-4383-9aee-daf454cf5b9a", "value": "1536:2aVTHW/qIAmPqmPHFGEWCRPKBKFnLblvCifzQVW9kXxeUwr/zw:2qWLSmPlDWMSBOlvC2sWqXxQrbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864182, "uuid": "2791c93c-f912-41d0-a482-fafcfbbe3da9", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864182, "uuid": "b614a8b1-ff65-4a31-bdf7-c2fcbfb4090b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864182, "uuid": "a5c180ba-2eec-4570-b7b3-2efeab99fa19", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d55632e-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869127, "uuid": "05b89e90-ecd7-4e90-840f-1293d5415551", "comment": "Malware payload (LummaStealer)", "value": "dca5a4d306b6166c5a4d4756707712e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869127, "uuid": "e042ef44-d086-4eb7-a090-89a3c03f4b96", "comment": "Malware payload (LummaStealer)", "value": "ba4bd6d7a2644c76ce30c905804302afdb1d0f5c6110bdedb7d4ea400f5c74bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869127, "uuid": "1ba0bc7a-96be-49bc-8375-4608d0e19059", "comment": "Malware payload (LummaStealer)", "value": "62fada94166304380dcec9a7a980a359ba3ba101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869127, "uuid": "ee3dfb24-1e62-4400-abb8-19645ce7fea8", "comment": "Malware payload (LummaStealer)", "value": "77666524bad8cd309b8dd2fa12a41cb12c1cef0e8247450b05de4c56833d236920ad5122f73c1eb34386df4ec4593b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869127, "uuid": "e4889938-407c-430f-b509-efa606485acb", "value": "T1C2F4D046BC91D0B3E91628B14D29E7C50C6B6B604F20C4FBBED89D646FB36E18932357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869127, "uuid": "f4b45b82-b827-4489-8292-0c0ba7c61db7", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869127, "uuid": "ceefa69d-0ae2-44e6-8e2b-432e10c9201e", "value": "12288:GIJQ/s2kiatVPnIpbWiJ621POPAANU/Sc+e1RoKq/T/+Kc5fBzBS0+I4d0Z2cddQ:7BnIpnJhdQAANeNboz/aKc5fr3l4dzcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869127, "uuid": "c76e2420-f314-4838-9e5d-ccd2ffeac20a", "value": 775488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869127, "uuid": "f55e52fc-e5cf-4c29-8583-edca6db18ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869127, "uuid": "13f61463-3a3b-4802-8c06-7d64c3b3c5ca", "value": "SoftWare(1).exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e7ab65-0008-11f0-ad17-42010a9c0004", "comment": "Malware payload (BruteRatel)", "timestamp": 1741869896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869896, "uuid": "ce139a54-e5d7-43d5-b889-456c6f07d121", "comment": "Malware payload (BruteRatel)", "value": "decf7b259d75e0e499f44c5a915b3175", "object_relation": "md5", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869896, "uuid": "7bddf23b-036d-4e20-9ccb-198b695481c0", "comment": "Malware payload (BruteRatel)", "value": "ba847f3edf4f9c540641c30f45e40baee8287d30d5aef59543d24f0375140f27", "object_relation": "sha256", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869896, "uuid": "b1433e9f-b25f-46d0-a3b7-13b3c60e81dd", "comment": "Malware payload (BruteRatel)", "value": "af87c4222d4538fd4d43eaa0cb30974af08ea21e", "object_relation": "sha1", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869896, "uuid": "ddd3a6fe-be07-4aae-8b22-659a812f940e", "comment": "Malware payload (BruteRatel)", "value": "ec0bfccd383cee9a40a57f75ab32fdff5056c2987713fb92b319dcff90cccf4b411f62891ee4841ad13ac8bd240c88b9", "object_relation": "sha3-384", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869896, "uuid": "fc1379db-d264-45b2-a008-25a84d5a5a35", "value": "T180541287A450C08CCDE7DD30A2EAF5F2BC3C3F5B087195A89A28E5343E513A96B5925D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869896, "uuid": "5bad8e1b-bc8a-4bd8-b09d-9855cb039f19", "value": "5821847e9de43275356a37b9a2b0a5b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869896, "uuid": "172d3de0-8df7-48b2-b8fd-5c2eadde7439", "value": "6144:Gq2UhPqeabCJNzgNm/qVoe93Zi861RyyZMAyqK2kY:bBhJNzOOQJi86Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869896, "uuid": "1dcf1cb9-93d4-4e99-b1b6-762b1913d6f3", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869896, "uuid": "df11d18d-67c8-48c1-847e-8c0d43d63394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869896, "uuid": "8d291e74-03b7-4152-8ea7-fd8163ba5dcc", "value": "badger_x64_stealth_rtl.bin.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d66846-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825015, "uuid": "c92e7e17-2fcd-4b9d-9cea-900da6330e02", "comment": "Malware payload (Prometei)", "value": "d1abe31f944bed1255e81167da29c5d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825015, "uuid": "e57eeef2-6482-4b03-a71b-ac0b5d52edbf", "comment": "Malware payload (Prometei)", "value": "bbd51994339038231d8c18705d0d22742a82c2369bd01e4850bcc2d906cb26b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825015, "uuid": "55ff986d-172c-4b88-8df8-cebcbb007530", "comment": "Malware payload (Prometei)", "value": "2789cd8ab4e7b65162965d6ef02a97860bd8cfad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825015, "uuid": "75294de5-7d92-4cc5-8c70-6a596dfac225", "comment": "Malware payload (Prometei)", "value": "e3bdcce11b5a6ee9600a6c5f029d4c4007c1242ec8e28930afec96f6dde8de5c8331958e9ca2b4312da5c94e3f397d34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825015, "uuid": "e386acf1-4bd2-480b-b771-5c092808aec2", "value": "T1C6155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825015, "uuid": "c6af7816-4035-4676-9e03-f876c1c83c66", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplj:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825015, "uuid": "ebb04dfe-8559-4b20-9637-0b85e6b08def", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825015, "uuid": "cf906543-99cc-4712-b4f2-fbccb77f2d64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825015, "uuid": "2a3a5f80-e2c4-4fd7-a741-3aa6040a9ce2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cb5a2d-ffb2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Hajime)", "timestamp": 1741832800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832800, "uuid": "70010583-b1fa-45be-a9d8-48e81c50593a", "comment": "Malware payload (Hajime)", "value": "3ceb292a012a8417c5460948ac11b409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832800, "uuid": "c0b46802-af96-4e50-bf15-88c019b33e81", "comment": "Malware payload (Hajime)", "value": "bc8791f638e05f46e4ada49eca0849f11c6918b8c3836bee33cf8f2f502e7f9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832800, "uuid": "a88235de-d8b0-47d9-bcf2-7c0fb45756bd", "comment": "Malware payload (Hajime)", "value": "6557d0ee8d4adb64587e0568d5ab612a88acd3c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832800, "uuid": "63afbca6-39e1-4590-a4de-1487a2952633", "comment": "Malware payload (Hajime)", "value": "6f9efa29b8c4bb0d973fe95e36169365a857a89939937c23d7e4be8c859bd93fb40038d03c45d56eeb8f25c33ec8f4a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832800, "uuid": "8fdfb462-a1b2-4a10-bb2d-c3c184de4441", "value": "T1AE43024523A62BB7857248F1A7F8FF4AE14A3E68CFF55C097C117A58A93235D18C4D1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832800, "uuid": "c6e104e8-3bea-4e70-8d15-1e4314867ee7", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efym:yYI0ARqw1qAEv7UIFM8oJorFquyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741832800, "uuid": "4b451c0e-15f0-4d97-8be3-b38ad2b2ee5e", "value": 56480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741832800, "uuid": "bf0c7a5e-d650-4c8f-a351-7dd70272df60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832800, "uuid": "3c2072e0-80b2-41a0-b694-90621330446e", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903bb419-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (GCleaner)", "timestamp": 1741879601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879601, "uuid": "efeb073b-1699-4513-ac7f-e1eafed947dd", "comment": "Malware payload (GCleaner)", "value": "1cc48593c8c31a8af8fa20d7ac1dcea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879601, "uuid": "bc9e2a81-3ede-461a-b3ff-3a97584af3b1", "comment": "Malware payload (GCleaner)", "value": "bca2d58f5317010c58ffb96cbd119bda713aeb1989515aadcccadc1ed58baa46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879601, "uuid": "d28da52d-1e7c-40e3-acc5-6f04eebef808", "comment": "Malware payload (GCleaner)", "value": "0e2529a42de99556f1d2b582a699d00847cb6cb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879601, "uuid": "09b242b1-73e8-413f-bfd6-fff34a47b59b", "comment": "Malware payload (GCleaner)", "value": "03cad3e5449551671a1e454c7b4510b074552cf75b6e3d0a7dc10edd4ed965d179344579bf77612519da581284f358e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879601, "uuid": "a510a9db-bb39-4649-a0dc-22b30a93fec6", "value": "T1BA2633872A366239D082B2B1EBDD02E71DC60E5F52706285AF64F18817FE74938DF791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879601, "uuid": "d2cdd823-e641-4921-9ec0-a867ec7889b6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879601, "uuid": "008ca803-1874-4c91-83c4-bc5546cae36a", "value": "98304:LmtaKETQ8P7BaNWevp6wJU2f7pSdBoJ6+sXvKaCm1+qGHlpD:uGT/aNhR6wJU2f2BoJIfMmkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879601, "uuid": "a0e2796a-4462-43a5-80e6-b1c216e9084a", "value": 4712960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879601, "uuid": "b71e351c-1fc8-455d-b48f-0429b53cc3cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879601, "uuid": "9f694b1c-2691-4390-8f07-3986c3f9faee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586552e0-ffd1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741846006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846006, "uuid": "8174f945-90f2-4223-b1c2-be093461415d", "comment": "Malware payload (Prometei)", "value": "8e956ff266b70c794a29b170a6c57a0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846006, "uuid": "c0d83879-3bd3-4a07-8b67-bbc691caaec0", "comment": "Malware payload (Prometei)", "value": "bd13f789da878ded692f0a8f04af90454af21e532d544d6a91ace59e6875a26d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846006, "uuid": "9e9c28e0-df9f-454e-9d10-0b85be1343bd", "comment": "Malware payload (Prometei)", "value": "9d13b209683c5a616f37bfc029d463a6793b2a88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846006, "uuid": "03e38c09-5083-4aa9-89ab-e1c063917fb2", "comment": "Malware payload (Prometei)", "value": "104ddda468f553ccd0d2ecdd25e4c640db6294a4ac6d4ab3ed9376773f33acb5f5cae069f69ae7b2f53e7b9bcb6c9797", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846006, "uuid": "58f0a02c-4a70-42f9-a136-bb1dea6bfba2", "value": "T1AD9423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846006, "uuid": "2749e1ba-75e8-4ae9-b71a-5a56cf6048a8", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgG:25WOSACZSV6eKRH5EPiamb4DsDwwc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741846006, "uuid": "1877fb2f-1a0c-4f02-8e50-c735c351d9ec", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741846006, "uuid": "d8f333ed-15dd-4fe3-96ec-6bdeca22a50e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846006, "uuid": "b7874c1a-6696-461b-8f0d-4af6d876a033", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8db7711-001d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Copybara)", "timestamp": 1741878810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878810, "uuid": "2d672496-3c6b-4661-9a4a-5153f8b601f4", "comment": "Malware payload (Copybara)", "value": "1a70102322bec314cb301906721efd5d", "object_relation": "md5", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878810, "uuid": "f5274cff-fc54-413e-836d-af6fbeea53f5", "comment": "Malware payload (Copybara)", "value": "bdae3cc96acd16347a7ca568b9972d82ecdef8d637abee96302d20d4d02cd613", "object_relation": "sha256", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878810, "uuid": "cc7a526c-1fd8-4b5f-adef-370b9a563480", "comment": "Malware payload (Copybara)", "value": "ba3552a30538dd9a1e6e96bd9ccf0ab536111a19", "object_relation": "sha1", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878810, "uuid": "f752c472-83a6-4163-a184-5842e400b0c0", "comment": "Malware payload (Copybara)", "value": "62ca605a58b7a511996804fc4608dfe0ddd07f3507a36a7cc9fd301816b28e5b140de45b18ffa87a54d76b8c0a0ae112", "object_relation": "sha3-384", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878810, "uuid": "be07201c-10bd-48fb-ac07-b9b1a0537f71", "value": "T17FC63322DBB6D11FD8F35B3B083545261AB5DD33D793C20BD9A172B848AB2E4CB499D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878810, "uuid": "506763bc-a087-48e8-a19b-4fa528c062b9", "value": "196608:jKqATYjBWMQNV51ZiKOXcLpuLqp8IwcFyWTOB8xmjmr7VwcmaFe5Qs1DgD/DSDqa:jKVMQb/wKOCumqYZTO2UjmMay0r2+kt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741878810, "uuid": "dfa19d32-5b9c-4bdf-8564-5815f71bc1dc", "value": 12130184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741878810, "uuid": "6c57d438-5105-4d42-a9d4-b2298834e0fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878810, "uuid": "6f23acbd-6c7f-4c67-987e-0c8fd1d27840", "value": "02818_MyBBVA.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1393a09-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864167, "uuid": "04e7e7c5-ecf3-4ddc-a029-697fd06a444a", "comment": "Malware payload (Mirai)", "value": "253bcd394fcb15ffb0b0479afd1820d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864167, "uuid": "3df47438-31de-4866-bc6d-9ff04d95e38e", "comment": "Malware payload (Mirai)", "value": "bdb1da264c5d0d39fcb2f7a9fa5622a1a7f062234c69279242112bbb2c7137e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864167, "uuid": "22598957-6301-4bb4-bdd0-d480b137652f", "comment": "Malware payload (Mirai)", "value": "65900331c34db510df9821c00623ab6930348b47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864167, "uuid": "f389a2e2-2fbf-4040-b057-892a07a8d67c", "comment": "Malware payload (Mirai)", "value": "de61f4028500feda9f79d2fd57bed878ec3fabbb78e1b7d00c34277dee3c56f03aa888178ae03cad9d9c83e606fbc84c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864167, "uuid": "765b50f3-2ab3-4b84-b73b-becb1a839ae7", "value": "T102030197EB5C12FFEA33993382EB58422761EA3D5EEB64D769B1CBC3011063E5034588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864167, "uuid": "8d80f017-8b38-4039-828d-1bc2931ad7f0", "value": "768:2xaiUaT15josfVAnej4t4+ooiFUY3OA5Dy0mBFs9uF/A+d/5Q4SBQN:22CDkEA3tuoiFUpAWVmuFDdBQF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864167, "uuid": "28ec0677-6ef1-4699-8919-c5e0e44522bd", "value": 38652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864167, "uuid": "cba61d46-7562-4170-a7e6-8b34e73d43c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864167, "uuid": "c99a0187-a618-4100-98e3-1e07e5a321d7", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebd255e-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879383, "uuid": "300f26df-7fce-4c30-8867-c23deb429c8d", "comment": "Malware payload (LummaStealer)", "value": "53e08bdff28e57439337d353fa73d333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879383, "uuid": "16a46c0d-5f43-4fbd-a158-cf90c9fc56fc", "comment": "Malware payload (LummaStealer)", "value": "bdd85f2a3d581048e31ad13ba9119d9b5bf1b078df86afa92b43929df7e6b1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879383, "uuid": "715baf6d-8b82-4c88-86a9-dcbd0fbb426a", "comment": "Malware payload (LummaStealer)", "value": "ae8c160aaa04c25c83611df4e7b79a04f8bae99f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879383, "uuid": "87c79b1a-92f9-4391-a0f2-a161202c842a", "comment": "Malware payload (LummaStealer)", "value": "84bdda18cd5d6a1687e604b068f52265fbead588cb499667917139364b8aa6ad16c542d2df52184a20717f49c3230cf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879383, "uuid": "62d20c0d-0980-45b4-a404-7e877c5fc4e2", "value": "T15B25024176C0D072F45729755A78E73A493EB9B04C258BCBE3D84AABCB641D0CB3276E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879383, "uuid": "bba7b3a7-9f3d-4666-87e4-c5cf033dd741", "value": "48f40757c8f29d7f10ac26de5c541985", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879383, "uuid": "53b2d80a-3628-41af-9960-4a6ab98cd22e", "value": "24576:kJ3/bFxc0uFgBlrWwboz/aKc5fr3l4dzcVPuboz/aKc5fr3l4dzcVPr:kJ3r2FgBlrWwbK/cfadzlbK/cfadz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879383, "uuid": "b0d9e66e-75ec-4385-85d5-db6ffc1308b2", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879383, "uuid": "8ced218a-90d9-40ab-a250-d575abcab362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879383, "uuid": "25849908-68b5-406c-baa4-0ef4ada37583", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33563fb9-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879445, "uuid": "1ce205ef-db78-41c3-8ff9-921b48ddb2d4", "comment": "Malware payload", "value": "1a42e9335c9e635075c33983768487c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879445, "uuid": "eda5d6a1-ee23-4da7-8115-f3c57ac799ae", "comment": "Malware payload", "value": "be20137175377f06037a66d3c0be4fbcf1dcdaf50ea11d26a627160f4cf9363b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879445, "uuid": "6cc8cba0-6e08-42df-88bf-72b8215f5f7e", "comment": "Malware payload", "value": "10c9054054e315d40dcd8d2c656831f516cde620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879445, "uuid": "83b8b113-f67c-4202-bdfe-b707c860e31c", "comment": "Malware payload", "value": "90dde0336d127b7754ee340c67df7d04e3bfb53aca744cf9467d1f354a823c8e2d274cc86e36086b282f0aa3f39500ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879445, "uuid": "c922698b-ba54-4ea8-93ec-1dd3ccd9bb3a", "value": "T135663A87FC9144E4C0AAD775896282A3BA71BC484F2527D32B50FF692F36BD46E79310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879445, "uuid": "599bd73a-d217-4173-9772-a27e6697d273", "value": "a9992294f8951a2b77e1dd844a4c619c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879445, "uuid": "1d5a506e-6045-4bef-9bb0-b57cd5b3b3b0", "value": "49152:1J7WJy2l9YqZfPrDRQudasN7HETop0DaEnPjA5EGv52XD9kKxncuz4WpD2gbFjLT:yA2r76O9HETjeE5J8wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879445, "uuid": "ea9c0dca-f6a9-439e-be9f-794aa64866bb", "value": 6706520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879445, "uuid": "16186028-8b36-4610-9b48-6e1259cee6a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879445, "uuid": "2705628c-710f-4895-bca2-7a2d006ed2bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ca7ca6-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883452, "uuid": "73672c5f-d8c8-4bbe-bd78-a2e2fe9d5d7d", "comment": "Malware payload", "value": "98939063be57d14536f9a492d999fe4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883452, "uuid": "3b5c9ad7-10cc-4732-9022-06fe6b74500f", "comment": "Malware payload", "value": "bec1a1d6587bb5254b4e8115c6216db346f79c5dedfd77512872b4d0ab76bb6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883452, "uuid": "bacdd65f-1f99-4c23-a22a-be587370c86e", "comment": "Malware payload", "value": "8ff5f515ed64a6d206aed3081d257327428bca37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883452, "uuid": "eb370c31-f10b-4bd8-b4c7-4177082ffad3", "comment": "Malware payload", "value": "e4f7c951d9d98a5a873d581ce6b958ad9cbbc0639f747299c232a19e346af25137cf6d048fb60195c0e75fbec4c7675d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883452, "uuid": "6057b0cb-780d-4c2e-9359-4bb77a163ff3", "value": "T1C9A5D023F2CBE03EE05D1B3705B2A25494FB6A616422BE5396ECB4ACCF751601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883452, "uuid": "500f5305-1cdb-402f-9518-c658a2ef788f", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883452, "uuid": "542d395f-f21c-425a-9b99-af2bdbe380cf", "value": "49152:PwREDDMFZBfHrZitaSN3ftiaOXziJD+QzMm1RBoBVtYHqgx:PwREW1EN3FMi9+Q4m1PQKq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883452, "uuid": "76044b00-9f3c-420e-80ca-c854ec5ff582", "value": 2241544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883452, "uuid": "a370b6d3-c90b-408b-a252-5901e2a073c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883452, "uuid": "7670dac5-f988-4156-a80e-2c575879d01d", "value": "cfvbtsetup (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f36145f-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869130, "uuid": "53277193-c146-4e50-abb3-efb2e965d819", "comment": "Malware payload (LummaStealer)", "value": "87a47a76f6fa81e316f77d1fbe07eef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869130, "uuid": "2974c16e-b214-4c88-b2a4-69afc0358875", "comment": "Malware payload (LummaStealer)", "value": "bf1afeb9f9662c5811556d7e3157d9225657e10573d44fee67c332acfbfc326c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869130, "uuid": "549194ae-c5f4-4b51-95cc-0e768abf73da", "comment": "Malware payload (LummaStealer)", "value": "e3455675f40783b67207aa37f5380493e54c4f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869130, "uuid": "a3bb2447-2a3c-4ff3-9a2a-1a43c7cea936", "comment": "Malware payload (LummaStealer)", "value": "953b87ac0dcfe3182531d7f84c5c52bf446261fce4344f45f844e86f5e7eca9df89f0446352477b627e8d662850583bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869130, "uuid": "1b7b00b6-f0d9-4b68-ba8f-2c2a75d723c4", "value": "T1D1F4DF46BC92D0B3EE1628B15928E7C51D6B6B204F2085FB7BDC9D646FB36E14832317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869130, "uuid": "865a5cc2-c626-4660-a456-cc241ade1ca1", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869130, "uuid": "2345e35c-2769-413c-a7f4-2d7b99d7d9d4", "value": "12288:DIJQ/s2kiatVPnIpbWiJ621POPAANU/FIuETl5qGlsecGHaRsuAVHETqpVEe1h3N:MBnIpnJhdQAANeStTTlkG6FDmpdQAzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869130, "uuid": "d0faf13b-5259-4942-9ae6-22a26f2e4b2e", "value": 784192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869130, "uuid": "e3997593-0231-4e4e-9568-c58e965fd395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869130, "uuid": "22589b23-dc13-4ecc-a9a7-3b8dcf1a882b", "value": "SoftWare.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cd7902-0022-11f0-ad17-42010a9c0004", "comment": "Malware payload (Copybara)", "timestamp": 1741881065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881065, "uuid": "12848789-62e9-49e9-aa1a-dd663150f44c", "comment": "Malware payload (Copybara)", "value": "161ef0a9926aee92989605fd0d46eba8", "object_relation": "md5", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881065, "uuid": "92c5060b-4fe8-4bfc-bf72-5c2da65e1d25", "comment": "Malware payload (Copybara)", "value": "bf56b2f45649c5aa8dc8195364af66277171398ba642330e44c67239c3fef52b", "object_relation": "sha256", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881065, "uuid": "518283e1-0d15-4bab-8ce6-345829ebeebb", "comment": "Malware payload (Copybara)", "value": "51aa7ea5bf1ed3a60abd1cafb57e221f8428d945", "object_relation": "sha1", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881065, "uuid": "e10695bf-e5aa-4324-b513-c56e50f242e7", "comment": "Malware payload (Copybara)", "value": "8682803f0f52763a2c0127104af987d2f8102916297521fceabdb390955195aea2d183e6a3da674d553c44f5f69bbf65", "object_relation": "sha3-384", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881065, "uuid": "e63c85ec-7fab-47e7-b4b4-d1b1186192f3", "value": "T1C7C6332BEBA5E51FD4F30B3E0436054A5DB6C436CBE3C14BAC71E678189B6D58B846E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881065, "uuid": "354bccf3-a3b3-4cd0-a6f7-7428caef0fd3", "value": "196608:CO4iFsCkXfJvDA88HlBHg63ygchjMxcLpuLqp8IwcFyWkW2a9L+IuCRGLABOS7K/:Xy13aHgkEjhumqYZkJu+IrGLKgHAsDuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881065, "uuid": "88a31106-f30d-45ea-a8f8-02c642b5b403", "value": 12162952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881065, "uuid": "3fb4b7aa-b981-4cc9-ad06-65cf02110a96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881065, "uuid": "75930702-9ab3-40b8-a762-235c0fbd275e", "value": "bf56b2f45649c5aa8dc8195364af66277171398ba642330e44c67239c3fef52b.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cc01dc-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741873188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873188, "uuid": "b4e244a7-7c49-4bfc-afcf-937dbba26d25", "comment": "Malware payload (LummaStealer)", "value": "1f8a2a63c0b5424a105d5a0eceb3d057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873188, "uuid": "7c0fe6cd-567e-47f0-83d6-95329ebb4eb2", "comment": "Malware payload (LummaStealer)", "value": "bfd127621e78e460668bf0828fa9035d8883a4767077cfea6a913223eb218511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873188, "uuid": "369ed478-721b-4639-8024-15cba1c0eb9d", "comment": "Malware payload (LummaStealer)", "value": "9073eb82302a7a7b6d19d26a3c27e79696457087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873188, "uuid": "98418652-1409-4cba-ac65-01ddc84712a0", "comment": "Malware payload (LummaStealer)", "value": "fc02165bd369dbae6ca4e05d49712e361e0e453981e7981efb49b2c9d1cf449d70f732be2dfa8b004bbe373e0bc1f452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873188, "uuid": "3ee8f6b1-408e-43b4-8926-3936d290d238", "value": "T11155330270B53AA0E9DD1D376205BFCF3983251413A1AEB34F749A74F3AA5EF80546E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873188, "uuid": "eb2c178d-94d8-47be-8e10-e98ced8220d2", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873188, "uuid": "6efe77ab-4e5e-46ea-b9b1-028c0bf57281", "value": "24576:JwPH22l5mJ6LWU+Yx+90LEZeG2p15JS0Uw9Mbanps6GJDzSfWPgBkyHZCwC:YDl5A9YE9Tsp1nD39MbapsrXngBDZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741873188, "uuid": "337b9e74-763a-40fd-bd38-d91dcb7b8696", "value": 1311744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741873188, "uuid": "975cddaf-726d-4bdb-aab5-2158567fbe37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873188, "uuid": "09fa42b8-8df1-4cb2-b3f3-247cc7f1276a", "value": "awkthjjawdtrh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf58ee5-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (Vidar)", "timestamp": 1741873208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873208, "uuid": "077a2eae-4377-45ad-89da-40be0fa8e039", "comment": "Malware payload (Vidar)", "value": "20beeeadd1cfac0bb5bda17172f1359f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873208, "uuid": "d03feaeb-5a0e-4f24-aa63-5b3a61017fc7", "comment": "Malware payload (Vidar)", "value": "c008a013fe6de93e4e83f0ce98098130fc16cecbf15c5e15438a8ccc47ceec69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873208, "uuid": "0c37a48e-f6dd-4b7a-94d3-95fb5118a703", "comment": "Malware payload (Vidar)", "value": "fa2ca39b5e4f273d6017cb731086ce0e81af221c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873208, "uuid": "59631262-ad95-49e8-ab78-c89b34779c83", "comment": "Malware payload (Vidar)", "value": "5e252a355b90d6f4d11e1ac8d1295f57f1c72d108ae7edbeb98b641b57307a39b572c6e18e66e9b6d40b196655a7d657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873208, "uuid": "4ec40c02-88d3-4f73-86db-e14f64334ded", "value": "T135D37C117282A0B1E8472B741E7F77BDEEB04E256B908ACBD3C47D598F191E52371C19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873208, "uuid": "9f9800d4-3c21-4b48-92c1-d65b4ce6ba5e", "value": "351fbae162a7dacb0ecda3be35f09973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873208, "uuid": "fee05df0-a42d-4569-ae7c-9bedb78f4548", "value": "3072:aVvH8RuVrLyEj/S2CUGACcceJd/klDHa/R8mxu3s8Q9yu:KH8RuRLlzgUd6a/Asl9yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741873208, "uuid": "8ddea89b-12e0-4773-9e08-c7bddc7e0d81", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741873208, "uuid": "db4a09bf-4084-4b57-b3b3-e00b19135b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873208, "uuid": "60e4f640-4966-41e6-8340-2184ecf3b486", "value": "ngbtiladkrthgad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7253cd15-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825004, "uuid": "344ceb13-be01-4cf3-bff5-8f43d75b1fff", "comment": "Malware payload (Prometei)", "value": "2b819d5766f2d67cdc67a84afc576e29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825004, "uuid": "7ef6b432-8544-45e7-a743-544b3c47d21c", "comment": "Malware payload (Prometei)", "value": "c0c99c38c1a6a5a734f4edaf9594867d6973ec8a64d12e2511081b485c677d96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825004, "uuid": "c48cdd0e-7b03-4b98-97ed-c3ed22871d19", "comment": "Malware payload (Prometei)", "value": "caf7c841e5231fed8b9f266372d7deefec7560e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825004, "uuid": "b403b2bb-77be-47f9-abba-5b2cba276343", "comment": "Malware payload (Prometei)", "value": "2667b754824819c3827c51163f7e7ab67245007137897d98599d73f5f2cce743f8b7f87ea47af88ea33ad4fce501cc00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825004, "uuid": "516397f4-fe9f-4ad0-90ea-4ca0a91177f8", "value": "T15E155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825004, "uuid": "e1e83dde-bc0d-421e-b9f0-7cfc0e21675b", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplL:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825004, "uuid": "c434fe9f-f2ee-4b87-870e-5644236c4d22", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825004, "uuid": "5e4eda71-495a-4f47-b6c2-3c16330b3621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825004, "uuid": "1bacb2d6-9a69-493f-bbab-548b374a7ae4", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb229ecc-000c-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741871593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871593, "uuid": "24c783ca-8bbc-4f85-a523-767c1d7f9e25", "comment": "Malware payload", "value": "15536a72eff4d9c8ee4311fc6d93f026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871593, "uuid": "1d5f0c6b-ed29-4e80-85fa-e3af4a72ca6d", "comment": "Malware payload", "value": "c10becdbffea8323ad5acff51f7b7de4ddb9460b3710d4e30684202a63a96e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871593, "uuid": "bed7a69b-f4d0-4517-a8f3-e62cb42ca439", "comment": "Malware payload", "value": "e2ea81aec2b8c96ff820b06fb018f9c55f535ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871593, "uuid": "67a3adcb-976f-40b0-a7d5-17b9587a4d55", "comment": "Malware payload", "value": "250ae3a356b082775a7a155f2e0e318ca9dc119961dbcba41762288a201ac181b15a8b2cb7c8baf4833d8ba8599f65e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871593, "uuid": "55abd6fb-f0fb-4f2a-ab80-aea4bbf66c6c", "value": "T18D95B043B28E02DDD457D638816B861FD779300D1B311BEB6AAD6E34EB136C86E3A315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871593, "uuid": "7f753b5f-3386-47f6-b3af-e6cec5ef947c", "value": "94d3fb7a8f8b5251d3abc0395a75ff9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871593, "uuid": "c2ec98a1-f6e5-4d40-ab75-3b98f8bb3d4d", "value": "49152:LL9Vqt2cl5GV1v6rSoaXOxAf+0lEqGae5Qns:K+MreXVfN5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741871593, "uuid": "de8460d0-c24f-46c0-8e23-4bd911a56cf4", "value": 2021888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741871593, "uuid": "ce862921-4efc-4c31-b059-76fcf9a73ad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871593, "uuid": "a9056cb6-a882-4fb7-a193-82c49b21c7d7", "value": "SecuriteInfo.com.Variant.Lazy.637779.2199.1764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b480ddda-0064-11f0-ad17-42010a9c0004", "comment": "Malware payload (RedLineStealer)", "timestamp": 1741909297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909297, "uuid": "8f728138-de02-4972-9887-3770f9b5fa4f", "comment": "Malware payload (RedLineStealer)", "value": "2888f09527270a001e069c9a6e1c72b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909297, "uuid": "826ae068-5ede-455d-a183-947632424e5a", "comment": "Malware payload (RedLineStealer)", "value": "c21aa7be1ee9b32dd1d19f84b901f7bcd410584e89b570051a9603e547158d42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909297, "uuid": "c7f18d8d-c25e-43fe-996d-5ae84cfc81d8", "comment": "Malware payload (RedLineStealer)", "value": "b35bda59573f498892ce62e527b3646ef095fa0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909297, "uuid": "d85b1cf9-849e-4619-a0cf-fc46f9a1cbd5", "comment": "Malware payload (RedLineStealer)", "value": "e931fa3a25f15a3f681257ef384a4c50464ae192c53e58ca36416bcbd8487addfe4128672b06c5fb949be1d6f427a4e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909297, "uuid": "dfea5cd3-98e8-46fa-babd-5bf35051bd89", "value": "T14886331673D88192C7DA87BED1E21B84E7F0B5126B03D39B66BD4AB62D133E04E15363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909297, "uuid": "5ba57fb8-dd66-437d-8e22-181888b0a8aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909297, "uuid": "22df4d50-74ca-49c5-bafc-9a9fd74d433a", "value": "98304:eo1aiQ5+ci9GC4bFs/vBRAwQTtAitvZ97ZLq40367JwYTYqK7bV9iQ:VwiUst/vBRWTWith9dzVwYE9Z9iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741909297, "uuid": "11e92065-3cb2-4ad0-b9b8-a7735ac087c4", "value": 8040640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741909297, "uuid": "c3906c7c-2548-484c-a45a-e4e3ba2d3fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909297, "uuid": "6283986e-a8c0-4374-bf8d-e2d0a92a94a9", "value": "NiggaExecutor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5e1ab6-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825025, "uuid": "71a47c6a-9948-4ae6-aa73-f936bda98ef4", "comment": "Malware payload (Prometei)", "value": "eca597f8e2a88063762c41923875deda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825025, "uuid": "262a22cf-508b-41d0-842e-e4a70db528ba", "comment": "Malware payload (Prometei)", "value": "c2e06cdccdb606505e3f66ae68c315f6c2557847feb4939fd34f83f79449992c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825025, "uuid": "9e17fa80-63f4-4471-a0ec-9f6cb03ccb4d", "comment": "Malware payload (Prometei)", "value": "ddab95d3f0d44e2f92dbb1a86ee12b36b7f31ee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825025, "uuid": "d2993897-50ef-4556-b584-f758e8418c46", "comment": "Malware payload (Prometei)", "value": "6e6f9207ccff6411faf4137f376b4391d811edc262ba0d03a4847ebc0fc9105ec25cce04e57734c34a86cb8116fa24c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825025, "uuid": "2fd54646-f26c-43bd-9373-964825f48bd7", "value": "T1319423F8C87D2E3098169B3CBB1A826CF0A15772D9562B6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825025, "uuid": "e0801c16-67ba-450a-b2f3-955f17459e44", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgz:25WOSACZSV6eKRH5EPiamb4DsDwwcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825025, "uuid": "6fcf6e28-be5f-473d-aacc-15a1d2a89779", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825025, "uuid": "abeda4cb-8579-468c-9aef-cd5e2872a6fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825025, "uuid": "6a408ebe-b6c7-4dc6-bde8-012c2b5301d7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79ac53f-ffc8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741842408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842408, "uuid": "43738fe1-2fbc-445c-bddf-5307951c19d7", "comment": "Malware payload (Prometei)", "value": "f6f102356578ee9f3241780d0479b562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842408, "uuid": "dcc0bb2e-f20b-41e2-bfcc-740940abf228", "comment": "Malware payload (Prometei)", "value": "c343991aa8cbfd0a8fecebb4f15665869411ddbc11a6e7691750209e913788b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842408, "uuid": "84cc62d4-a5ef-4ea4-a822-0bef7b48f4f7", "comment": "Malware payload (Prometei)", "value": "8d8fa34f29136ae5398ecb479c05b675497fc8b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842408, "uuid": "b4ff0358-c188-4da0-af76-e8dfe596a500", "comment": "Malware payload (Prometei)", "value": "150d5103c81fa22160511dfd11f0c8db1914126cad6170927259c17a138165c21965df15b0af09c05ac3910e6d0e6279", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842408, "uuid": "8f6aae6b-7e23-41e6-9caa-d7c6fe3ffd34", "value": "T1D59423F8C87D2E30D8169B3CBB1A8268F0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842408, "uuid": "19b99f2a-07e5-4ca2-9239-b98068758ad3", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg/:25WOSACZSV6eKRH5EPiamb4DsDwwcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741842408, "uuid": "c64113f3-6538-49e9-9b01-82f18be4a997", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741842408, "uuid": "3d473ee0-721c-48c1-afd4-5f969da5048e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842408, "uuid": "47b1f165-3e98-44a3-aba0-a37c8134965e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e7eab8-ffda-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741849785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849785, "uuid": "a2f722d4-72f9-4e4b-a8a9-541f1ca8b4dc", "comment": "Malware payload (Formbook)", "value": "f71fe2f5fe1ed977af4ce373c5a1f0cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849785, "uuid": "b4dd0f70-f071-48b8-9c05-8e09f87f7c18", "comment": "Malware payload (Formbook)", "value": "c3470c40815a22673db74a77c2fa1a93c641e4e0236215166c288155b978539f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849785, "uuid": "e3d2fc17-949d-49bd-83de-631e281d40d7", "comment": "Malware payload (Formbook)", "value": "f24f7b4998ff7f9c05b8d8e95c573f6443d4b9c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849785, "uuid": "c7ee4c64-1a83-4e09-ae5e-4028ef931d9a", "comment": "Malware payload (Formbook)", "value": "9a65d1b9cb92a4ec2b33cd2341478d1a75b79c5af43093b75ae64800bb4e3336ab7ae446b1163196c51513b6c4837a4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849785, "uuid": "4fffa101-8d98-4fdb-a495-98e781989c3e", "value": "T16045CF2273DDC360CB769173BF6AB7016EBF78654630B85B2F880D3DA950161262D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849785, "uuid": "6f118903-dfe8-4163-ab64-c2523f59b3f8", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849785, "uuid": "4b719b25-5f2f-4e9c-81f3-298101e4a760", "value": "24576:CCdxte/80jYLT3U1jfsWax+38+rmg3C3AqpBG+5Q:Tw80cTsjkWax+s+ig3C3AnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849785, "uuid": "71e7b54c-def8-40fe-b603-9f3b5ec71aff", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849785, "uuid": "4cab0f08-f0a3-4d8e-bdf4-e61fd1acd769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849785, "uuid": "77e03835-5b92-4ffc-9d2d-b035ccd521e9", "value": "ORIGINAL INVOICE COAU7230734290 1055272307342901_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73de424b-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825007, "uuid": "82bbf23b-da99-4db3-a1db-d4033a6b3033", "comment": "Malware payload (Prometei)", "value": "3dde480201c1d32b4c9d4be4dae0e3d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825007, "uuid": "65bde515-e0cc-4293-8c50-35f17e673641", "comment": "Malware payload (Prometei)", "value": "c39311be668f1760661ad9911b7b3d6d33c74fede602a08c2c58bf603a48d1ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825007, "uuid": "332efb46-d528-4517-9e35-51b09dda0919", "comment": "Malware payload (Prometei)", "value": "ba53cfdf8a69edaf7b4be472a03ca7b11d57baa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825007, "uuid": "d1ae4b66-0f2a-491e-85b0-869d2803ade9", "comment": "Malware payload (Prometei)", "value": "95085116be27cf6da08bc8fc87eded92d3b981ed9bc9c185ab7603a42fc5866fa69774ba09f7d18d3fbba7c4199bfb4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825007, "uuid": "e2cd74e4-96bb-4479-aa5a-ad4d0182b688", "value": "T1C79423F8C87D2E30D8169F3CBB1A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825007, "uuid": "617f9ad7-3a61-4f9d-8f66-7b6f419c6ded", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg8:25WOSACZSV6eKRH5EPiamb4DsDwwcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825007, "uuid": "d0aee2df-4c3e-4702-b2be-b15383de0f47", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825007, "uuid": "c94d8600-acbd-4223-9b07-01109253be1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825007, "uuid": "5af69d55-742c-468a-ac7e-d314f2208f11", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361e7093-ffee-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741858404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858404, "uuid": "9abebd38-0a1c-47eb-b98f-c3f8ca60b469", "comment": "Malware payload (Formbook)", "value": "06ecc7856765f14403800d93005889bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858404, "uuid": "e35d85a2-74dd-48bd-8b79-2e11ff1a1147", "comment": "Malware payload (Formbook)", "value": "c3a8f04e93b504cd421c50473b136c2de2bbceb9a2469e84d89cf29d75fb7680", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858404, "uuid": "727ec177-f83e-4775-bf19-277796bb82ae", "comment": "Malware payload (Formbook)", "value": "7bea746b7dec0bba74d619a260b6de9603a86b05", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741858404, "uuid": "78146e94-052c-4ae7-9da0-39a53ec780f7", "comment": "Malware payload (Formbook)", "value": "de9cf6b5b0ea25294c70ff7519e585d82176129064c84cd13f41f69ec94c72ef67c17f5c917b91d394cfde8c8e8e7b37", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858404, "uuid": "3adbcb14-5592-45a0-b7f1-93b3fc8182ab", "value": "T19BC4235345F2A2D14B6778ECAF09A0E7FF9CF43C48A1184FCCBA9269945F1B58092E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858404, "uuid": "560b53bc-a8a2-4b5a-987a-5f5352f00a8b", "value": "12288:dtcCfR0uaFZtoo+3hTsdL7XQt3wsJylmCPWgVYs7hxgD:vdfRKwtxWI34P3Ys9mD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741858404, "uuid": "30d8e7a4-e2f0-46c1-8542-d5636a0e4c46", "value": 570059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741858404, "uuid": "31939343-80bc-4023-ba19-bbf00eb7e568", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741858404, "uuid": "8a299532-cba1-413c-81d8-8fd5fa8787c9", "value": "TT-RECEIPT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73895390-002f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741886425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886425, "uuid": "82a5b869-1434-467d-8a7b-bcf2c0bf0b5a", "comment": "Malware payload", "value": "7c2154de5495bc7ab17dd077f6f19de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886425, "uuid": "2f189491-f7ea-43d4-98f1-43b00a6745c3", "comment": "Malware payload", "value": "c42ef0f1a12e6ac63dbf794bb9d90b641a0acb0d3f01c5c30e7effaf87a6d76c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886425, "uuid": "5de6eef6-096c-445e-9107-da2828b1823e", "comment": "Malware payload", "value": "011179ab276c25c44abeeb14afa821a030e72587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886425, "uuid": "d227f776-affb-4978-8e29-d7798319b96d", "comment": "Malware payload", "value": "d8cb83f1680f5880eb05db48a6a0f5e1cc23d78adbd3238638f3507a4248a2376b98f2376112cbbf22bf4ade28d9f0db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886425, "uuid": "d00c69f7-6459-415b-b545-b086e7e02385", "value": "T1BAF36C1176C18072EA77193198F8DBB55E3EF8310F316AEB638407BA8F205D19735A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886425, "uuid": "9d2a92c9-88af-460c-82b8-4c795112e2cd", "value": "240c731639a477f85d9533f6045d282a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886425, "uuid": "19ccd8f7-67ca-42b2-8009-e2d68a1d3c11", "value": "3072:5LARjsG5/gqnX/B2AjgNJjRcEWXxfx6v/HUuGBTTthgqY5D:mjhpnX/BXg/jaxYHa+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741886425, "uuid": "cef81a56-fef5-4781-98dc-b52e721c4636", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741886425, "uuid": "6d1a5655-7817-49dc-b61f-1ecb732b7d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886425, "uuid": "f315cdc0-fc70-41f0-a822-777432876fc4", "value": "RBX MONEY GEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10dc46e-ffea-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741856946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856946, "uuid": "8ec44e6f-f7a7-4143-bdbc-f36e45f13ef8", "comment": "Malware payload (LummaStealer)", "value": "36ecbd776704a4884f9978275e1bd271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856946, "uuid": "61b2ca5f-84c2-46bd-b218-cbb3afc749de", "comment": "Malware payload (LummaStealer)", "value": "c44547f8c9abb1ab6b9284ef25f65605f36f2ac7fbe6d93f707e65ce77dcd008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856946, "uuid": "cf19ab27-cb0b-466c-9523-9c89b29c2609", "comment": "Malware payload (LummaStealer)", "value": "1f260011f2abf7b9e53b98bf29d2f29a41af5e6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856946, "uuid": "396004c9-d76c-4043-8895-fee1c3d2add2", "comment": "Malware payload (LummaStealer)", "value": "3693a3648f520967fc84b06262e1242ffe9377d93a0a09900c8cfa91498f80926943628a702ef18baee3df037150b632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856946, "uuid": "a425b7c1-124a-4f59-962e-7c9f3f201fbb", "value": "T1F9F4D046BDA2D0A3E91628B14D28E7C50C6B6B244F3084F7BEDC9E646FB36E14532357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856946, "uuid": "6f2859c5-09b4-473b-8ecc-0183274f0eda", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856946, "uuid": "8550ea4d-e241-44c9-8cc4-ed6c3138bd36", "value": "12288:6IJQ/s2kiatVPnIpbWiJ621POPAANU//6dkOCVPjsSMMXNb7cnFgeadvEAfSO9uR:HBnIpnJhdQAANeShCV7svMXNAgMQufJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856946, "uuid": "f33cc0ba-b53d-4d9b-b799-17b712c85a64", "value": 778560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856946, "uuid": "11fe1930-4d51-470b-8a2b-1c3a967a494e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856946, "uuid": "64340f18-9b47-48f2-abf4-3bce462ed7e7", "value": "Galaxy Swapper v2.0.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c834e7-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883236, "uuid": "108f52a9-7e56-4df6-9694-5a2d1a0ac1b1", "comment": "Malware payload", "value": "be7aab72922732cedaec89c1fa0f2b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883236, "uuid": "d41c4955-3ead-4ee7-a7de-f9967e1c87fe", "comment": "Malware payload", "value": "c4794509df99b09e248cedd061c068a0a4c4427c621d06dc1bef7b7acafc93a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883236, "uuid": "e4ecad34-8c20-41df-a46e-bebcde5301d5", "comment": "Malware payload", "value": "a6bd7e4814c2cd38fdec4d6ba76fdb876ebe76e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883236, "uuid": "af3257e8-2462-441a-8fcc-c36aa35798b1", "comment": "Malware payload", "value": "7672c7b3801746d693bae85f7e1639e84f0e3ea5c23a14a44b3fe9d0a4b6a835739f107d44b7d339f7dc001c7f1fddfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883236, "uuid": "de1dfc94-9bb3-4051-b64f-5957e0d48f9b", "value": "T169A5D013F2CBE03EE45E0B3B05B2A25494FB6A616422BD5796ECB4ACCF351601D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883236, "uuid": "bf15875e-ea4c-4de4-a4a0-5389c9390947", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883236, "uuid": "8505cf55-f255-444b-b359-9e0ecc135a66", "value": "49152:SwREDDMsUU/G+U6n3ftiaOXziJD+QzMm1RBoBVtYHqgy:SwREB/G+U6n3FMi9+Q4m1PQKqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883236, "uuid": "c87b299c-f256-49ca-8192-7a48c4d1b8b2", "value": 2242024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883236, "uuid": "13c6715f-0c83-44f3-ab02-e74dec9be194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883236, "uuid": "47ecf997-dc1b-413a-8856-7737517b69c8", "value": "cdpsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06eef49-ffe2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741853509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853509, "uuid": "bbed0f1a-1b41-441c-bd0d-1c34a91fee1c", "comment": "Malware payload (Prometei)", "value": "be46d15d4810102d81a46c20ae051a51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853509, "uuid": "2b29315d-248c-457c-a785-c0797ba0c8f7", "comment": "Malware payload (Prometei)", "value": "c4a7fadf980c87dd197340399dd827405f72818929766a364d99f8d1df423aae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853509, "uuid": "0781bfc8-4e3b-4973-901e-0ea919b36050", "comment": "Malware payload (Prometei)", "value": "84fa9dda4b18cf46da0a05ed1b0c5aee2fe79be8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853509, "uuid": "689803e3-552a-4904-8545-8a32f4d03e71", "comment": "Malware payload (Prometei)", "value": "7362ffa29c9f8374e6196f3ad9a7d32a4597e9b747674b0a49e17560407a2e714d7ade48c9687e6243899e69765cc7a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853509, "uuid": "b55191f6-b140-4904-977d-eddcea8cf929", "value": "T1B29423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853509, "uuid": "78ec6aee-e335-4165-9223-a8b95101e6b6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgo:25WOSACZSV6eKRH5EPiamb4DsDwwcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741853509, "uuid": "4effc3fb-5ab0-4a64-8613-8f731e6ffcaa", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741853509, "uuid": "bac12536-a1a3-43df-95bd-cd74c3eab2b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853509, "uuid": "ff4a4e3f-9231-485c-8f7e-3d30ed0124f1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cb736d-ffff-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741865725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865725, "uuid": "2a9e4a68-7ede-4146-8fda-fec80553a970", "comment": "Malware payload (Mirai)", "value": "cc7776a8e54315c76e7c897d764791fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865725, "uuid": "f87c9c53-6500-4c75-9536-72537062c961", "comment": "Malware payload (Mirai)", "value": "c50887430ac9522eaa5cb26bbe04a2c331b5df5c7da31d5c152698cb1293db6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865725, "uuid": "aa3fb37f-29a9-4908-885f-f486489fa1b6", "comment": "Malware payload (Mirai)", "value": "c597bc48c16a2fc016c5f9d458877b0e30821ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865725, "uuid": "d6a5618d-1cf5-46e0-8210-fb079b40ec62", "comment": "Malware payload (Mirai)", "value": "b9bf6f31491c0f483d49dd4e75fdbe7121f281984f97411a379e2d3d678f1305932d1b0881e5a8de89745c4a3741ae4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865725, "uuid": "b2ad338a-040b-4b82-9889-861ea909a001", "value": "T14953E8C57841B639C3C15777EE5F014E33489798E0EA335288291BE4BB8BD5F0D6AB4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865725, "uuid": "b6044e67-8e57-4fe5-9b1f-7515eb2868e9", "value": "1536:ZyI1wOenT0KEeZFIgp1KMPyShWdK57aeni:ZyOwFYw+gmMPfuK5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741865725, "uuid": "7d1c14e2-5504-46d4-b1a0-971644c69f81", "value": 66372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741865725, "uuid": "0a55f34c-72d2-4523-8a6a-6d05b6bc1fd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865725, "uuid": "8b06ace7-2c58-4591-ac83-1705af8d3b1f", "value": "Owari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f24c601-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741824999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824999, "uuid": "0e059990-6e6d-4fc2-8c94-9546db7dfac4", "comment": "Malware payload (Mirai)", "value": "cf8ea76f0f976278aa11ec95e17d0383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824999, "uuid": "d3a628ce-8573-4444-9100-5e94ade98a42", "comment": "Malware payload (Mirai)", "value": "c5765582ee0111b25e7f410a8008334a248720a3a8e4fd46e81abd4350addb3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824999, "uuid": "9ca074e8-2914-4c44-9500-7a7b1102e6d2", "comment": "Malware payload (Mirai)", "value": "d301c23c5465cf9e934097f33ab7d5f0a31b6b07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824999, "uuid": "001c2433-2ffc-453f-8932-aac4963394d1", "comment": "Malware payload (Mirai)", "value": "cc190f5d1b430eddb9c7fc6c401052e8f6974817fa3a7013c1e362fee75b66bff8dd1d229a74a4bc3bc37b4238fad7f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824999, "uuid": "aa7e8541-421f-437a-8455-e6f982b0db13", "value": "T1585302D01B75178C5671E87539DE306F8124522F329A29102DA791CEFC1B21396B7EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824999, "uuid": "88be34f3-10ef-4ba0-9d46-a5c0bd149546", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtE:8D+CAXFYQChaAUk5ljnQsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824999, "uuid": "1c21554f-8e45-4092-9e85-2e8d6baf76e6", "value": 65340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824999, "uuid": "479a4d7a-8cad-4f8a-96d9-f52b322d5738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824999, "uuid": "b49f3c24-20cd-4dcc-bbc0-58799332eb1d", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7a05b3-002e-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741886144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886144, "uuid": "1f465d8a-2879-4977-a98b-c83933ee937a", "comment": "Malware payload (AsyncRAT)", "value": "e00ffc3924f28f8a9e57e63378b56a70", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886144, "uuid": "f0968d33-b2b7-4cef-9cc1-ffe18554c2a1", "comment": "Malware payload (AsyncRAT)", "value": "c5924d4a2e24ecfd49a08643236d261fd375dce90f61b0b1b5de6e3d8f971d1e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886144, "uuid": "7c97f811-2b2f-4fd1-bce0-622545b13694", "comment": "Malware payload (AsyncRAT)", "value": "4750e39aef5da208fc29cbbd0772622f1d4f9d76", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886144, "uuid": "0892ac96-6c2e-4470-8776-8aa86e34fb6c", "comment": "Malware payload (AsyncRAT)", "value": "c1538a2704ff5ee702da3786d0df1a98a3cb0117289296bd04c87752eb4f92b9befee2971aace90b1c62a496a1ebc208", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886144, "uuid": "a7ced3c2-9a7f-4095-ad7d-3b5ead7bea04", "value": "T1D7F22B4877D14325D6ED6FF56AB3A1120679F6179923EB5E0CD884DA2B337C286023E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886144, "uuid": "efd29ccb-60e2-455b-b81b-509f532dd4f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886144, "uuid": "45f7d281-b590-4566-8dcd-89d55fbdd722", "value": "768:6Hs7Dzumj2frksy1TxVP/sVFyw9bki4O/hMyEA:6M7DzumnpbKFr9bkZO/uRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741886144, "uuid": "1f1bec5e-0293-46ef-a9a7-0fa805cfa748", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741886144, "uuid": "79b2e41a-eb6d-4d8c-8d8d-c0acef65e488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886144, "uuid": "410caccc-6993-4fa0-bafd-6aa6719b3fab", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c435634-0045-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895808, "uuid": "cf8ee3f8-a1cd-403f-9539-e7b39af977ae", "comment": "Malware payload", "value": "eb3e7f745d2d490e8075ccd653a0882d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895808, "uuid": "668d2e1d-26b8-458c-b80f-bc8148df8fb6", "comment": "Malware payload", "value": "c5ada9381f7fd387ac7b92e009ab3b6c1d5fcbba2ad3a118f31c1ee9ca3c3dbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895808, "uuid": "98916a47-d900-4a2f-a14e-785ccf2cab06", "comment": "Malware payload", "value": "f588bf67c517ab48c2379d1f3391684017b6e592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895808, "uuid": "45baab1e-3452-4230-884b-562f3ae56828", "comment": "Malware payload", "value": "aeb07f7e1a6c5c5ed04e7a655eba57ad325281f6b2c0e2a2b878944c6c2363f1c7b81c50e49a0e8b1392c140f4cf163b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895808, "uuid": "040dd3ab-bc5f-4aad-bbe0-36e7d5fa93eb", "value": "T1A00833031D440196E88D4AFFC47E3DAB009F58AADB530DD2A0DC06D91458A1EEAEF77E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895808, "uuid": "749b2653-6230-48a6-bc4b-d573b092a50a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895808, "uuid": "00dd2e83-e6d2-49c8-ab2e-938f26c1e802", "value": "1572864:nr9mj0JZ4WaRnMy5LcyYLtC/tatkmIm+iP/kaISwl/vqOYqJc1zcn:rEYJZ4WgD5Qw/W0m+iPMNS6vokclcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895808, "uuid": "09d84f95-ec37-404e-b5cf-25cd449cb741", "value": 78965856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895808, "uuid": "662d9c8c-314d-422b-b3ba-cc3149967119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895808, "uuid": "8b08af93-ec70-40c6-912e-250fcb4fd596", "value": "GenerAI_Installer_1.3.7_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837c3161-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825033, "uuid": "ff36541f-5f98-4edd-99e7-a854bdb8d838", "comment": "Malware payload (Mirai)", "value": "d835219cdef596402376a081285a71ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825033, "uuid": "51817903-bf6c-4700-a3a1-b3da1536e999", "comment": "Malware payload (Mirai)", "value": "c612119c1e8765e2510f06074e67a6e149babe7b3c8815c1822177588bd1d2c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825033, "uuid": "de346139-d5c5-4f86-949d-f8f6a4849537", "comment": "Malware payload (Mirai)", "value": "dfb6391c629d2e456d956f6fc0788d88bf743c36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825033, "uuid": "6812c0c7-86f6-44fc-a1cb-a766375d781c", "comment": "Malware payload (Mirai)", "value": "b6bcf154a022be5c00e2a7fbb98a18ad16575712fd1cb1c58d82a6c661cf04ba458afa7186bfdd981b2f997b3602f71d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825033, "uuid": "d95f3433-87ab-4a51-ba87-0dbd7f987ac5", "value": "T10DC34C46EB808A13C4D51775BADF424A3323E755E3DB330689189FB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825033, "uuid": "65c8dc9c-cffe-4663-b825-5c8fa77f506f", "value": "3072:S5EQwczNhDcde9aLKMZgOQ9Zh1C+WLwM/9CWJz:S5lzHD0saLKMZgj9M+WkM/99z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825033, "uuid": "309cc5c9-869a-4a6c-9651-e194bdbf5ff2", "value": 125762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825033, "uuid": "6a0587e4-8b80-46e4-b167-7f74a94dbd2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825033, "uuid": "848be357-d139-4813-9508-0f1319b77dee", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb9e061-ffac-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830396, "uuid": "13853dc1-a44b-45f5-b0e2-fa0fd740edbb", "comment": "Malware payload (Mirai)", "value": "3dc8bff197c89d257ddf82be309ac6f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830396, "uuid": "64aa879f-b52b-4d86-a13c-19ebff72d01d", "comment": "Malware payload (Mirai)", "value": "c633e7ef539a508be85774601453bd3237acf8666720ea688adef8a4f603b7b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830396, "uuid": "7cd5220a-8678-4e80-8e9b-7f663701d09a", "comment": "Malware payload (Mirai)", "value": "e38016cf0399ef204357b756a8fcecb3c2e8fad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830396, "uuid": "1e53e0fa-1600-4430-83e1-5654b585e32d", "comment": "Malware payload (Mirai)", "value": "6f2c5e63817e0199fbad473ac8c11644ec8c686598b8a056d0b187d6e4a30e1cfcd4eee2d2d260a9f943f2ef7f43108c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830396, "uuid": "6626fe7e-bf51-42c1-99cc-c8e94d497123", "value": "T1BC43710ABF650EB7EC6FDD3709A9174524CD651B21A87B3A7D34D81CF20B25B19E38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830396, "uuid": "385ae943-34fb-4d76-9a86-fa1b20552abc", "value": "768:oLWu89xw1IlMGA2ntlOIlEZmNF5obtWp/4iZ92xEqxOwyl2sAR3ej5dIne2el9e2:oLWu8fwuAfkkLg9gzStS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830396, "uuid": "22614e67-cc0c-47fb-8b5b-7b27d5181009", "value": 59220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830396, "uuid": "de7e53ca-bb45-479c-aefb-a468e8fedc40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830396, "uuid": "472bbff4-fe8b-45cd-9ffe-81c53d4b6976", "value": "NewAge3ATOmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b83ac43-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879378, "uuid": "ad9aac9c-280e-48a7-bdad-daf3d7a6394c", "comment": "Malware payload", "value": "dbd46d6a4a15faed18b20be54bf49b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879378, "uuid": "a8104cd9-dd38-4148-a79d-8a18097dd363", "comment": "Malware payload", "value": "c875012919be75070006b3967b7cedf2c5e4f1803d610dcd34ec7cd05aced4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879378, "uuid": "fafd84a0-3ddd-4b8b-9c90-34b9be08fbfb", "comment": "Malware payload", "value": "1d0c6f84cd93ab412d1f6889f2210b6d0302ed6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879378, "uuid": "2f4a5af4-f1e7-4ff1-afe4-53fb4d9f418d", "comment": "Malware payload", "value": "7a83ecb30855000fabc5b495d50c278f89de18d081567a073631af280dc269009694a7323c5043e70fae7bd36a43fcd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879378, "uuid": "c2442be5-8025-4880-8d66-c5b509146281", "value": "T13F96337EE142B8D7C4819B76357CF720EFC5FE83E4B1A1CA558543A142DBB2DB0626A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879378, "uuid": "875e6d79-94f1-4385-a28a-3ff95aa50873", "value": "88150dec1385c6ec9d94004f63b62fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879378, "uuid": "ca7c953e-8c5c-4596-b778-96055b5160eb", "value": "98304:K60IGHpK9SFNGfW1iYleD0HgwGSMh9TlUwEVlGGvdTXmrpjFCE9EbLJs5MM5ZSCw:50HcSnGfklezjzm/DVWdgPZo/54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879378, "uuid": "c9930926-737a-4d75-924a-54aa0c6b91db", "value": 9355264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879378, "uuid": "22030571-ccb1-4916-b649-43320c18ca76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879378, "uuid": "fc1c6754-ad9a-4393-a9c4-ab2b12e6af94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1b2fd4-0003-11f0-ad17-42010a9c0004", "comment": "Malware payload (DarkCloud)", "timestamp": 1741867566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867566, "uuid": "6db75c8a-d5e7-48dd-993d-4389d70e178d", "comment": "Malware payload (DarkCloud)", "value": "be1bc2e263d93ce92b73ca484c5bce9d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867566, "uuid": "98309972-2223-4d17-8ddc-1d3f3e7bdafd", "comment": "Malware payload (DarkCloud)", "value": "c920c6eca469fff5ec81c3e8c92f734190a20f944b63f9d9248a5764afce6aa1", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867566, "uuid": "5a3a0b06-ab5b-4c3d-8c04-c74161f825a5", "comment": "Malware payload (DarkCloud)", "value": "b54ebdcd1a98931c6da2c67c1095625dce4bd313", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741867566, "uuid": "bdf30f73-51bd-48fb-8901-04a694634518", "comment": "Malware payload (DarkCloud)", "value": "d9f7d2a790d03c2874096fb542ae31332e94747650e039362adeab24dfa4d0addffa6fe154a4ca0181eaba8f44b6ebac", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867566, "uuid": "80f3e314-0d9c-4882-a8b9-e7a08cf0d122", "value": "T14C45CF2273DDC361CB669273BF2AB7016EBF7C610630B85B2F980D7DA950161262D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867566, "uuid": "ac356868-f4d3-45ab-9aef-b4e0dae552d2", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867566, "uuid": "980eb711-b6ce-4d2b-b41a-757af582df4d", "value": "24576:Au6J33O0c+JY5UZ+XC0kGso6Faw4KQC8OuCoW9Ukq3K9e25WY:qu0c++OCvkGs9FawNQCoCoNa9e7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741867566, "uuid": "e8868df1-b4f9-4b16-a426-ecf7d852071d", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741867566, "uuid": "be0af3e6-ac69-4966-8488-9bb17f5b619e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741867566, "uuid": "df71dae8-4f5d-45e8-ad47-da77c3bbb351", "value": "COMMERCAILS INVOICE AND DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9237c0-ffa5-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741827384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827384, "uuid": "1c2cc951-257a-4ebe-9fa2-bb9e344200b8", "comment": "Malware payload", "value": "12aa08b391b513b857b99ec17ed87efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827384, "uuid": "176d2061-38a7-4a20-bf14-03d2e0ea9456", "comment": "Malware payload", "value": "ca0d826474de55e38e85ded843feddf433df74c9f2691fda4639f2cdd3ee66bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827384, "uuid": "75484db2-a3ed-4938-b3ce-795d1665248b", "comment": "Malware payload", "value": "df8ca0fa10fa756eb43579aa99ac85a79214c1aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827384, "uuid": "9d2029e3-b9a8-4792-bd15-095e4365ad44", "comment": "Malware payload", "value": "0cb7dcaded2af971c67be747fba298fb8369d7f557495ec681585b8a24d93f9cf7460a8566060757d74b6e23bb8f3cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827384, "uuid": "a74c1b47-7d71-4f27-bf75-4fef4a4a2e6a", "value": "T184E58A30ECA18061D7A10076D569EE362D68D5D0472C36FB92D2CBEC19E71DD2B3B26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827384, "uuid": "62926165-982a-433e-8200-8a05188b0f4b", "value": "c1cae4bfd3e6429cf501f04bcf6bdc37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827384, "uuid": "334d0f97-9a56-4312-b305-2f7c750dcde9", "value": "49152:QiLIhIw1qXiMFuDKw9vKpP0TmtDkl+aoM89VJxak1DSPVyQB786m:Q6ef1qXXFuDKw9vwN3Jxak1uMW8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741827384, "uuid": "9a9a773a-e691-4480-8464-8208acef4580", "value": 3209054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741827384, "uuid": "0eff7baa-f752-4b02-b836-8f940926447e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827384, "uuid": "1b4f40bb-34f1-47c6-a23d-4ac6c603e229", "value": "\u3060\u3060\u3082\u308c\u306a\u308f\u3068\u3073\u30e9\u30f3\u30c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a99a1dd-0065-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741909441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909441, "uuid": "6188c319-63ee-464d-a852-05d4bb6d1790", "comment": "Malware payload", "value": "4ec6375438489cad210e68e5075867db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909441, "uuid": "07ae49bf-ebaf-4516-8118-71f0d2245667", "comment": "Malware payload", "value": "ca5726064db991bfa0f2a4dd5d6a9d66baac1c764f5bdf342cb48e94559667c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909441, "uuid": "295c1bcd-feda-4d65-bb1d-b54909afd62a", "comment": "Malware payload", "value": "4c5bee6482c3827a86d5a982b564ee3cd1b80ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741909441, "uuid": "ebeb7d0b-4fbe-4baf-83cd-fcb2e3d09bf1", "comment": "Malware payload", "value": "81d44af6ac91077d8c4a5615da6fac1bfe0c419637f7b64c97139b7df5da83e4805ab71f5e7bf4a431344d805b203cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909441, "uuid": "870816a6-0589-461b-810b-affbe8a491a1", "value": "T1F256AD9C7220B6DFC857D0729EA95C74FA6039BB931B4203D06755EEAA1C8A7CF140F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909441, "uuid": "98c875c0-fe2a-4fe9-9d3e-e41d01cc3eca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909441, "uuid": "fd5cd088-529f-4773-b19d-5251eb41c040", "value": "98304:Cv1LSIM31BhQSNzAFqFDBRRWCvgZE+dxS20V5Q2aXr1sCacCusSF4Zr1hO:mON31BmSNzAFq5DcCoukc20nVdcBhyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741909441, "uuid": "4a7ea738-1859-46c8-8ae9-ae226115589a", "value": 6011904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741909441, "uuid": "d917d677-f44b-4e47-89e8-95cd97737d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741909441, "uuid": "32ee960d-6984-47f0-8213-7505514afbed", "value": "BetaLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c05b30-fff5-11ef-ad17-42010a9c0004", "comment": "Malware payload (XWorm)", "timestamp": 1741861737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861737, "uuid": "5dd1a200-7e80-4e66-a03f-99166c64427f", "comment": "Malware payload (XWorm)", "value": "536dd0cb514d4edc2eb452a1c2b51466", "object_relation": "md5", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861737, "uuid": "7c2e6a8f-79fc-4e03-81de-d03fd7f15e88", "comment": "Malware payload (XWorm)", "value": "cb08ed88dd97692627d9bed9a5201369574a1ef581aa52cadd674b26461b1c9a", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861737, "uuid": "e4123153-fc8c-4ffb-862d-4f0d2f382b90", "comment": "Malware payload (XWorm)", "value": "04db0453b3499beecc89bdb9916edba1d7f682af", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861737, "uuid": "9764efff-f955-4524-87e6-9d8d085b578c", "comment": "Malware payload (XWorm)", "value": "7d6828b4cd85d18cf46c8981c1699797d85a6e38c908a30ca87b7a3ab0d0ec8a32526560f098ac7d47ccc8ebf69f436e", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-116", "colour": "#4B3BF9", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861737, "uuid": "5f5c6dc9-c92c-40c1-9084-9eecaba1296c", "value": "T1AF53F63ECAE4FDC9436B70C0665D3B4A104D1BD3B6765FADFAC20D6518A4285EF3A188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861737, "uuid": "6b7f9f7e-ea7a-4c3a-ac18-2c557167f48d", "value": "1536:85Gd8aRsWP2o6vY/5SAS5aZOZkbmEKUgXEXzICKUnFRV4h9:85S8usWPn+YhSAeaZPHfyh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861737, "uuid": "fa4e9f12-b0a7-44e6-a0ea-df794b4d46a8", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861737, "uuid": "1ddeea1b-e3f6-40c1-b724-8d1a6606510e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861737, "uuid": "6f9a79ed-5839-4208-9117-8440d8050b5d", "value": "road.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9932268-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1741855672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855672, "uuid": "7fcab51a-7960-4afd-9764-bc6a2748679f", "comment": "Malware payload (Cobalt Strike)", "value": "a99780d6d3cf80e86d54a51740a6caf7", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855672, "uuid": "e7bb879d-8cba-41c6-97ae-9f128eda62ad", "comment": "Malware payload (Cobalt Strike)", "value": "cb3c2c17d9bf0e4f936e7389c2c08af0a2f6b1016cf9b394f1808b0387f640e6", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855672, "uuid": "e9a4a0fc-b2ff-45fa-a6c2-1fa91f8002d3", "comment": "Malware payload (Cobalt Strike)", "value": "e523240838b92b98efda178014f3879244dba406", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855672, "uuid": "a7d7c4e0-00c5-434e-aaa5-be3f27ef379a", "comment": "Malware payload (Cobalt Strike)", "value": "ec6a8269c4a37d6b3f8fea469d51bb0c4293ffe0d0ed9811405ee9da333d6e2584ce6a006a8cade66a1f20a20e369563", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855672, "uuid": "86bea453-4789-4d73-aa25-c319586b98d3", "value": "T190C10955E7E40B72DCBB0630ACB353010678F710CD6B9B9F26859E172E623194953725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855672, "uuid": "5d09014c-a62b-411e-8d18-51a10268fbb6", "value": "48:6d+lup08cP51YWMdddCfJNynTSVNMkyQPg/pXF6ngxqDRMbkcrq7/bgPSoJ054tJ:3up0P51or41JSF6ngIDRMWsS4J9ozNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855672, "uuid": "8a320871-5eb0-4338-8307-e6096c095006", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855672, "uuid": "0d35aeb2-920d-4b46-a9b8-ec9c68654c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855672, "uuid": "80f724d5-cae6-4101-b8a0-a73f5fda5c1a", "value": "ConsoleApp3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0245b633-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830400, "uuid": "677539d7-a227-4577-acb7-f019753f274a", "comment": "Malware payload (Mirai)", "value": "7325606f2678ec7802da85cb22812321", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830400, "uuid": "bc120b04-4120-4dcb-a796-05da54307636", "comment": "Malware payload (Mirai)", "value": "cbbbf3d90ad0ce954c3fec166eb31638f1cefd5f093d30dfe983b900488d4617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830400, "uuid": "a4d3a55e-551e-4674-a46c-980b6555aa25", "comment": "Malware payload (Mirai)", "value": "9f810fb057774f35a6b4a6d1402ec69d7fb4d59a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830400, "uuid": "949fd263-2e5b-467e-8814-95d6042ec931", "comment": "Malware payload (Mirai)", "value": "8b5a0080337d3845e4a3a7f145ff3786152fe7404f2cbfaae8b46c2931f8ed2d875d7565733efa4cb39d3bd10006243c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830400, "uuid": "3b1674ba-7679-4413-a0c7-4ed3da57a3c2", "value": "T12E332AC476C3E9F5E815457D307AE7729F77F13A603ADDDBD389A423D842A01A2022AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830400, "uuid": "19d3c615-daec-4576-adae-f604ce5b836b", "value": "1536:AtzH2sAukd2RKZwLNXqLsv5TPDGrp1EmaEc:AYsAuEWKKLNXqc5HGd1DRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830400, "uuid": "f3a8b390-7c4c-4c1e-aca7-4fc2f1bb5c46", "value": 50332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830400, "uuid": "078ad7f4-a345-487c-8154-20c739950444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830400, "uuid": "9372721a-5de4-4072-8654-88f272c738fd", "value": "3atoNational.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83727944-ffd8-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741849085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849085, "uuid": "eb5daf5f-2563-4a09-b94a-153bcf70bf50", "comment": "Malware payload (RemcosRAT)", "value": "1b5f077e92e227cb698dbf561dab1ba7", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849085, "uuid": "b35454b8-99b2-4096-8cc4-e4ceed273b10", "comment": "Malware payload (RemcosRAT)", "value": "cbca3eeb382b5547f69174b12adb1b7d34731fe4881d0d7000d2f2dcdde679ba", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849085, "uuid": "a5ffd5b0-b3c9-4e1b-a5d7-2dcd45f291c5", "comment": "Malware payload (RemcosRAT)", "value": "c9b53afa5921c332862157029bf4ae082dcb55cb", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849085, "uuid": "eac7ae4a-8b79-4a6d-bedb-352a5e747b85", "comment": "Malware payload (RemcosRAT)", "value": "111c021f973c9accb4b187de946826e65be3aedb3973caa11e92f3e31e0cd6f91fffd5f63fb2aab87b679fe5dd69cef4", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849085, "uuid": "52bb86bb-33ff-44b5-925b-a77bc6378355", "value": "T126B4CF01B9E2C172D57654300D2AE776DEBCBD2028358D7BB3D60D57FE30190AA39AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849085, "uuid": "10d6627e-c7ee-49bb-80bb-b495173b6471", "value": "41e05d591d7d93bdd5bc6d5da04da74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849085, "uuid": "31438a89-c617-4c80-8281-db233ca09cfe", "value": "6144:/IlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6SG:/200OFp+G0imvHn3Cp6qyBP+YdsvZGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849085, "uuid": "fa35c331-bf61-4c39-9686-a3b95312d1ae", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849085, "uuid": "2c936c70-2fab-4388-a94c-350c64a8eadf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849085, "uuid": "f35de65f-13d9-4f60-bf07-774f5bc64bbe", "value": "174184908302bc95dd4ae6bdaa09c8cac312e0ae5573db1f673f0a868b0cdece4416df7c22293.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ef8afb-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849623, "uuid": "35864938-9110-4db4-98a5-255fa5e47ed6", "comment": "Malware payload (Mirai)", "value": "d5c9e1c208c8161d1fde4b58f96ac7d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849623, "uuid": "ccc5b992-e92b-45fc-8376-6a29acc22148", "comment": "Malware payload (Mirai)", "value": "cc49e291c3e9962cf873f1b6109123255d17e81848c0e7caa883bbe17e8ce754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849623, "uuid": "fc7fbd3a-c2e6-4b49-b08b-f4a06f11d06d", "comment": "Malware payload (Mirai)", "value": "39e697e62de80d240f5ba7b9e233f5e72cadb063", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849623, "uuid": "81edd53a-eebd-45af-b3d3-3435dfaa05a9", "comment": "Malware payload (Mirai)", "value": "1c454c9117ba8253534f4301e97735523ad073dc1192f9e5402f0d6bb43e27c51d952de13bdb4b4b7972ccd189cf6014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849623, "uuid": "b4ed4661-b6be-47f7-a00f-b83677ce2a70", "value": "T1DDB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849623, "uuid": "d69f4169-fff2-4cc3-a13c-f3877e43b8f7", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1b/LWy:c9sSyzz36YaWWgg1bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849623, "uuid": "b7fb9354-27b2-4515-9bc5-79167b06a42b", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849623, "uuid": "5a892d25-624d-42c8-b585-6bb5b421447a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849623, "uuid": "cc931041-423c-441a-bf5c-b395a9a58d83", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d4842b-ffe2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741853496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853496, "uuid": "dec96ccb-f037-47a5-bd3d-6f906eb1ba0c", "comment": "Malware payload", "value": "8e075f03fd689f75665067405a321c56", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853496, "uuid": "ea64e12a-b911-44f5-ac64-80ea986dd569", "comment": "Malware payload", "value": "cd05b7676886e560400643e3852e64483cee95f4741ec8a930c7b1f68479835a", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853496, "uuid": "9c0785d9-2e88-4a57-bd42-847066ee3629", "comment": "Malware payload", "value": "aca4f3442d716f4c96034b7a2e7aff59ebb896b0", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853496, "uuid": "067dcac7-46f0-442e-a024-c65f95591ffb", "comment": "Malware payload", "value": "fda86db82740805b6d867c2b2badb211f723a48539e3fefc3e49abd5411eadf7f1ad340ae90746f9af4499b5e91c1890", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853496, "uuid": "4e781057-a656-41bb-8493-39dcc641bf66", "value": "T16C93A21570D042702AD746BDF6DBB811E034E0BBA5EAA948F9ECC2C05F56610EEF169F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853496, "uuid": "5bbc69be-9f72-4a51-9c3b-6d6e51d78b85", "value": "1536:08waBBtdqJ1NummECTMrNri0wDuNDHLJ/3TnmOnctHsOr:WaBBtdq1CArHwStHLJPTn9ctHbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741853496, "uuid": "313935a0-bb0f-4f31-8f87-f6d12ec98a71", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741853496, "uuid": "dd071582-5f3d-43e5-a9bf-2f1ed2628d17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853496, "uuid": "3ad29c36-a3b7-4fd4-a52c-215e37b1ad62", "value": "LAPSToolkit.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f88dd3-ffe1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741852735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852735, "uuid": "084610e4-324a-4636-aac2-5a27e71cb73b", "comment": "Malware payload (Formbook)", "value": "5e9ae3b9f8d62a2f6699457979fc1cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852735, "uuid": "a7510c9a-1ba9-4c49-b725-84fbd96a526d", "comment": "Malware payload (Formbook)", "value": "cd4b98de3dacf06e429593bfc098f96fd9d03fa9c6a95e1ab5a7f4a93b04d29a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852735, "uuid": "a6ceafd7-eff6-418a-89e9-5bca650849ab", "comment": "Malware payload (Formbook)", "value": "ba63cf407a91f0b716daf1a82ddb7c043158bc23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852735, "uuid": "3842cd86-09dc-48a8-9643-66545a71ad56", "comment": "Malware payload (Formbook)", "value": "9462bae2dcec76856656f4043315e1fa8305513375474524f4fe2fb617663988f6105993c0e4211f2b76197a825c0b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852735, "uuid": "b9a12fe2-cd3a-49eb-bb20-e1e32ddc5b7b", "value": "T113F4124C7F69B761CA4E1BB2D4232208D5F64492E13AF29B0DD518F30E39BD8851FA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852735, "uuid": "d20c2fd1-7e5e-457f-ab8f-b6c5457d25ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852735, "uuid": "d2789efe-5924-46ae-b96c-a0393c155b04", "value": "12288:7xk1tyTu/HjUupelCQ+289VqHc5XfKxGm70ajcS/qaBrnuiuUK2P8JsGdoRapCGR:7a1FAdl0289VMctfO7DqeDuE8yGdoRaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852735, "uuid": "e34cd3d8-16db-4b9a-92df-54d07470a723", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852735, "uuid": "750dbc4a-02e0-4cc9-84b9-7491f92869d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852735, "uuid": "37e874c9-798d-4243-86c2-9bea632fcbf2", "value": "PO NO 28950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f81975-fff5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741861622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861622, "uuid": "f31dba71-f2b2-4575-b776-30ae9ed0c817", "comment": "Malware payload (Prometei)", "value": "56568a118cb30d88262823386e318aeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861622, "uuid": "a6501867-b90d-486d-9feb-cd99e5de2bc5", "comment": "Malware payload (Prometei)", "value": "cd67f49958c87a1f74f9a2c9bd1b628153b5a03f322ec6e4f808671427698dd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861622, "uuid": "2d870260-91c0-4011-9305-2716e199d7ad", "comment": "Malware payload (Prometei)", "value": "94dfe434f3bb13f16a998fda1883937e630ac0c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861622, "uuid": "82b60b5f-29d4-4296-9ad0-6e5f498b0807", "comment": "Malware payload (Prometei)", "value": "27ef182c1dc391f6a6deaacf876ffac513ff0d74f019d4db8bfd3916025854d3ad99d8f2a238d8f86e68b78bd0224394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861622, "uuid": "b4137b3f-0482-4a29-80d6-b37687811fab", "value": "T12A9423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861622, "uuid": "39139e6b-ea32-46af-99b3-37f3bbb80b84", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgd:25WOSACZSV6eKRH5EPiamb4DsDwwcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861622, "uuid": "027bb2b3-5f30-47d2-a20d-9ab687aacae8", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861622, "uuid": "3494fdc2-69ed-41c4-99ae-86dd54ff5413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861622, "uuid": "de44cfb8-d608-4cdd-8613-c67e347abfb8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c14b93-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849629, "uuid": "5ab90715-acae-4572-ae4e-f1541df08b74", "comment": "Malware payload (Mirai)", "value": "2670c63a6e853269abe266bde6e9b424", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849629, "uuid": "19a34ac4-fa7c-4986-9c07-5633bd11f06d", "comment": "Malware payload (Mirai)", "value": "cdcdf01262a4ab0f4db0a988fdbc8058cd545d946890ff4d5e0caf046be88f7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849629, "uuid": "0181be12-19a8-4dd8-8804-60e6b210dfef", "comment": "Malware payload (Mirai)", "value": "d2522d7a2099db9bae1f3d7a37c89f018fac89e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849629, "uuid": "ddab5843-c88c-4837-b8b0-c9aeba34087c", "comment": "Malware payload (Mirai)", "value": "1cb4d2d16486bfd2d3731d920ee265877426d5b77203cbf836536e06b48899f11618772ae236d25ad2c4b72d9a1a2a45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849629, "uuid": "f536d100-7d4b-48c5-baa1-cd93a76f72bd", "value": "T1A3B2C0CD60543084CA8D7C7C178D4A674F6CA0D0BAED9B26E350CD98B7BAA4F385D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849629, "uuid": "eba93559-71ac-4cac-b1e4-739ee766148e", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpOZZqEWvT:/QlS07FUXqIYSXQKquOPqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849629, "uuid": "354eb07c-e1a1-407c-b1d1-ff587aff05dc", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849629, "uuid": "b9ea9682-6abe-4ec5-8c9c-a5c66c6fc7a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849629, "uuid": "dd70d0d1-932e-4373-98b2-a1fd0103154b", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10b1c56-0018-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741876730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876730, "uuid": "b0fa5fd0-87dc-4490-9234-9be69f5380cf", "comment": "Malware payload (AsyncRAT)", "value": "4868ad2c8edd5754b93c162c54d546b3", "object_relation": "md5", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876730, "uuid": "3eb3b6ac-6d4c-4445-8a8e-8c58282c2b90", "comment": "Malware payload (AsyncRAT)", "value": "cdd7f60e7d161ae694719ff61ce9c940eba89788581eeeba73bbb034be1988c2", "object_relation": "sha256", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876730, "uuid": "30fc02bc-41ef-4a44-9ab6-de67e2bb26f6", "comment": "Malware payload (AsyncRAT)", "value": "f0ca8a34d86769e3039d6b4a0069b026b620ccde", "object_relation": "sha1", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741876730, "uuid": "a789b609-8482-45a9-b105-df6d799d03ee", "comment": "Malware payload (AsyncRAT)", "value": "02b8fafd57910350151e54a5d9c9bae0909537f1c4c7f2ef2133cf452aa6b9aa45a249dbaf77b86e8e91588949b3811f", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-85-66", "colour": "#F40277", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876730, "uuid": "aaf990c6-658e-451a-b82a-e5b74d15cf4f", "value": "T1AFC0C009404CD1353654EB24D93E0CD5F3851EC1002C37819333BE2442704C5FA28006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876730, "uuid": "49e18c3c-5d61-4ae0-9dd9-ad8a01d5f566", "value": "3:mKDDGKSSJJFI9IrFhkUvPkAY/KOLISBb55uVi3LmKBLsITmsBnXJXWXLF6B:hSG8qXk0O/K8IC15uVi7mKqITHnXJmXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741876730, "uuid": "915bd4da-f664-4f65-b0bf-e81bb36cfe30", "value": 170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741876730, "uuid": "61945197-d047-49c4-8a40-aa80b80785bd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741876730, "uuid": "c7f6b71b-ca5f-4684-b12b-8b1ef32f6901", "value": "cmd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3d6dcd-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879408, "uuid": "46e1bfea-fa03-4524-9017-1a254dfcff66", "comment": "Malware payload (LummaStealer)", "value": "6f5fd4f79167a7e2c0db0a9f925118b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879408, "uuid": "6ec68770-4a1e-4ae0-bdb9-cc83d0d0cbf5", "comment": "Malware payload (LummaStealer)", "value": "ceb426731770a6cc7dcf8eb3a1c0f861e3e5e94562f7c0c37003219485e47509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879408, "uuid": "fd1522fa-65c0-406b-bd7c-7ca6ea15c56e", "comment": "Malware payload (LummaStealer)", "value": "5a9887316db9016897fbb8e7e349ec5e27fb6ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879408, "uuid": "23841e54-6df3-4b88-9a22-1b21990abff8", "comment": "Malware payload (LummaStealer)", "value": "515575dc405da50d1e0cc0edad1dceb40182e03c50053b4c09f15008ebcbddc63301a1f227c776954f7c83bfe7c65926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879408, "uuid": "d5c09e98-7d38-48c9-8dce-4673c976afc1", "value": "T1A1A52206F12C400CE07554B6AB8B41826DFBB6FBD3423ED0DAA9476AE8C7FC95447C69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879408, "uuid": "fc25222d-ee76-4e02-b6f5-59001ef986ec", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879408, "uuid": "d7da13b8-62d5-41b3-bfc4-5b6e20fb1eb1", "value": "49152:TmTINWxavCEC3+CEgCWK/ipp1l7sda2hq+9oYA:TwIAxavHC3+ClPGEDf219oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879408, "uuid": "972189a7-f721-4785-a0de-50dba0a3e100", "value": 2111488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879408, "uuid": "6e262833-1713-40dc-b569-75e2043922b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879408, "uuid": "f9658afa-b009-4670-a75d-ffa46603a240", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a20f7fb-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860183, "uuid": "52b77240-6178-4e44-a751-be3aa9111151", "comment": "Malware payload", "value": "483d3ac05856f80ad8b30170843cedef", "object_relation": "md5", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860183, "uuid": "047a7882-ba0f-4f18-995e-e6b7e32ffb58", "comment": "Malware payload", "value": "ceeaa4d8c1a6424c5108c6bb75d1fd3c4629c90a0888f090a8ca4aa2bc124cfa", "object_relation": "sha256", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860183, "uuid": "2ce22a80-32e5-44ab-84da-d445fa38cb5d", "comment": "Malware payload", "value": "4c1bc264ae50bde8dcd6531dbd9b8bedd8eed63b", "object_relation": "sha1", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860183, "uuid": "b643838b-d779-4a27-b4f2-76ebbf99e712", "comment": "Malware payload", "value": "c969caf7a43a589779f0dde39d36f9b7a2845ada88f9f8b3cb96cdac1b6b931924f5c9b92b4f43e62299c67f3ef97660", "object_relation": "sha3-384", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860183, "uuid": "90f6141e-9678-4ae7-9bab-6fc3d51f7484", "value": "T12A33F5D68A88BCDBC6641E398C316440703FEE3BE4B1606A5456B5560EBE783A937F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860183, "uuid": "337f3ca1-ad9d-4f5e-8a94-e2e86a0977dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860183, "uuid": "4e3fc5b2-f476-4e06-9bd8-5aef7b5ee87a", "value": "768:4ElbuyojLybOSHx0fE7i3nDOa3MbOSHx0fE7i3nDOa3E6J5MCJ1+ySp:7l5pOS6ei3/32OS6ei3/3E6J5rJ1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860183, "uuid": "928fcf6c-1e6c-4fcc-bc51-761783fcd4e4", "value": 50792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860183, "uuid": "6c41b58e-3e4f-4adc-a2ec-7581475f4300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860183, "uuid": "09ee3e66-60cf-44a0-aa37-05472850f0e2", "value": "ceeaa4d8c1a6424c5108c6bb75d1fd3c4629c90a0888f090a8ca4aa2bc124cfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82388f58-ffba-11ef-ad17-42010a9c0004", "comment": "Malware payload (AteraAgent)", "timestamp": 1741836198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836198, "uuid": "c1b6008e-3293-470a-a262-43e601e0eb3e", "comment": "Malware payload (AteraAgent)", "value": "33e1da237802bdc69ea7326799ec8c44", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836198, "uuid": "49c6fd8b-32c6-4830-8f3a-2d6da574cff1", "comment": "Malware payload (AteraAgent)", "value": "cf13f22012ec3a6f27a878c417a4ca60fbe56a90069748d2ffc59f264e5451cd", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836198, "uuid": "de4eda1c-17f5-4ca5-9156-199d280b7b50", "comment": "Malware payload (AteraAgent)", "value": "a8f2348282fc248a334783484c57fc48c195f8cd", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741836198, "uuid": "884ee281-4cd1-4205-b597-3526da1565df", "comment": "Malware payload (AteraAgent)", "value": "b290c62e25b7b5ad1ed32f22d2ee139d5d30e6c372bb8744a3c592ebfcd77bf2b8705c7bf31cbc2d8ca8eb4b7682bd02", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836198, "uuid": "9aa6ca02-23eb-42f9-873d-7eb0fee6b535", "value": "T16ED523117584483AE37B0A358D7ADAA05E7DFE605B70CA8E9308741E2D705C1AB76FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836198, "uuid": "796497f8-2c7a-4bde-97a2-1f84ea56bcd5", "value": "49152:2+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:2+lUlz9FKbsodq0YaH7ZPxMb8tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741836198, "uuid": "06ab713d-7d22-4177-9b80-a0f8d5119bd5", "value": 2994176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741836198, "uuid": "29ef6113-e02f-4066-8d2e-a54a89a201b5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741836198, "uuid": "8a455e2c-0106-4e56-8aab-0c4bfc4fd453", "value": "RQ-5218.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081792c4-005a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904713, "uuid": "b7b1fabb-e81b-42a2-b3b4-b7d9ec9822dc", "comment": "Malware payload", "value": "bd4b324031cdaf8b07b87b1f65baee83", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904713, "uuid": "444e6f30-0fbf-45d4-a59c-aa393b60ee78", "comment": "Malware payload", "value": "cf6987478b039bcd830352cd60f085b934ec1cab67f11f7a44d57e5d6ec40372", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904713, "uuid": "a1c3774e-f5af-4e39-9a91-3ee9e6a05515", "comment": "Malware payload", "value": "25bf44317695ac1fa97755df73756c8de2e73e5f", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904713, "uuid": "3c46dbd8-d48c-461a-af16-37bfcd01ef41", "comment": "Malware payload", "value": "212560415c29f6521ac8be0acab5ba1a680f43c76ea5f876454fd0b1c879d6a4f7eca27644be92c02a5feec4dc493150", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904713, "uuid": "8bdf5650-1e1d-48ba-9ff5-ac269dbe3b27", "value": "T185A54B313BAAC52BD5A215B06A2CCB9F51A97B7B0F7250C753DC1DAE04B48C28731E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904713, "uuid": "314b6494-d09a-46c5-bc0a-914a7cebea07", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904713, "uuid": "024877fb-29a2-4354-a048-61898f5b1627", "value": "49152:nT5AhUC7ilxeAi0D4QSq8Amr5N5ch1Vq/awZMDJf5Hhqm99zkG:FAhUCyxeAi0D4QZmrT5cs/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904713, "uuid": "caf3ccef-3ce5-49ed-8f05-d72cba3c1cf8", "value": 2167656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904713, "uuid": "7c94d7eb-2635-47ba-8f24-79f822123515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904713, "uuid": "0973912c-c874-416c-9752-484ec1e220c6", "value": "instal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6a98d4-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869125, "uuid": "91d761ce-59f4-4594-86c8-23f41d874326", "comment": "Malware payload (LummaStealer)", "value": "eff5d3bc8920a72ad1bb26e34e3f5132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869125, "uuid": "d53dca49-5f73-40d1-9689-356f01c4de46", "comment": "Malware payload (LummaStealer)", "value": "cfcf4fec48112057c235868a2561693719656dd179862b895de3908bd8f4956c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869125, "uuid": "759aeb3a-62c5-48cf-9a70-380729f49f7c", "comment": "Malware payload (LummaStealer)", "value": "672aafe1ddd2a21ce76d04d287ac1ec0ae60087b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869125, "uuid": "5e63860e-b4f3-4112-a7c0-b65c74915d4b", "comment": "Malware payload (LummaStealer)", "value": "0ea3df4241d851ff8538195b810d133483b38716b094f93da9bc51fc87e5742b5084aa07cc2315185825a4a19653ab8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869125, "uuid": "455e5d1a-7126-44b3-8159-4c0441e7b512", "value": "T13DF4D046BC92D0A3EE1628B15D29E7C51C6B6B244F3084F77ED89D646FB36E18932313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869125, "uuid": "6d4d8b42-a1fd-46c3-96a3-3622dc0b4fe0", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869125, "uuid": "ab962713-871d-489a-9992-f4aa29b43aa5", "value": "12288:XIJQ/s2kiatVPnIpbWiJ621POPAANU/o8e7UyZySMHe2LmGcwN7T/Jt00pV7Xt5y:YBnIpnJhdQAANevejW/Jx7795iJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869125, "uuid": "eee52187-3605-4e6a-bbfc-36d5c0be2b9c", "value": 785216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869125, "uuid": "e9e5081a-62ab-4fa4-8df4-d3d99d4ec04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869125, "uuid": "e336e58b-f321-4890-ac93-bc795547a552", "value": "SimpleLoader v2.1.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c01c7d0-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825048, "uuid": "b163eff4-a3fe-4bdf-ab45-99cc54532f58", "comment": "Malware payload (Prometei)", "value": "4a005be3379799a94944fe26c2f5354d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825048, "uuid": "b0096a47-0492-43c4-9847-03c95d5b8d58", "comment": "Malware payload (Prometei)", "value": "d10ca1ca8268cdc0d24b653456e95180a35458c74d22880a0b5331a23f47a340", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825048, "uuid": "07a4c870-9cf5-4aef-b365-4726f2ba42a6", "comment": "Malware payload (Prometei)", "value": "5a674b99fec5b4c61ed536b64aa0b5da3b0840ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825048, "uuid": "817d2845-e306-48eb-84aa-c24151f70eee", "comment": "Malware payload (Prometei)", "value": "838d4fcb943e97648a0008e678538e42d4bb19c9657c9bdad49b9bbae82f7d98401b0197d008b540ae74c929e2f383f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825048, "uuid": "67f2ff13-1d5d-45fb-921d-fff37e9d4682", "value": "T1879423F8C83D2E30D8169B3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825048, "uuid": "99b3b66b-488a-4013-be4f-9dc5ebd14c24", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg3:25WOSACZSV6eKRH5EPiamb4DsDwwcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825048, "uuid": "a0c14fa5-0d21-4f00-9e96-731557e012af", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825048, "uuid": "bd211428-c752-4f9e-8843-402f5a4921bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825048, "uuid": "aeb43044-17ff-4227-92e3-448df12e9b84", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17edd6ae-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741872956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872956, "uuid": "cd227acc-9bd0-4f7c-be4a-e7665271e435", "comment": "Malware payload (AsyncRAT)", "value": "76ec073ab9d346e83f4d51c6e4b0bf6e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872956, "uuid": "8b445bdb-99b3-457a-bab3-99538a885e02", "comment": "Malware payload (AsyncRAT)", "value": "d11c2a3ba2abdc94ab341e055803ee3deb25ba2fcaebff0711570e31a0b196b7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872956, "uuid": "0e0e3a91-0bd5-4979-8e47-5a92197001a8", "comment": "Malware payload (AsyncRAT)", "value": "5cd48e0e4bedd24a627c3a1a94dffe0107106a9c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872956, "uuid": "fbc18274-e43c-42ca-9567-775bde0ea08e", "comment": "Malware payload (AsyncRAT)", "value": "5aae895b09855a125e12fae3fc8340f5c61c803b8ca22067fa4f5660967c12c4698038d313e3c1a92972703f90a35060", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872956, "uuid": "4e4e8911-c257-45f3-88f6-7c43c3522db6", "value": "T1DA232C103BE9822BF2BE4F749CF26145867AF6632603D54D1CC441DB5A13FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872956, "uuid": "395eadf4-01f0-467d-b4b7-b17bda29d5e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872956, "uuid": "bd68dae5-ea05-4147-af06-406345ff73af", "value": "768:OuwvNT8E2mLWU3FvZmo2q7cKjPGaG6PIyzjbFgX3iKWFTb+8h6JmzBDZex:OuwvNT8xk2JKTkDy3bCXSdb+6dex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872956, "uuid": "3b239462-59dd-4cf3-a267-dc4de0c583b6", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872956, "uuid": "0c82ba0b-e730-4677-87de-288286add07b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872956, "uuid": "a9758eb4-7fe7-40d3-9dc4-fa4f165ca34a", "value": "AsyncClient.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef87a6b-005a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904778, "uuid": "30b63d6b-e47e-4a11-9c0c-6906db6404dd", "comment": "Malware payload", "value": "1876aa26b7579b32c011858dcd7a226e", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904778, "uuid": "2d6dbc9a-abf9-4730-b653-32269a2608e8", "comment": "Malware payload", "value": "d18e6a3572ea1b0545fe35e735094fae8e9ca82bf01cc185da5e67b54ba0ef11", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904778, "uuid": "91f6bceb-da88-4906-9322-dd684b31cdce", "comment": "Malware payload", "value": "b0efcafe9de6915cd7bc49779ad9874a33b3ffc7", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904778, "uuid": "177936f5-660d-425c-b5c5-d4250555fab3", "comment": "Malware payload", "value": "88322e04bee0967bd26baac2435e1b1a109ba4af2f50f383e3122d48d931657f091e8ea6d7d1d0b8e3cec7292013782c", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904778, "uuid": "15cff75e-0ea6-4562-9892-3b3f2a2d4268", "value": "T1B8E59F15B9EAC236E5BE41305A6DDB3BA1F83EE7077144EB67D855AE0E718C10231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904778, "uuid": "eeffc5d3-586e-44e7-9de0-ad38ee4cb882", "value": "49152:OW6FaYb7oC8YuJdvh2qVAnqpdoVG/AYQJcQTqFQaKn6j2yBEeI+ji8NvuqmSJhN1:XYHX8YuJdvh2id1AdWQTAj2y9e0gWg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904778, "uuid": "d84f7fed-3752-4c31-bb58-bb99b879524c", "value": 3177472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904778, "uuid": "6cf2067a-872b-447e-bd4f-8a2dafd2536a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904778, "uuid": "e622881c-abf5-46df-a5e0-016fb8aa1b9b", "value": "AIE866E.tmp (copy)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00900e27-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879360, "uuid": "a4445059-2b3a-494a-ba56-760241185b04", "comment": "Malware payload (LummaStealer)", "value": "82f657a38f9f52f6c6cd7134babbd6ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879360, "uuid": "a90683dc-0240-45c7-84ef-a5cd3471de20", "comment": "Malware payload (LummaStealer)", "value": "d2282c9a1df9a8fe4d4afa98b4f69f1917febed85181a92762652c4832a6b5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879360, "uuid": "36360d9a-ca48-4ad9-9b17-b492c2210750", "comment": "Malware payload (LummaStealer)", "value": "d3210b333ef2274dbfcfe5cce5dc02e013ef6298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879360, "uuid": "ae9a2492-8a68-4f94-afc3-34aa358910cd", "comment": "Malware payload (LummaStealer)", "value": "3f2fdac6ab7d22f5a5fbfcf1f94258470a8c441747d676b04cf3186ad61e3edd11d47ec1502f37b8ce599aa17ddd0600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879360, "uuid": "a05883a8-a6a4-41ca-9d3f-1a997bce1234", "value": "T14D9533B4AEC19497FD0269F0093A87FF4D615208BA01CB5ECD4D7060DD71AE9BF6E09A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879360, "uuid": "5771e8b2-a79e-4104-85cd-05fe3325beb2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879360, "uuid": "363e10a6-9007-40c7-bdd1-03203dee3070", "value": "49152:jgmuf2iUt24Ht8WqFDsvHQ9yLtvL8nMkO2:jgmuueFgvw9kleMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879360, "uuid": "808662a2-47d1-4b6b-a674-de3bc5224f2b", "value": 1891840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879360, "uuid": "80f8b155-0945-4296-b3b0-5d3a955dcf48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879360, "uuid": "817ca675-333f-4909-9726-048446d410f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9119120-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879723, "uuid": "c303bf0b-e3dd-4b65-9e2b-a9f84a3b0bbd", "comment": "Malware payload (LummaStealer)", "value": "94bc6b62d8b8d619fc46035aaa2ab5e9", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879723, "uuid": "5defa558-7244-4519-9f2d-86bd349adbe0", "comment": "Malware payload (LummaStealer)", "value": "d2858925aedcdcb1b204ec6fe076f4450f9c7f7c533814caff54abac5e6f472e", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879723, "uuid": "65e10a3d-5f57-4ab1-a0a1-44b24096420a", "comment": "Malware payload (LummaStealer)", "value": "bf44a1b0a062a68244b8c836e2e94f0683819d9d", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879723, "uuid": "fd15dd02-b636-40e2-ad58-3eb01195149e", "comment": "Malware payload (LummaStealer)", "value": "3545f5d58713b3ad81f3a3f28090fb61ec56a5665f988bb8c1ade34b5eb79c1720b2e4b0cfad8b65a193a246662801db", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879723, "uuid": "9564e66e-46c0-4821-a386-430dd8475120", "value": "T130F723A0B391BF28EA9F60E587C5C41D0B6BF45717A2B2370E7EF18BB90542215F8B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879723, "uuid": "38956352-3bdf-4a2d-9b9c-4ece42cbf30f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879723, "uuid": "a052ce88-7135-4da6-b969-11790b21bab8", "value": "24576:K3XS6NksAvCd76aJC/3B0NitJ32zRcYbncCdeybo9Q16OFS6/tLq1B:EXSLKdmac/3B0AWRcYLE99Q16OtxSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879723, "uuid": "838062b3-7bb4-4420-a810-a536bc39a79c", "value": 74448845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879723, "uuid": "14aaa640-ac31-40b7-b5b2-c1c9a91b46b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879723, "uuid": "2eaaa296-0107-4cb8-b8ce-56600b2bbe8c", "value": "\ud835\udde6\ud835\uddf2\ud835\ude01\ud835\ude02\ud835\uddfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93eddfa6-ffdd-11ef-ad17-42010a9c0004", "comment": "Malware payload (Metasploit)", "timestamp": 1741851260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851260, "uuid": "0807f16e-0f77-47ea-9780-06c09d310fb4", "comment": "Malware payload (Metasploit)", "value": "aa9f819f355c3ab17de926aeb48e00d3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851260, "uuid": "c8a1e24d-bc80-4a37-9aba-cb1da6c08540", "comment": "Malware payload (Metasploit)", "value": "d2df019dc9cd8a6bd05c4d42ba83778a571f58a783ac762e138cd45ae0a31f12", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851260, "uuid": "f9d3c7b2-de13-4a50-bbd1-a19aaf9e24c2", "comment": "Malware payload (Metasploit)", "value": "9cbf234fbfad00377fe05c14ca807531931f31e9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851260, "uuid": "128a042e-1319-4e6a-9cf5-29f26b083422", "comment": "Malware payload (Metasploit)", "value": "0304f9b5e6bfb4217968e29f92fffc487c6551dedc44b1b59362a0754254cd4ea404195bb20f34051347947720d8686c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851260, "uuid": "e807152a-5e3e-4561-acc6-10431d36e7dd", "value": "T164C2E11DE2D99C059A0C47F45817038F0B7D7F352E48E7E261E2C211F7A2BD89A5AD17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851260, "uuid": "d27c01b9-f184-4662-89fa-c33a065b7024", "value": "768:vPSh6Nvzg4iTpQmhYYHFuzhNvQxMni51QgQAkePtvOJeN:vS4EWG5luzhNICi56glPNOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741851260, "uuid": "db3b3f5e-b1c7-4e80-9782-f6c785f95539", "value": 27750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741851260, "uuid": "401636f6-1948-467c-a5b1-b0619e02f510", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851260, "uuid": "c07a0794-1e7a-4be8-9b61-00054932271d", "value": "evil.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804f2758-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741825028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825028, "uuid": "cc0874d3-433b-4094-b910-3b4e294ea0eb", "comment": "Malware payload (Mirai)", "value": "c72cf69cd7a4ae98e39071611ff34d00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825028, "uuid": "1323372d-915c-444e-b069-45c1beb27455", "comment": "Malware payload (Mirai)", "value": "d37e6c37c1db4ee88db6547ae0cacc128677092a7f4dc6906659f266c0d0705e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825028, "uuid": "4a4ac43c-21e7-46be-827a-254cf3f94302", "comment": "Malware payload (Mirai)", "value": "5296304e254009989d6adf9c78d891896662e410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825028, "uuid": "ae642ed9-b16c-45d2-98e4-4fae14364a3b", "comment": "Malware payload (Mirai)", "value": "edf79ce45285348946ac562b3c89a2e4e65706ce7607a6137bb587a594a3c33f859e09afbae1ab08824d477607a810b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825028, "uuid": "19920a34-8e58-4a39-bcd9-4c6256ec5b1d", "value": "T1393308C4FA8B89F5D90749304067F13FCF31D9B941B1C6ADEF9A9E35CA67542920228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825028, "uuid": "864ca651-933b-4377-b7d1-6970c18bfc74", "value": "1536:nfyMY0q0Yv5qP69kj0MGNLajcsQL7YkOIJtP:fyMY6Yv5qP6moNLaQsQfYBIJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825028, "uuid": "a4fe9c06-6350-420d-a3bf-482e550e768b", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825028, "uuid": "b7e74eaf-3582-4f48-97b8-05ba9947dcc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825028, "uuid": "49164b6c-a60e-4858-a5af-68dfa6ba04bd", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a00edcb-0043-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895052, "uuid": "ecfdcb1a-408e-46e6-9a21-25ee7ebe057e", "comment": "Malware payload", "value": "325706962cad0969b75c77a4ebbfe99c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895052, "uuid": "ac0fa1e1-f60b-4d1c-8ae5-b6a8b8c755a8", "comment": "Malware payload", "value": "d38bfd9a2aa63819d8817696243ddf2b2ab8389eaaf18cf4f06a371cd75c3ae3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895052, "uuid": "1d1cd64b-baf4-49ea-89e9-322f77f35dd1", "comment": "Malware payload", "value": "80745d6b3f5b9ef581f38ffe294508fb98c10970", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895052, "uuid": "b27ca774-38d0-49fb-b6b0-771068f6def2", "comment": "Malware payload", "value": "1a3a5c1b52a41cd1b2538802002792b5d8c9bb6d9d382b349b877e1989d8e19d187acadca312dbfec399a790cda77075", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895052, "uuid": "da59e266-a351-4724-a9fb-62f0c9d57795", "value": "T10DB73331B99E8136EA5E44B1A93AAA2FA43D7DE30B7044DB53E4F85714315C3A334B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895052, "uuid": "d92ea244-ae9c-4e5f-8eda-589198824b31", "value": "1572864:+FTJlrefp7j7j4o3nipMi286l2R+3jUZFPohQAhI:+FTJl6bng2ZcR+TygaAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895052, "uuid": "9194299b-5c7e-4173-8c4c-4d52d50384b2", "value": 51274752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895052, "uuid": "4cf7d403-26ec-4545-a6df-4f850fdca50b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895052, "uuid": "04460d2f-ea04-4548-b3d7-557c7b542022", "value": "40d4ec.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054f94c7-005a-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741904708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904708, "uuid": "f3036a5e-b9dd-482c-b600-23c3db8a86e0", "comment": "Malware payload", "value": "6c3516fa2975225869eefdb33345918d", "object_relation": "md5", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904708, "uuid": "3312bef4-7308-4c75-bc55-d3011b8e8220", "comment": "Malware payload", "value": "d3c496be4af5c11438e3ba334cf75b069edf0d2815f56d6508256d1484891af0", "object_relation": "sha256", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904708, "uuid": "e5067ac0-743f-405c-b60b-7aa9c057785b", "comment": "Malware payload", "value": "a771ae5b3a7a0a79c4d966cdfd10f6613723c483", "object_relation": "sha1", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741904708, "uuid": "3e6f5bf9-4bac-4bd2-9317-2fd3a441463b", "comment": "Malware payload", "value": "3a6ebd4167b6d7b877bfa43ba80cf6164649b637e001d6d92c924625d6e809a9c4e8d72f0169417dd5be8513db81c966", "object_relation": "sha3-384", "Tag": [ { "name": "BITO LIMITED", "colour": "#C132A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904708, "uuid": "d8f7b4b5-2145-41f1-9a38-f6f3b3f4c483", "value": "T1F3A533ABB5257B06C68F4D3202C51B8F41F37B854CFAD4EE115362C7AE17B886812E6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904708, "uuid": "a0d29e15-d51e-4bd7-954c-710a4307904e", "value": "49152:oIjBPIW25yE02KKjzmMhjfrx/NalBBcQG0Et//RgLTzWDDZ3zaJi:oKBPINx0QLhfJNalBBcQGVHRXpaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741904708, "uuid": "03db7d2b-f921-4b73-84b6-4b14370f4f36", "value": 2079710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741904708, "uuid": "87245591-75de-4d91-8cd2-321d2ed461cd", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741904708, "uuid": "d617baa6-8c1e-41b1-96ab-50367bb4aafa", "value": "MSI8DE6.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9a4bc0-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883301, "uuid": "657f8a7b-4fa0-44dd-a2b6-fe8ed48b1d53", "comment": "Malware payload", "value": "67e9184f24fcc29bc341fc62bc9d669b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883301, "uuid": "a9b56153-c4ac-4273-bfa5-9dce719856e8", "comment": "Malware payload", "value": "d4b33840f9a9af7dc77be268a58900919a010d1fc4d515dd78896139579d2f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883301, "uuid": "e229f33b-f60f-42cf-b4ea-0159b8259ac9", "comment": "Malware payload", "value": "ee5f7194397a9fec4983d499c11b4cf8f1fd10ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883301, "uuid": "7ad053b9-9394-4757-ac89-58c31d8fc917", "comment": "Malware payload", "value": "5adae352bd863a6cda3a0044618aaf342ac11e2483b3de2d5eb45886d3125a8a1e61103278bbcf10e65af880dd6b71fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883301, "uuid": "3918e659-48aa-43b4-8743-4f12c3af02a3", "value": "T18CA5D023F2CBE03EE05D1B3B05B2A25494FB6A616422BE5796ECB4ACCF351501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883301, "uuid": "6bd21797-5ce8-4abd-9a24-1472ae7926ac", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883301, "uuid": "fd033eb1-8463-480c-8c0e-652550c6a7d1", "value": "49152:cwREDDMMuAe4eKN7vRy3ftiaOXziJD+QzMm1RBoBVtYHqgD:cwREREKvy3FMi9+Q4m1PQKqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883301, "uuid": "ef2c4ac8-a71c-4a4f-a237-c93d243bb526", "value": 2241776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883301, "uuid": "b3711f82-862c-467a-b619-dc74d10650f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883301, "uuid": "7cb4fc66-c7fb-4c53-ba76-39b6ddc964d0", "value": "cbtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661badee-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824984, "uuid": "cc5c4041-ba52-456d-a50c-19bec671fd19", "comment": "Malware payload (Prometei)", "value": "f4d2cee485eefc4f41d8fa55696b3a59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824984, "uuid": "730860b7-a586-42d0-bb73-de0abebcad1f", "comment": "Malware payload (Prometei)", "value": "d682619fb22b6a90f7cf57a3472b291a6a73acd0edfc5703d79a225e8312701a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824984, "uuid": "6aa731b4-3ec3-498d-81fc-40791825c839", "comment": "Malware payload (Prometei)", "value": "7001dc6603823460fae667dd67afbba1d90d5feb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824984, "uuid": "67dc9215-fcff-479c-89d9-2f5df38f9f53", "comment": "Malware payload (Prometei)", "value": "4c2a06e216199863a6fa576290981c9f0115314ef7d20095bbd0edac180bbdb9ce183d8e166b657a402457db6b41ebce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824984, "uuid": "b9d53266-3738-478d-98c7-6991c4114850", "value": "T15E9423F8C83D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824984, "uuid": "52db66e4-3d48-40a9-a762-90911165e80e", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgB:25WOSACZSV6eKRH5EPiamb4DsDwwcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824984, "uuid": "af95da63-bb37-4ca6-9220-aa75927d00d7", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824984, "uuid": "815253b1-9187-41af-a6d2-d788e90e4fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824984, "uuid": "295d0731-7393-45c9-8bf1-5a8dc189fb40", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbc65ed-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824995, "uuid": "97a12efb-d2ba-4b21-975f-2a93d34b953f", "comment": "Malware payload (Prometei)", "value": "4eb8901bb1795d092e77dd9d41209719", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824995, "uuid": "7235e1d5-633a-4531-947d-a86f655e0c36", "comment": "Malware payload (Prometei)", "value": "d70a54303352782fa10f5013851771d8804f3f6f7ee4160b5c9f56420dd80f54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824995, "uuid": "3a939647-c088-4a66-b6fb-4d5b0d434c3f", "comment": "Malware payload (Prometei)", "value": "1c77a848faf3826cde7693b4f2da81af91f7e34c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824995, "uuid": "25f85f1b-f7b1-4467-9207-e47b69b7c087", "comment": "Malware payload (Prometei)", "value": "4e215d38f8f21a98ffaefcdcb5c320e61a26ac8f93d72d93f304eb25ecdd0752e29480c1e2ae9075e328b089c744a73d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824995, "uuid": "d588e117-75d9-4207-80b6-070d886a0c63", "value": "T14D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824995, "uuid": "ae157de5-e9e0-46c1-b842-8e90541b0102", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplz:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824995, "uuid": "7a0e0516-f959-4b7e-8762-fe74b9fd5e5d", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824995, "uuid": "2683696c-41dd-485a-b976-9dc3e92efe79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824995, "uuid": "2306c4a6-d1cc-410e-88ed-aecbd447f1a2", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a727a2af-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860312, "uuid": "00fbe950-628e-4d06-a4f8-8d7a0a50a560", "comment": "Malware payload", "value": "054d432e231e8ee6e301675ef2bd598d", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860312, "uuid": "16d4eba7-0971-4d7c-b41d-70a0afc81eed", "comment": "Malware payload", "value": "d764287198865dae880e7f2ffeca531d5d827f7828d495aa6f08da7c8ecad059", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860312, "uuid": "c9a4cf33-e385-4488-a40c-f860732d00ef", "comment": "Malware payload", "value": "3a2328d1794752177f4e1ce5c7c8824f425cbf6a", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860312, "uuid": "c3ae12d9-be22-4232-b853-7b03b7bc7f39", "comment": "Malware payload", "value": "58bbb391efac28523055d7c4b3ce7b3a26a67a956a16306913a280ee1e11c6c96ea6ca1e7c450c42760cc6549012da6c", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860312, "uuid": "8f1575eb-2a8d-4f61-9a93-850aa2856fac", "value": "T1BB3137827AB96015D37BD0295043E10394993E13130E193A76BCBAA46F35370E1EBEF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860312, "uuid": "e14a9778-c06d-42bc-8b97-d2384e27d530", "value": "24:Iop7A6pKZG/D5vfyS5aiNa3o8G5CO7BiKXzZ1R8fb96gIqSdmYUPJxSnb+V:I+hpKMtHoYD8i7B/XjROb96/UPXib+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860312, "uuid": "82fea865-e217-43c9-91c4-3ffd725007db", "value": 1545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860312, "uuid": "14e6e593-8058-4825-9960-f0a13fd20fc6", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860312, "uuid": "88db7f19-5a51-455a-a38f-7dfd8442d6b1", "value": "d764287198865dae880e7f2ffeca531d5d827f7828d495aa6f08da7c8ecad059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279a5706-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1741869117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869117, "uuid": "52f6f8e2-49b9-4368-a49c-3dfe7b6bc50a", "comment": "Malware payload (VIPKeylogger)", "value": "cfdb222e894ea0d5fe9557aae2e0adf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869117, "uuid": "0d7f14ed-d96b-459a-81fa-461c24cf152d", "comment": "Malware payload (VIPKeylogger)", "value": "d7798f6bb9a86bb1f5c9d5633015951425439cad729cc2411ff092ae654620be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869117, "uuid": "ebd51dd9-f9d0-4b13-89ac-af08037202b8", "comment": "Malware payload (VIPKeylogger)", "value": "cc01954d759cce12e827be5b1443d5702ebc779d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869117, "uuid": "0af18091-7274-4321-9dd3-877cef7d415b", "comment": "Malware payload (VIPKeylogger)", "value": "53023802d8eaaf094fe15109fc1e9f784bfa4432dcac9155832f8654cd45239c2edffc983630b6879ea9ccdcd7477018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869117, "uuid": "15bd2dff-24da-432f-bc80-794c1576aca1", "value": "T139C402C0F3E18C36D266A970DCAF4661CBD53A12E47301F93B31BA6DE171BA2950B365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869117, "uuid": "f252994d-8b25-4b4e-b24a-fdfcfd6e88dd", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869117, "uuid": "908cfc54-5457-4e18-8f46-902e9c7a3e2a", "value": "12288:kNBvQTBpy0wBT1PZVX6cNgbS2fsPJQ3ynES0MDTWaL:kNBt3Pj6XbDX3yF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869117, "uuid": "6eed8659-c703-4036-854c-c7c353c3ae37", "value": 565772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869117, "uuid": "7eb7a5ac-3ee0-405d-905b-c1279cd2ffc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869117, "uuid": "be97b3a2-c4f4-447f-b001-9267acd1884c", "value": "NDQ211216GM08.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c67c78-ffb1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741832500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832500, "uuid": "1eb6a356-8a27-4590-b9c3-053ca2c2d6aa", "comment": "Malware payload (Prometei)", "value": "7efdf4874d5fba2ef00bc236fd402238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832500, "uuid": "88c05ee8-0161-4e7e-9680-514ab1879751", "comment": "Malware payload (Prometei)", "value": "d7bf0f362169ceb77869d815c81b3792293d4c263c98c02a839dcbe2ea092418", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832500, "uuid": "97b83c73-1945-478b-8e08-7d77c582c8ad", "comment": "Malware payload (Prometei)", "value": "dbf3f375557ed1074b68d7a2eb60ac424aef8a90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741832500, "uuid": "e5991d6d-dedd-4b15-8fb4-8a81b3d39d2c", "comment": "Malware payload (Prometei)", "value": "dabec23bf5defb972bd7a3c431d3508e0e2453d4776799fb62e2f773293dedcc930d59234f80e6076d05559eddbfd32e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832500, "uuid": "d5b2d394-8513-45de-a150-268c7ece49ce", "value": "T1BC9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832500, "uuid": "88c6ba70-bf59-4d7a-958f-de72b2adbd28", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgK:25WOSACZSV6eKRH5EPiamb4DsDwwc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741832500, "uuid": "bf23601e-8dda-4943-abf4-7465e9c4443b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741832500, "uuid": "7137b1bd-a187-47c8-bbe1-c261b7ac2f94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741832500, "uuid": "3e51c7ce-f670-4791-b3a8-3a3c06638668", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a977b074-0042-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741894675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894675, "uuid": "e85752ad-4fc6-483b-a93e-2e022d84cb10", "comment": "Malware payload", "value": "95bb65ce370137f8aaf80fee66ffd912", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894675, "uuid": "b0850144-f2fd-460b-9d9a-0748dfcd033a", "comment": "Malware payload", "value": "d7cb4e4a3489b1ed1bb110b999f52d2eee30092f0d08c06f7cc568d2d137b99d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894675, "uuid": "7e456fbc-33e3-466b-8a33-0a4f302c2232", "comment": "Malware payload", "value": "7ebb5fe8c9bdc59c9503e1a1472b4fdd7afb6838", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894675, "uuid": "e9f8c331-c3ba-4b34-8d46-070348ff953f", "comment": "Malware payload", "value": "94f636163351ca2d73c78a05c2ddad013bffe1a4cc8ce11e1b9c19e56d74757fe62fbf946e2ae65fb87f86a8325d3914", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894675, "uuid": "5b997457-c731-40e5-aef8-6e89a24533f6", "value": "T1DAB73331B99E8136EA5E44B1A93AAA2FA43D7DE30B7044DB53E4F85714315C3A334B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894675, "uuid": "56399133-2e5b-4b66-9dc4-7aaca896daca", "value": "1572864:0FTzlrefp7j7j4o3nipMi286l2R+3jUZFPohQAhI:0FTzl6bng2ZcR+TygaAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741894675, "uuid": "6590bd2b-44d5-4cc7-935f-8b9921747abf", "value": 51272704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741894675, "uuid": "d86e8e12-684d-44db-8aef-cd51652c2b9e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894675, "uuid": "b235043f-240b-4e21-bce5-42b316234dcb", "value": "setup (2).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5da6e2c-0013-11f0-ad17-42010a9c0004", "comment": "Malware payload (BruteRatel)", "timestamp": 1741874537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741874537, "uuid": "190ae618-63bd-4676-9c0f-0e82c44ce557", "comment": "Malware payload (BruteRatel)", "value": "43453a594c177b330476da9cee742d28", "object_relation": "md5", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741874537, "uuid": "56348193-0bd4-459c-a823-2635bb151b18", "comment": "Malware payload (BruteRatel)", "value": "d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1", "object_relation": "sha256", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741874537, "uuid": "dc46bd5f-dc72-4f76-86d4-fecd524bd272", "comment": "Malware payload (BruteRatel)", "value": "4504fd0afe692d405af8dba26a66a907a71b56fc", "object_relation": "sha1", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741874537, "uuid": "011959cc-1c8b-4dd6-b58b-2f2afba90b51", "comment": "Malware payload (BruteRatel)", "value": "7e6bd782befd81e1757a599caea33fcd8f25dcb19d01716f8e6d1f0469b1d696d01f49d9ec44725ca78ac68de3059121", "object_relation": "sha3-384", "Tag": [ { "name": "BazaarLoader", "colour": "#3745F8", "exportable": true, "hide_tag": false }, { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741874537, "uuid": "6b80d46f-f00c-47d6-9c9e-eb8517a92863", "value": "T1F8347212F36368EDD97AC1B047AFA233BB31B84D55747E2E5720CB552F10E21A66DB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741874537, "uuid": "f12da57f-6851-4909-8981-55cdf42492e3", "value": "00eb539293304c62a55a0a3a9463ce6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741874537, "uuid": "00421481-12f8-4ab2-8992-cf49e822db68", "value": "3072:/x8adlIkXDBumBr1F8WLBXIZ4mvrr4tUJR699vxcv7I4:J8a7I6Bu/6mjro9cv7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741874537, "uuid": "0ff617d6-910c-42ea-8b56-baac7270a05e", "value": 247872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741874537, "uuid": "8e1aacbb-4b18-47a6-a111-82dd0d32952e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741874537, "uuid": "a6c21bca-0737-460e-bdf9-444bb5d678fc", "value": "badger_x64_stealth_rtl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505b0f9e-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860166, "uuid": "94e48c43-d8d2-434c-99d6-9b1b2a635f2c", "comment": "Malware payload", "value": "5334cbddd1128f87308c0725d2cb012e", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860166, "uuid": "bd94a272-e9eb-46dd-8a66-aba1cfec8cf7", "comment": "Malware payload", "value": "d84f3eed419573ea0d790d2557b57eb59c064a0db605e17ef4b2a4c3f31a3aee", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860166, "uuid": "4fa7caed-71a8-4c70-8b85-ffd623b0d172", "comment": "Malware payload", "value": "7d38a2de7e7ce9c169885c9465b8d0cebb4428ae", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860166, "uuid": "4633d1f3-4b91-431b-a3eb-12622fb58e21", "comment": "Malware payload", "value": "29f6a156335a434336a8cdfb69d45b590308fa5fc4214f3bb3f7954acc1c63108310086ad86908905344d3425bb639b8", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860166, "uuid": "027864ff-73bd-45b5-a239-7811ed75d21a", "value": "T107918462DC29245283B2449DD9239952E64B43171759282BFDBCC3B42FB1432D3F99BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860166, "uuid": "6dba4ed5-1ac9-4362-b4f2-3d0f5dbc8390", "value": "96:koyxASxtyZRt+tFWrUxMij3oWBSbd/84eZ3Ufnplh/YExM0Wkt:k1A1udaw+d/84eKfpvzxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860166, "uuid": "1b882d62-9340-4f1e-aede-0b12265f338a", "value": 4556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860166, "uuid": "2b95aa58-f6ff-4c0d-8466-3c73c95ad2f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860166, "uuid": "81f9aa6e-2d2a-4ead-a78f-e43434c8fca2", "value": "d84f3eed419573ea0d790d2557b57eb59c064a0db605e17ef4b2a4c3f31a3aee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904d5cc3-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741860273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860273, "uuid": "066420ba-1df7-4d4a-aeb4-ee9a13cbe555", "comment": "Malware payload", "value": "5db1b3c2e15d011820f37cc07a4f36b2", "object_relation": "md5", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860273, "uuid": "2ceea102-630e-4f7b-8a47-30ea9ff8d465", "comment": "Malware payload", "value": "d87c109712e375489c5858448905e3c2a9323c65efeeb3a4c50f86d8c86826e8", "object_relation": "sha256", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860273, "uuid": "745d1a00-df16-4206-9bc0-d0c56a9c0ae7", "comment": "Malware payload", "value": "cc52ca75366793e54c553e3cbdcb7c3b67611173", "object_relation": "sha1", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860273, "uuid": "4d144f5b-cc29-4f02-b688-04e3d17d37ab", "comment": "Malware payload", "value": "f6344388b282dfdf12ab27acdec8c3790b7e1cace8bbc92c9c054c97139fb61f169bd12acf152fd50be03f5fdf2fd546", "object_relation": "sha3-384", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860273, "uuid": "1a9c6a49-8b11-400c-9cac-2c825deb8544", "value": "T190159D52B58280F3D285193045B6A73ADA35AB871B21CFC79364DE3C6C33591DF3B1AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860273, "uuid": "3903eead-7b72-4fc9-83d0-bafcb40cb1ed", "value": "4caa89dafd16069eca0211942fccf863", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860273, "uuid": "7f95ca73-c0bf-4b34-b5b0-03d8b837be89", "value": "12288:ScqLbHhLARLmM/wkunX0BbNtkxDsv8A99fAO6Ll7JvKU6+jQ:Sd/Hh8BmM4kEXapGA0jLlN36v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860273, "uuid": "1149cb49-6fbe-47fd-a821-76687681ff81", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860273, "uuid": "85851082-c2f5-45a1-acbb-e61616388857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860273, "uuid": "79561460-ba6b-4c8f-92cb-f9edf4a9f10e", "value": "d87c109712e375489c5858448905e3c2a9323c65efeeb3a4c50f86d8c86826e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e41ccc1-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869128, "uuid": "484b6e63-73ef-44db-8ec7-3bf300f88636", "comment": "Malware payload (LummaStealer)", "value": "3312164cbdf37c1dfb5d1b3f5d9c9863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869128, "uuid": "c79a4e87-3761-4591-b1dd-9e73803de246", "comment": "Malware payload (LummaStealer)", "value": "d88aa5595bef3c5e49ab6a408d9a15114496936e1231aced7d55a4f2052d083d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869128, "uuid": "60734dde-7ecc-40d4-ad69-2e39b0b83d38", "comment": "Malware payload (LummaStealer)", "value": "e3e8ae938c16655b4058089b856b070434384fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869128, "uuid": "459a46c9-6ba5-426a-8f95-5357c065b483", "comment": "Malware payload (LummaStealer)", "value": "1dc07471cb9ce90dfb250c459608a349d986497a69bd2a37fb90f7637c77c95b0a78fb622c62b9179aefe3f933341be4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869128, "uuid": "2c0e9188-7724-4ac6-a773-78eea9b95e21", "value": "T1DBF4D046BC92D0B7EE1638B25929E7C50C6B2A244F2084F77EDC9E646FB36E14532317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869128, "uuid": "ec9e9e41-a363-4e67-8df6-793e84f47b0a", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869128, "uuid": "eca3308a-d780-4ae7-a0de-38498ff455f5", "value": "12288:sIJQ/s2kiatVPnIpbWiJ621POPAANU/EAROpMHq1xw86W40tqTIriQX+C1K8fTrD:9BnIpnJhdQAANeQ4O6W4NMaIlHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869128, "uuid": "030d0253-e411-4882-b871-28ebce35f5ec", "value": 774976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869128, "uuid": "15436103-e923-4297-956a-69941ef512e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869128, "uuid": "6225de21-e9eb-4f44-901a-ea2be6747bcb", "value": "SoftWare(2).exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e6a406-005e-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741906638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741906638, "uuid": "ae8100ac-147d-40c1-9406-d88f438b8f32", "comment": "Malware payload", "value": "7e6cf20ad5608d564ef844fd9cea03f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741906638, "uuid": "f04b4e55-cac2-4e8e-ba86-5d7e6e21d5c4", "comment": "Malware payload", "value": "d8a641a419044c45be2bf1bf10d143a5848a5c341935501664a007df73776bd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741906638, "uuid": "0a48182c-7380-4f84-9767-f6c786ad0dbc", "comment": "Malware payload", "value": "b5f284018da2860b2676b0c1b621f01775ff3156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741906638, "uuid": "273426c5-ff07-49b1-9262-ce983ce5c4aa", "comment": "Malware payload", "value": "7627951e6e7575c2ee832367c4df1c9cf798088e8eb6e9a90dbb6a72cae6809eab87c640218c0b86aa791cdc56d92a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741906638, "uuid": "516556a6-7900-411c-bbad-b67b39fefcc1", "value": "T160B5D023F2CBE03EE05E0B3705B2A25494FBAA656423AD5786ECB49CCF751501E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741906638, "uuid": "2bec988d-b718-45e6-9eac-f0d70926fc57", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741906638, "uuid": "52135ec8-1bc7-461e-8478-4904c3dffccc", "value": "24576:1aE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH1p+mp83WcMH5JaFMWHIta3+8Fk86e:B+MRvHXrc44Ju+ekQoEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741906638, "uuid": "899b26d0-d66b-46cf-90f7-a1e19f48230f", "value": 2275272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741906638, "uuid": "f3275745-6145-480d-8369-8b03dbeaec01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741906638, "uuid": "e740436f-e685-4892-b1b4-86348ebf9e00", "value": "Dokument.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ec0646-ffbc-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741837137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741837137, "uuid": "67094f30-fa80-49ac-89f4-4fc116bba825", "comment": "Malware payload (LummaStealer)", "value": "161f970018c505b2f603ee149c142bc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741837137, "uuid": "2b3cfdff-d06a-4b30-9ad5-bc459b4ad8b5", "comment": "Malware payload (LummaStealer)", "value": "d8c6ce345bed283d96525fb018307169f5a7fb91138a4882781db8dd07878c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741837137, "uuid": "4e2ac8d8-ebbf-4909-be19-b9f8d5e812d5", "comment": "Malware payload (LummaStealer)", "value": "3a0d1535623f3c3b2efcfe15c9e111ef6226dfba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741837137, "uuid": "d7cc6587-b7ec-471a-9513-5cacc1bec16e", "comment": "Malware payload (LummaStealer)", "value": "696c77d05242654ac531c613473e617d3508420a07d062e1259d8189431df548bec42ac875601fa5ea986ec43b7adaea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741837137, "uuid": "c9e93a17-0c87-4890-a6e5-8e243e4fb6fd", "value": "T137F4D046BC92D0B7EA1638B15D18E7C51C6B6A204F3084FBBADC9D646FB36E14932353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741837137, "uuid": "701a518e-61a3-48d7-aa8c-317047cd56c1", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741837137, "uuid": "ccf67576-fcbe-481a-a1cc-2b95f542a617", "value": "12288:/IJQ/s2kiatVPnIpbWiJ621POPAANU/ocPe1Ja4AUL/t+ijFju2qsxVzJ:gBnIpnJhdQAANeX2/hB+ijFHdx9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741837137, "uuid": "70595a9b-dd7a-410a-9f4c-8328b054140d", "value": 783168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741837137, "uuid": "9780e5e5-f1ee-44e1-9e8c-feab4d641b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741837137, "uuid": "93db52d4-11c6-4362-b9c3-1adcb7306aca", "value": "Launcher_v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deaf82b1-fffd-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741865129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865129, "uuid": "d942f5eb-dfe1-4e17-a504-0366ad7b390a", "comment": "Malware payload", "value": "e025fa8354968f298af3f6ef2f22d7d3", "object_relation": "md5", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865129, "uuid": "5d04f295-ae4c-4ccf-8662-0f3d28a14e9e", "comment": "Malware payload", "value": "d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164", "object_relation": "sha256", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865129, "uuid": "3b7eca89-2fec-4b70-97a8-e5820f67e1ff", "comment": "Malware payload", "value": "b4221c83a3fffe7bc358dfc613c3e58fcc522a23", "object_relation": "sha1", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741865129, "uuid": "7a8cd8e8-cbc1-4303-b743-2d7e50becc37", "comment": "Malware payload", "value": "8399c654902f3926352ba4cddeaddb87dda0cd4a91de122cd0b1cd3788df9e4257a4693f706fb03dee03bf5cf4d78a79", "object_relation": "sha3-384", "Tag": [ { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ophibre-com", "colour": "#222B54", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865129, "uuid": "d47cd767-84e1-46f2-8b2c-0a738a7c0ceb", "value": "T125040809725520E9E9BF8038C4432A11F97174A44728AFBF07A5837A9F277FDA83D764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865129, "uuid": "c2d02c87-a646-4e5c-98a6-080244578d50", "value": "b193916914acf4f5d8cb2925a95f8739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865129, "uuid": "d2bd1d75-3f8c-4ddf-bc1f-4426dbff313d", "value": "3072:tIGcUg4CHNf5iI1azsrj5KhwQR79hqpJ0sOkg7tyCFYUX:Qlxza4rj5Po79hYJ2pnFYUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741865129, "uuid": "84e0eb6a-d047-4963-b92e-eae91471377c", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741865129, "uuid": "4b227d59-0f6b-4e2c-a03e-6c5f14fc0398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741865129, "uuid": "cf030c15-95ac-4a72-a15f-608021afd20c", "value": "ppcore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac32a5f4-ffc9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741842711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842711, "uuid": "80859cf8-fc16-45b7-8c57-156a764795cd", "comment": "Malware payload (Prometei)", "value": "97ccd770debf5378701283c2b5c0db00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842711, "uuid": "b5ee50f8-5c9a-496d-af14-78741072b730", "comment": "Malware payload (Prometei)", "value": "da410e4fe9351ee9f0d32ff8c39241498d75fda733fc9999f911c085de409c82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842711, "uuid": "83dabafa-f699-4655-8c31-ed472b4930c6", "comment": "Malware payload (Prometei)", "value": "b765fc914ec4ae89e749d27995a6fe1035b36c55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741842711, "uuid": "14f4fb70-25ed-4c05-840a-a9642299a2da", "comment": "Malware payload (Prometei)", "value": "42e036c1418d53309e9d73e973ebd81ee27fcf06c4076347a66b0a826da696cf2748e96d064714c1e1617bd77b281ca4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842711, "uuid": "98cff069-1341-44e6-b6c3-8d41074b2f5c", "value": "T1639423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842711, "uuid": "5ec3252c-f1e1-41d9-ae58-a362499e5e6b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE+:25WOSACZSV6eKRH5EPiamb4DsDwwc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741842711, "uuid": "3fb51189-a759-4f0a-8865-23b99f4af4b8", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741842711, "uuid": "37db25be-8a80-4671-88e8-1aa23b6e9564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741842711, "uuid": "05fb533f-4109-4bab-b15e-3b80e07e08c5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec1e78b-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883464, "uuid": "97af9a40-af3b-44b9-ba55-43fb1a6f1490", "comment": "Malware payload", "value": "0a08cc3661a39defcdc182acf62e17e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883464, "uuid": "01253d27-e017-486d-89cd-4b52f6388597", "comment": "Malware payload", "value": "db433f673eeacd8e905cca9ef3b283d30c466ab6afde31e53373197ee5d197fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883464, "uuid": "40e9c404-4382-4dc4-954f-4b9eacebdb80", "comment": "Malware payload", "value": "580ccc43274151726405797779500f4fe9a0069c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883464, "uuid": "9b427a12-f2ae-4076-aa11-f8cb204fbc5b", "comment": "Malware payload", "value": "92a30e341c9175362d424a4baaec407397b95b3c78f19066f15e799abb354845563963fc882bfdc91aab1274251e2dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883464, "uuid": "a9d955a7-066d-49f3-956c-da0ba69800d9", "value": "T13807335AF5D004F1C5E12C37D935A6C2C437E471EAC44A8F0A1BDF6AA858C578BE9DC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883464, "uuid": "f28e54bc-ce70-4063-94f7-933936ac2c2f", "value": "eeb9c59be65b5a0861a842d1f49817b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883464, "uuid": "2b0c0f7e-cebf-4913-b75b-786117c6d3a8", "value": "393216:cYvwa/xPKBtFlFk5zb91woDQGQ3bNkpmVqehJGFsxQrnkvDKZwdp5t:H4BNMvbcGAbNZVqnsxQbUDT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883464, "uuid": "2ddd4b36-f380-4974-a2a8-540472d3ad19", "value": 17126992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883464, "uuid": "57f3fc42-0f41-43bc-9afd-e2add79789c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883464, "uuid": "cbc100bf-4034-4e86-835c-9c0adb5f56c2", "value": "decrypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a750c9bb-0027-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883075, "uuid": "9ba5ee35-a303-4776-9e33-b345a534c45e", "comment": "Malware payload", "value": "4934f895b4bfe44f63e7e13f5d98578d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883075, "uuid": "6c5a2b64-83d1-44a0-baa3-81bf06d3d1d6", "comment": "Malware payload", "value": "db78fca7ed503d6fdd667e1eaa26a3a4cf2c4131b911084f2961556c50689253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883075, "uuid": "905baad1-a070-43bf-873b-114c5fd8e903", "comment": "Malware payload", "value": "bd2832a15681aef4d99e820ceb566776e33cfc42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883075, "uuid": "f7c0ae58-24e2-4c2d-b040-25e674065243", "comment": "Malware payload", "value": "278b4e852ebb099b68feb420ba930d44fb3d7757754ba8453d436b56bf7d40698e3ada26f382af52c4ab1bc21b1492c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883075, "uuid": "69ff2b05-12d1-440e-9a93-8ed95bf62b9e", "value": "T14907335279848C33E3B12E32C2E912C5F94BFD1A28B6992FE3AC110D5E5595C1B623F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883075, "uuid": "df642ef2-4c66-4be8-97ee-9f80be672ef8", "value": "eeb9c59be65b5a0861a842d1f49817b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883075, "uuid": "74280502-4cd2-4585-9b51-844796165ba4", "value": "393216:lM95qC7FcZp6QuOmt2KfuJt/ByMc8fdn0dvwwEn+RFdibmkAabhI:e5f7F+6Bt2IuJ9Bdrn0dIwEsFdqcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883075, "uuid": "73e3e2c6-3971-42e1-850f-d584b055448d", "value": 17125968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883075, "uuid": "40ed061b-cc5b-4015-a74e-4f8ef5d9ca84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883075, "uuid": "c3256718-bf6d-4db3-a253-2055b449f723", "value": "pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069ccec7-ffad-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741830407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830407, "uuid": "6a199ef8-5b91-46cf-b4c2-f74de61cd9ea", "comment": "Malware payload (Mirai)", "value": "6b5088de7abbb4ac371ca740049ffdc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830407, "uuid": "3055d748-c4b7-447f-a0b6-5ce32bc6e00c", "comment": "Malware payload (Mirai)", "value": "dbba1bbc6f1c0ce5737a28fff4bb9ee547ca696ec19731cfd577f3c4770989c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830407, "uuid": "5a87d297-56fa-47cf-b010-14c65a434e6f", "comment": "Malware payload (Mirai)", "value": "da3d48d1ae4ae42822f3508c19b96b0aa2abe55e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741830407, "uuid": "cf017493-dbfc-4d85-b9cc-113d550fca3f", "comment": "Malware payload (Mirai)", "value": "bfb9a727a5eb86f2cc73cbb2a2d4f8ea218f9116a327bd7f0e0f5a5cf06ff7f9874a104baa68034e6f3849dca474b588", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830407, "uuid": "d89e6426-255c-4933-82db-a8e07672e6db", "value": "T1BF131991B8829913C6D4237BFA6E418D332523A8E1EF33179D226F4177C692F0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830407, "uuid": "26563a36-ff9e-4ef3-b553-0d2c3b031f6b", "value": "768:UkIGeguxM1BjFfEn3+mOzK4glQ0C8SaDFXqTy9GMkAnLoKaRPN+OnrJyIw:UeegZjjFs28Si9vnu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741830407, "uuid": "08042eee-3e4e-44d8-b2fc-0cf036abd5a7", "value": 44740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741830407, "uuid": "838c09de-0a26-4f57-9d9a-5bd16af9e8dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741830407, "uuid": "bcdb038f-abd2-4418-8028-2b4a9657cda3", "value": "NewAge3ATOarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264c2e6a-0034-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741888442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888442, "uuid": "c388c956-caa8-495f-a831-75da2f61d45c", "comment": "Malware payload", "value": "3a78b6f8a4a9eaa1ce8968972b391c3b", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888442, "uuid": "52de915e-5952-4a93-a011-49d288c8d2a9", "comment": "Malware payload", "value": "dc1ab6309bf69430b3a715521078c588ac7b7fdb11c7bd4ff9542d243efb775f", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888442, "uuid": "af48b171-7cff-42d8-9640-a0575a425ee4", "comment": "Malware payload", "value": "05d4b747e1d4e1da90951dc410e4fd0c97561709", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888442, "uuid": "7eb7342a-3eb2-4d7b-8351-c2c0a8eca0c8", "comment": "Malware payload", "value": "7fd87b18471ab7ea2f6438ff6d5b48615551d1770872ab4eda67bdfb204336e5f53cc1a5db398c5017e60da8ddbea116", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888442, "uuid": "dd199110-54f1-4bb8-b008-d0c5b40efae1", "value": "T158F305E789C00555D9611FB81072DE7984BBAFA9FD3CF1066CA0FC677BB79C22821846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888442, "uuid": "d40db5e1-2595-4e5e-b1d9-bc14104b5f88", "value": "2196993dc3730f6a2b6d10f223e44db5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888442, "uuid": "79669e34-1c04-4e2f-889d-ed8bcb660c1e", "value": "3072:I/ldoum8ZZZ08TuYzGrbLAb7Bi9a5QBvSzb:kd1NBqrPeNmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741888442, "uuid": "e3fc57c4-fa94-4c05-b6de-4eacc872505b", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741888442, "uuid": "8ef378b9-9251-425a-9bcc-12d9a2e39458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888442, "uuid": "560a91b3-7dbd-44de-99f8-bd4ae68ce8ba", "value": "gdcjfjfgvnk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8079f597-0024-11f0-ad17-42010a9c0004", "comment": "Malware payload (RustyStealer)", "timestamp": 1741881722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881722, "uuid": "879ebc70-fe50-43df-be27-2edd25174770", "comment": "Malware payload (RustyStealer)", "value": "da61dc10ea55e0c0376fb23ce9907976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881722, "uuid": "1f4075aa-9ce8-4efb-b6c3-02e861fd56c7", "comment": "Malware payload (RustyStealer)", "value": "dc1bcd4074651a3795b8b21e93223537f5067890f1ac68e9f15d3a3dc7dd3056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881722, "uuid": "c145747c-bcec-4ccb-8d07-517f4b7d48f5", "comment": "Malware payload (RustyStealer)", "value": "ce3595e012c7106d3e9ffcea954ecb342efddcd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741881722, "uuid": "38020669-af63-4cdd-8e3b-da95f3a44710", "comment": "Malware payload (RustyStealer)", "value": "a07109004babca2cf9ea3f8d5685d7ed3a7085250775e84eaf308f910c783f9e91a3b1dc689891f31438b87ebfb4004e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NATIONAL CARE CONSORTIUM LTD", "colour": "#A8A48B", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881722, "uuid": "05caab64-3468-4253-aab9-679edf64981e", "value": "T16566221BB69992AED45AC03043575A7176367C8E0A32ACBF16E0E7383C76D610F2DB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881722, "uuid": "7d9564c4-e720-4bee-b497-32506ab9a1d2", "value": "e32e6c437dac93b0e8ec64d2176ffc71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881722, "uuid": "6c8dadb9-c6af-4aa5-872a-88b6e1e8ac80", "value": "196608:Kjx2WDcZNI8DX5og5OTL2sMsaI6HMaJTtGbo:K9hwZG+X5oTTCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741881722, "uuid": "f3d0c0ee-89c0-45f1-943a-cc2f422576e8", "value": 6987352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741881722, "uuid": "37f15800-84a5-4a85-ab98-6cca092eb38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741881722, "uuid": "3ec53166-e3f8-4f7a-b657-ee3d460befef", "value": "dc1bcd4074651a3795b8b21e93223537f5067890f1ac68e9f15d3a3dc7dd3056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe41a81-ffe5-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741854716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854716, "uuid": "258d2409-de72-4140-adea-b44a3bbd4792", "comment": "Malware payload (Mirai)", "value": "6b9389acf70c4ae3b8b738db8b024919", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854716, "uuid": "e5181757-e192-4573-9ea2-5f3971d6d884", "comment": "Malware payload (Mirai)", "value": "dc81899024959992f53b76dace00a3d2b1e08caadbb0031ba91942eeacb9113a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854716, "uuid": "ba62f66f-ce37-4fd4-a610-3353e4a2274e", "comment": "Malware payload (Mirai)", "value": "62fb2ec9becb9e95b890e17f6384ea778310205b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741854716, "uuid": "7675acfe-cabf-40db-9677-ebc6b0a7b70c", "comment": "Malware payload (Mirai)", "value": "c325ba1e9fb54783258e78d265a63f6bf2d0ff148bd2e2c1efd6e58de578415b654ef381b519d93789cef383c4abc9e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741854716, "uuid": "c591ff00-3f09-4f3e-9d06-63cdbfe0ea05", "value": "T1C851B78563840D701AE36E97E7B6792832C594E79CE96BD9EAFCBEF0024ED143240753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741854716, "uuid": "95724b08-146a-48fa-9599-8b4152b9b6d4", "value": "48:v37e7N7h3Z6G3gRzP3JKW3ToU37T7o7U3fM3b3u9R3Pcg3ypV3RSO31+C3cfT3Uq:v37e7N7h3Z6G3gRzP3JKW3ToU37T7o7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741854716, "uuid": "cd274aec-f44e-437e-9968-2dd37dc1127a", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741854716, "uuid": "3a1739ba-ad3e-4e4f-aec9-8785c79c1a85", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741854716, "uuid": "7fc80679-557a-4d18-a9c7-b912e8318f0c", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a3a2ca-0025-11f0-ad17-42010a9c0004", "comment": "Malware payload (DCRat)", "timestamp": 1741882219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882219, "uuid": "b073e472-f14a-4b1c-af07-2fd44ef899ec", "comment": "Malware payload (DCRat)", "value": "4c23ca4230f5e1957531d3a4ecc092b5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882219, "uuid": "6b94a3f5-6174-4273-b9d3-65839c57d0a9", "comment": "Malware payload (DCRat)", "value": "dd13ad8b7fbafd3e63f5c644f88623c5b1e30a08c7eb1694f9e77f5252a0d820", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882219, "uuid": "e0c093ab-3700-45a7-8efe-6e8db373a052", "comment": "Malware payload (DCRat)", "value": "621010e4643cccbb5c92208eb4a63655e5e35125", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741882219, "uuid": "466eea8d-27dd-490c-a6c2-97307bc2a0fd", "comment": "Malware payload (DCRat)", "value": "a97ac49ee83659483604ffea3ac4fea593a8fddb49fefe187a02c4e000c73577c8c843c11b3266b495b3e56ed9f7f91d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882219, "uuid": "bfe2cfd2-507d-4aee-ae99-e96902e596ed", "value": "T1B4758D0695535E72C259BB7088D7146E52B0CF372613EF1B3E2F54E2AA86270CB526F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882219, "uuid": "3efed6aa-9603-4abc-8372-57e4a0459041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882219, "uuid": "b1d18819-b565-43c1-a7d9-5caeb6ed4e66", "value": "24576:CCKaBNxP74ac3kygrrZ28V2Sq5htgWXiAGkKGMWTItaBGptqrMEk4qa9xATdE:CCbtP7O3xgntWyTFWTpBGptq2wHSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741882219, "uuid": "c59a9d16-40e6-431e-8337-75df74deef2d", "value": 1651200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741882219, "uuid": "8257167b-6b38-42af-b131-24667a1264b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741882219, "uuid": "2411b257-5916-4e3b-b92f-33dcdd6fed4f", "value": "4C23CA4230F5E1957531D3A4ECC092B5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53319cb-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849625, "uuid": "30412fc2-ee51-4f48-a5a1-37796fc92ca0", "comment": "Malware payload (Mirai)", "value": "59823da94078ffc960250d6abe2d6643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849625, "uuid": "fed2d577-e8a5-46b5-a6fc-f0813cf9d87c", "comment": "Malware payload (Mirai)", "value": "dd8c359dbc66116b6ab4b9ede357f39c4a718de02e1478d74fedcf5dd4264dc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849625, "uuid": "6fd36ac7-26a8-4543-a77c-c02c14305b90", "comment": "Malware payload (Mirai)", "value": "a69a9a27bf2d87a718f8bfd34ef7091a93ac5a8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849625, "uuid": "54abcf18-1e8a-41ce-878f-17065500401e", "comment": "Malware payload (Mirai)", "value": "7fef1e88cf1fa89bff38070d4c6490630921f1d2a9e8a198665ba2854f150b26afd0789332de586dfd487ec24ef30fed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849625, "uuid": "9f0c2a4f-a797-4c43-b3a1-de5d1e44ae05", "value": "T101336C36E029DED0C6560134A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849625, "uuid": "716456af-f75b-4294-b11f-1a622d8a80c4", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849625, "uuid": "e82ceaeb-afe6-4844-8e37-aefc0efe7783", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849625, "uuid": "703a5197-ee04-4eed-873f-4f4a3df6c81b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849625, "uuid": "c5a9113e-d7d3-4970-8e49-5aad083669dc", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cb9142-000e-11f0-ad17-42010a9c0004", "comment": "Malware payload (StrelaStealer)", "timestamp": 1741872309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872309, "uuid": "417dc1f2-30ee-4ac2-b5c0-e8b0d3bb1ed7", "comment": "Malware payload (StrelaStealer)", "value": "b78cab86a0799e78040d7ee6a661c13c", "object_relation": "md5", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872309, "uuid": "14d4e06d-54d3-465e-980f-aa8073558fd4", "comment": "Malware payload (StrelaStealer)", "value": "de10accbf325ba23a8f4550e42af20bcd56570a0d0075aafb63a7658586f23af", "object_relation": "sha256", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872309, "uuid": "6b755ceb-03c1-4b6e-bd81-cfa1b46878bb", "comment": "Malware payload (StrelaStealer)", "value": "793a7487440db8e6d8e48c5529019b0d40a87974", "object_relation": "sha1", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872309, "uuid": "4b7f1b40-a7f8-4729-829e-33efa04de4e5", "comment": "Malware payload (StrelaStealer)", "value": "65880f1e3269f45a6345c4f600fe01a898cc0105fe1efd26c349b35ecca23b9f2dbb1c5ffc6b49797c91f0c15b735431", "object_relation": "sha3-384", "Tag": [ { "name": "62-133-61-75", "colour": "#E6F63C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872309, "uuid": "b94c6fcc-49c4-4abd-8654-68dee288099e", "value": "T1EBB4013CCEA8BDC443AB72C5655E3B4E2A4C5F93F6702BACF6C314A60465204DF76689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872309, "uuid": "791ce4ba-6c5a-4587-a6cc-0a1757a8c829", "value": "6144:tHfDxJthsTECqh3bMTRfOeTWVl+z8ZM58vcLk3+/Ea0rHkko/26fmhJiIBkM:tHfDbHsTECM3lemvk0rE6/JiEkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872309, "uuid": "8b63f7a4-6fbb-4364-97b7-1bdf745c7532", "value": 528296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872309, "uuid": "55c988d4-553e-4942-aac8-46090c01a5e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872309, "uuid": "3f491b6f-659a-41d9-a6e5-98ea2ab02bac", "value": "demo.bat1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c365fd0-0049-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741897525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741897525, "uuid": "dc06ef9a-cc23-4e74-8b81-90a86bac9bcb", "comment": "Malware payload (RemcosRAT)", "value": "77c0814eaf8dddac328bfbe0838eb184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741897525, "uuid": "2d0c1e8a-e85c-4bd7-907a-fb8eaa7b6f6e", "comment": "Malware payload (RemcosRAT)", "value": "de33e7ff04e6d11f0e69bf2db0158c6f15d243352a51f6975de56c96b676b00e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741897525, "uuid": "cb605849-44ff-471d-aa12-86ca3826f3a4", "comment": "Malware payload (RemcosRAT)", "value": "ee9059aa7bb0b2a24d19c1f7d1aeaed00730d546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741897525, "uuid": "030b5416-bf72-49fd-9822-c058e0935947", "comment": "Malware payload (RemcosRAT)", "value": "4e7e2eceeb9a8ff39a087cad848c30a902a51456603c0bf0547e7c26a6d135580147ccaba476e780377a96f5d14c1fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741897525, "uuid": "b10a881c-20a3-48cb-9ff9-4365ade317d3", "value": "T1FAB4BF01B9E2C172E57654300D2AE776DEBCBD2028358D7BB3D60D57FD30190AA39AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741897525, "uuid": "1e22858b-75c3-4c76-86bf-7edd48c2ba80", "value": "41e05d591d7d93bdd5bc6d5da04da74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741897525, "uuid": "e3796384-2ee8-4c1d-ae0a-929489616055", "value": "6144:aIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZzvFXlXc6X:a200OFp+G0imvHn3Cp6qyBP+YdsvZDGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741897525, "uuid": "ee2eff77-4c51-4232-99f5-163237411ece", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741897525, "uuid": "2739493d-b20e-445e-b096-170b8fdec987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741897525, "uuid": "57e12938-7287-4efc-93ab-bdd7f84e9eff", "value": "77C0814EAF8DDDAC328BFBE0838EB184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9ca2e8-0044-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895540, "uuid": "cd037df3-8c8a-4201-8be6-7871c4229d21", "comment": "Malware payload", "value": "417d01b756feae042d9a3fe245a087ff", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895540, "uuid": "9f47544d-b533-4642-ba23-27244cf8f937", "comment": "Malware payload", "value": "de7f4d47c0f2329eb4b67510b5dfa6e0b9cb9edd5a669e987354008b57f88eaf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895540, "uuid": "ab66d704-6958-426d-a104-0e2fbde7fe12", "comment": "Malware payload", "value": "d2069c82688caf49916691039c1d339d2d9f0fc2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895540, "uuid": "0705d89b-25e0-4a2b-866f-d0d5516878ba", "comment": "Malware payload", "value": "184b63fc05822232f68b9b08c626742ce9b390561af9e111fe1f10d62981472aa103b9d80d05b524d66a94b9e7031b0e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895540, "uuid": "80bbecbd-784a-4fea-a684-cd98ff02c6df", "value": "T148369E317A5EC036E65E45B1A63AAA2FA43D6DE20BB084DBA3D0BC5B15304C39335F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895540, "uuid": "d0037060-6be0-4e56-a1e2-902379a09b41", "value": "49152:nq9liN15sBAbwjHtS5DfKFT3zGLAl+quHMlKJM4L1aLKc78DZuzkvoS9xeXf7LKE:Q8HOFT30u+oUwXXMAMsrLBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895540, "uuid": "772be675-016d-4498-afaf-b484468b0d03", "value": 5052416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895540, "uuid": "5b8ba5e2-e315-4733-9fd4-0cfc18f4b596", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895540, "uuid": "369e755a-f519-46e0-a4f9-77f09a75b2fb", "value": "Distributor Software.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cff749f-0032-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741887756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887756, "uuid": "ca4ff5ce-5218-4be5-a76b-a9f66f847344", "comment": "Malware payload", "value": "6dbabcd7373a9a7cd8fbe6c6e9a0d816", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887756, "uuid": "8d730191-ee01-4bd3-a49b-5e206713795e", "comment": "Malware payload", "value": "df971af30305bdf8634b02eaefb8bf82e41a2897bca1a477b1da438ecae61ad2", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887756, "uuid": "8423d686-25ff-4186-a55d-fd53792ec794", "comment": "Malware payload", "value": "d9969e6810ddf06a89d5c711a5daef39cb7d47b0", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887756, "uuid": "6acc29ed-a2ef-4fce-ad12-21b637b22b8c", "comment": "Malware payload", "value": "068d3ab6ed57a99a7287d5cbad161f7b38a51156e3206faef96d6c1dbf5bd3bf57a982777f21d1ab73792b22e6f5feca", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887756, "uuid": "2416407e-6b8d-43be-8c5d-9329e3de99be", "value": "T1DBA6122161619132F4B306B58D7D656D5968BF28072460EB6BCCBD4FAEB2CD36C32723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887756, "uuid": "f3661f6b-6a43-4d69-ab43-95caa45b2624", "value": "831e4fdff88bd7c34a2c252b2cee262e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887756, "uuid": "0c6c67cc-1d79-4b83-8d2a-90e8d03e69de", "value": "196608:lcSSA+rez9EYDh20b1BkBJrytOjX7sLI+JFaI39nz9:lcStos920nCytoQFaa9n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741887756, "uuid": "f0099e3a-c8cb-4fa6-ae99-64e530964f2c", "value": 9806336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741887756, "uuid": "88105366-ce79-442f-be6b-991676aeee63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887756, "uuid": "3037fb2b-65cb-4405-af8e-20b934addb40", "value": "ExternalUi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c0fcec-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741879394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879394, "uuid": "017edad4-cac0-499d-958c-4a35a224b35c", "comment": "Malware payload", "value": "74870b85ac926c53e0eaf2c42265b939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879394, "uuid": "3512f8da-ad43-42e3-a1ad-976f7fe1ca51", "comment": "Malware payload", "value": "e0db1f678aa7f880e19fc03709b0a99b15f507585f9e2bf4a44503ad68b3f174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879394, "uuid": "a5388cbb-418b-440e-87c2-4b13d4f698e5", "comment": "Malware payload", "value": "9a94434406b55ce00539fec07f1452c9d94f502c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879394, "uuid": "f8455d80-b1ad-4d60-9b36-58f3101268c7", "comment": "Malware payload", "value": "14dbbdec56cf2e280da5331db36dfc6ff73248fca7e3c2366c9953b9822b92ec02a770580147abb6c0699a035a3dddef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879394, "uuid": "0e298ee9-d8b7-445d-a2dd-0a09aae9a0a2", "value": "T110F33906B2AD11F9D1BBE23C89A24A06F7767826473597CF1390423B0F677E09E79721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879394, "uuid": "36521ab1-e0da-41ef-b175-db3171c77c0c", "value": "6dbf27f4c70fe2c8ed3e0122ba75d641", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879394, "uuid": "d3f8f3bb-51dc-43d0-b192-0ed73fd600c7", "value": "3072:98vbzyQ6Y1YXrbNK+3FNxacPEMk65RQASTWPne:9szAXNK+3FVFRQRTWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879394, "uuid": "0686e8ae-7344-47ee-9c24-32abc00c7a80", "value": 161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879394, "uuid": "f8f560ed-69f2-4e6b-97b7-a85435ea4192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879394, "uuid": "76ddc047-ccea-4e3b-8d1e-c4325a6fce87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ea8a6c-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741872960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872960, "uuid": "7d78616d-e8f5-4864-bc21-8c64953b3e88", "comment": "Malware payload (RemcosRAT)", "value": "bd77910e1cdead3cdd559950952536e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872960, "uuid": "b794583f-8b9e-45c4-aed6-a321b4a9b46d", "comment": "Malware payload (RemcosRAT)", "value": "e11a97236afde003d97440b91a471a73f59fcd2c6f40cc4dde9f7ac57e67ee5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872960, "uuid": "53554fee-c5b6-449e-8bbd-1601038ce6e7", "comment": "Malware payload (RemcosRAT)", "value": "69775eb9e64ad8e34158e5d886d3ff517febde39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741872960, "uuid": "441ba71d-530b-4180-a5d3-7894a86fb9ae", "comment": "Malware payload (RemcosRAT)", "value": "0f7a213eba51602168837bcb2bcfbdb30b70419d37e31bb146f04a5b03089f1f872731ac02876dec2b2cb3b48ee2b88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872960, "uuid": "ca4944ce-0f94-4299-a285-c2d730c66d1a", "value": "T132552364B4A0C522C9544AB1CF6ACAFA1B27BC60CED090D37A8C7F6F7E336645B51358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872960, "uuid": "47dbdd29-82c4-4ac8-917e-da7c71ba00d6", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872960, "uuid": "391da0ba-9339-476f-b1c2-a162abd34c11", "value": "24576:BiCu96e3He1zc14HWLcw2wgu1fFHgOcm8hD3go/meWoxT:BiCdQmAcvHujHgOeFDmfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741872960, "uuid": "c7fe06a5-6ddd-443f-b8c7-08e1e34638a9", "value": 1375376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741872960, "uuid": "6b734fe3-4721-4b30-b13f-7d90e94fb694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741872960, "uuid": "69efdbeb-1b76-4cfc-95e3-a7416670e610", "value": "Bina Tegas Sdn Bhd Voucher Receipts.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db085a7a-002e-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741886169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886169, "uuid": "7e8cd8c4-83e6-4700-99cf-91fb7811468c", "comment": "Malware payload", "value": "abb3a1f9959d2cad6e28c5f4828c89f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886169, "uuid": "26430c11-ea62-4dc1-997a-7cf2f1f53f19", "comment": "Malware payload", "value": "e11d5fa18b5e000654afdd60c67df0cfc0ae4146ac1068f06b20e2b59be715e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886169, "uuid": "49e2bfe7-843a-4582-89af-e88ea9a2cffe", "comment": "Malware payload", "value": "8058d6219f0cf70e8450a826bf971fcf6b7b3ed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741886169, "uuid": "097572e2-3046-471e-be4e-a99d9ea9bc60", "comment": "Malware payload", "value": "95c005e854a62a553e39de997c4a61efbc5728cb9e5eb79b0aeadd79bce5e3bb382f3102ce291b7dbd8cc927d69bd214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886169, "uuid": "dedcacbb-c211-4c78-987e-7fbdfd089398", "value": "T1B0B4E9242DFB501DB3B3EFA55FD8B8EF896EF673260A60B9205103464722D81DD92739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886169, "uuid": "3c18dd54-a958-45a0-87e2-3eafa19139a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886169, "uuid": "048c9ba6-329d-4760-aa2a-dc9ac861ccc6", "value": "12288:yu3DTkV1ilKya0FOUuQ0gH+kmtbF6W05EJXp107sd:hkGTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741886169, "uuid": "31cc6806-65e5-4d23-b638-e44339d5227c", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741886169, "uuid": "7640df4d-79c9-4017-bafc-da3392034e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741886169, "uuid": "1794bca9-f77a-4b34-8259-ce4c7e2f86d9", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d3fd05-fff8-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741862831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862831, "uuid": "45f5d9a8-2230-482f-8187-2db806776112", "comment": "Malware payload", "value": "186d294e74367b1199a81aa71c43dd06", "object_relation": "md5", "Tag": [ { "name": "45-88-186-38", "colour": "#0CC62B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862831, "uuid": "6688bdca-6d86-4cde-ba08-f34b46ed5b31", "comment": "Malware payload", "value": "e16efb74ce35f0e9741b6d6fd55460e34141fab7704307951d83fe9b921d2357", "object_relation": "sha256", "Tag": [ { "name": "45-88-186-38", "colour": "#0CC62B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862831, "uuid": "12f07ab0-4e32-444c-b0ad-f2c1ea9f946e", "comment": "Malware payload", "value": "0973e7d9115a4ba6564959e970d6c4bc8950570b", "object_relation": "sha1", "Tag": [ { "name": "45-88-186-38", "colour": "#0CC62B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862831, "uuid": "b2a6b6a9-f1a3-47de-864a-5a8a3be24148", "comment": "Malware payload", "value": "b26abd63c1e5cac49421741d27f81e13f478be74c1d1f448fed8b23058431212e2abbb05319fe25c291231b4d6b7d72d", "object_relation": "sha3-384", "Tag": [ { "name": "45-88-186-38", "colour": "#0CC62B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862831, "uuid": "0453e1e6-6c2d-413b-a852-101f0e63ae13", "value": "T153742373FFA5CA53DE0A8FB859610E729FF45E6802CAFC4D7A854810471329C53F68A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862831, "uuid": "15f879a2-1f37-437f-9792-efd4d5b1ebf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862831, "uuid": "3ef37a61-dd55-4079-9c2e-ee889d76c7a9", "value": "6144:HnUxwGOlqg8lloaOElK4wh8A909q9aE9XdKajzMp7Kuvf+feI0a3q2Hr:HUx9OYjLoSK4whhsqaE/zMIuvfsDD3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862831, "uuid": "b848908e-806b-4400-9937-2a1cfffe1546", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862831, "uuid": "68d3c1e7-7a66-436c-97e7-567817df3adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862831, "uuid": "3a83912c-e90f-42e6-b64b-ea370c03d0ea", "value": "Nigga.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8e7c98-0045-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895758, "uuid": "860fdbd5-d6e2-46aa-bfb7-bcf9638b5978", "comment": "Malware payload", "value": "b460540403634e3a59c6e397bb19128b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895758, "uuid": "b472cc56-20c8-4e07-a87e-2cb196817afc", "comment": "Malware payload", "value": "e215ec0e3b39ef0baffc97a0bccbe65bc69204e8897f524d7eacda0bd0fd0443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895758, "uuid": "c0157bcc-0f60-49d8-b6e2-864d377b8450", "comment": "Malware payload", "value": "5ae0f8f39935f98cff6b63ffe5cd3af00049bf9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895758, "uuid": "a452dc85-5f7c-47b0-b9ec-85fbb4f026c5", "comment": "Malware payload", "value": "e3a4f21cb8d0a868e98bc7a21867d37786f6fc4a1b9cc6f2d2f148f4adc21d9431260dd8fad5c336b1bbef8fc6f661b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Signin", "colour": "#FBC19C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895758, "uuid": "8ddae90a-2b7e-42b0-94a7-5193a05552b1", "value": "T1990833DDDC5D0900CFCB5BB1C2DA68841369B74D5E1138EAD09DA0FAA6A22C17C1E9DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895758, "uuid": "1d7971a0-f24f-4c38-8fed-ff72061271a8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895758, "uuid": "c70df8aa-a296-460f-8b1a-5f1224354538", "value": "1572864:ar9mj0JznAr/rCXKHAvm1HH5Ifwgvg5YcYCg1I5suddQNE0:8EYJzy/roeHiFp/1I5snC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895758, "uuid": "ac074955-3ade-422f-9444-2bdf9776ed8b", "value": 78816888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895758, "uuid": "05c49895-6e5d-4ff0-9f1f-ef89e1d70ef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895758, "uuid": "5f4fdbb6-a5d2-4bfd-911e-c00358684bd2", "value": "Setup_Desktop_1.5.4_x64_v2 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ae451c-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864177, "uuid": "943bbc8f-3a8b-4d35-a70e-82f4646511ff", "comment": "Malware payload (Mirai)", "value": "b72122ff2f32dfc35dcee033e343187c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864177, "uuid": "b8515760-35d8-41f9-84ee-2e6302a10fd7", "comment": "Malware payload (Mirai)", "value": "e230dc7bbc59541bd4fb0ee6803159a0a1d53c3d3aa3b1061e8720a2a6ab2775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864177, "uuid": "227d2612-9bdf-4d81-995d-c6f33b96f55d", "comment": "Malware payload (Mirai)", "value": "ffdb9e28650ff520490dd4ab69c430496e3992f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864177, "uuid": "062b7fd2-b219-4d25-960b-f71ba561fb8a", "comment": "Malware payload (Mirai)", "value": "7032a6f1076197c3f117a2c738c4d46360a4171f44947737230b2f669d59483092b43c10d7e21a7104356c4012786b83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864177, "uuid": "9cd5958f-2857-4195-bf9a-d600172731e7", "value": "T15E63027466935CE459821B33F8A8F5C3A19F9F34632778B676B306D5B2C05C2ABD0187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864177, "uuid": "9c813e15-f48b-4b4a-b4bd-ea75328305a1", "value": "1536:If2wavRqSDizs3dbkAQo2ENpW+a/ryLFtJzt26ZUddYG5:I7QR9D4sZkAQVA/QGLFtJi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864177, "uuid": "dfc44e4d-1ee5-497b-ac4f-f5b0692331ac", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864177, "uuid": "493e68ba-4340-410b-8dcd-139a1ec84d7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864177, "uuid": "d5ea36e2-9c32-4479-b8b9-9cbd305cf58e", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc53ef7-0021-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741880347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880347, "uuid": "97745fab-7ca7-4931-9814-e4e773914268", "comment": "Malware payload", "value": "5254989f3d494d80f56f5bce6c34f5e3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "FakeMp3", "colour": "#6EE88E", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880347, "uuid": "12e79d5a-8fff-4290-8dbd-279169714698", "comment": "Malware payload", "value": "e2bca952200eaf761e3b80ce5f232a0fe519d3617df52589f3e478e65f248212", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "FakeMp3", "colour": "#6EE88E", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880347, "uuid": "54fdeea0-4b14-4c0f-af3a-e7b049a4c39c", "comment": "Malware payload", "value": "65c171ed5ae00f81735a72b329c9036dcb7434e7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "FakeMp3", "colour": "#6EE88E", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741880347, "uuid": "1def1a10-5191-4bc1-b464-41a498a5fe4b", "comment": "Malware payload", "value": "e8417a915d1a88bd310c709cde4d2ca3ff971da8331ee71ac3c4c509e6d04bee9aca5f9714336aa627489ce9c12180c6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "FakeMp3", "colour": "#6EE88E", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880347, "uuid": "59653311-fa2c-49fc-8980-81c531065591", "value": "T199262381DF54E214C8AB5D34CFB3829D5E4E9E404E94F8DC89DD3BC809347A8DAFA964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880347, "uuid": "4e5d7b72-9cc5-4dc6-816f-98cc3a03f895", "value": "98304:Cm5nsuCmQLtjXiDShkmEcjdsQDwtGJrTH3KjRGCBGWi:CbjLFA4ds9tGBvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741880347, "uuid": "c8cf5b9f-aac8-4299-8013-96c369c1061e", "value": 4809660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741880347, "uuid": "24dbabd3-8543-4c2a-8251-9a895900827c", "value": "audio/mpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741880347, "uuid": "61b5bb54-b936-4d49-8642-12d29ea3222c", "value": "iamlighter.mp3.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5f9fff-ffde-11ef-ad17-42010a9c0004", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1741851461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851461, "uuid": "58773f1d-6e8e-4127-9ef0-6a050768f9cb", "comment": "Malware payload (Cobalt Strike)", "value": "ce929cdfdac12ae06d7aeba958bb748c", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851461, "uuid": "5893213b-43e6-48a6-9669-ce124d4790af", "comment": "Malware payload (Cobalt Strike)", "value": "e42cddd007109fe9dad5e1f083216c3e623025e3d672b2dad5526af8f4bac4e0", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851461, "uuid": "3657bf2c-c65c-4ed1-8843-1ff06e23fe0a", "comment": "Malware payload (Cobalt Strike)", "value": "9453bd538974dabbed07dfbed83b99e2db29c08f", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741851461, "uuid": "a873d340-0341-4c38-8967-c318a64b2cd8", "comment": "Malware payload (Cobalt Strike)", "value": "2a5a354488085cd95dd2114afe8180adcd25e2eb61f772399c8b300e8ba1ff9597975a3b7d911e439f7abbc7c649ff13", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851461, "uuid": "c5e3f2a9-3c55-4fe8-bc91-503b865ed99f", "value": "T148C1F70197E85B72DEA70371AE7393004769F351DD775FAE2181AD2B3E6AA400A63730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851461, "uuid": "2cc2dab0-27a0-44a3-bb8b-e898db9d0e21", "value": "48:6hoSIDeQUV6s73ZvNIMM9SOVK+srJNy5MVNMRyQPS2wC3jqbnOcrq7/bgPSoJmGN:2IDeQI6WFDOubSv3jq7UsSUy8gzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741851461, "uuid": "d3f450d4-0bb0-4836-873e-d491ffcdf3ff", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741851461, "uuid": "0baf84e2-3967-4689-a96b-1a8c9aa861b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741851461, "uuid": "c18c5d04-893f-478e-ba6d-61c4f6345489", "value": "DecryHelp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34a8ace-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849622, "uuid": "51c498b1-fe13-4255-82af-219494a01eec", "comment": "Malware payload (Mirai)", "value": "d4fe10965abb86c3049c2d38a5241e90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849622, "uuid": "da2d6c05-f6fc-4bd1-820b-e7c85c774fe4", "comment": "Malware payload (Mirai)", "value": "e444e3bb83f36fe060de61cea7978e9f66bb75b828f78a9f9eda9d9893035f2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849622, "uuid": "d160ea2c-94d9-4515-b230-7e92a0f78553", "comment": "Malware payload (Mirai)", "value": "0e2ad8fa5bbe2ef933345d7612daf9aafe21de84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849622, "uuid": "c044ec1b-ed3a-4b64-8efd-55d8cc280f49", "comment": "Malware payload (Mirai)", "value": "d0b5f2fcf184babf48d4645f61778a509588b2c0945b3c7fb3433d9d0ad7f3af471caabe2c71adc4d911428ae56948dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849622, "uuid": "878966b5-1962-42d7-a339-7a4223562707", "value": "T13BA2E01472632D66E3ED1C3DC96A821BB9671BFC90F232B679415620C94D24B3E39B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849622, "uuid": "c3d6decd-c5f3-4caa-a433-a0b98adc670f", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj5kChymdGUop5ht:UvQn4j+ZO5fKAlxFkCs3Uozz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849622, "uuid": "6a2d3040-125e-497b-a0bb-1e1265597dfc", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849622, "uuid": "686bf61b-5e28-4c41-8f2d-54360a07b8c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849622, "uuid": "a4da3701-2f56-451b-8a5b-04941c806bb1", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd856c6-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824997, "uuid": "8445c3f4-81aa-42cd-926c-e0568dd37371", "comment": "Malware payload (Prometei)", "value": "bb33ffb134ad49012850b007fefda39a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824997, "uuid": "38b85e82-dac5-4dc7-ab54-5f31c9e6e788", "comment": "Malware payload (Prometei)", "value": "e4dd86484b595b904fc5fc7753a8bdb001b8f3b9d659622c1b74a4e6c3a38894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824997, "uuid": "0e38d347-1f51-43de-b459-a785f775823f", "comment": "Malware payload (Prometei)", "value": "ca9b014e9a489e0c7a4079b527ee674efc663726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824997, "uuid": "f74979db-00af-41fc-b9ac-cdbe3553b3a7", "comment": "Malware payload (Prometei)", "value": "70926fce117094f8e050a5a9aedc235370bd2b14d28c54cef394c2ac4f6b2c2bc76905064865ddd30f13f37064448342", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824997, "uuid": "f17c7abf-dcfd-48e2-82c8-3cf01032b66e", "value": "T1EB9423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824997, "uuid": "203665da-81aa-40e0-a798-a6d299eed61f", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgp:25WOSACZSV6eKRH5EPiamb4DsDwwcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824997, "uuid": "522378c7-a4ac-4b17-8bac-a5606254a2a2", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824997, "uuid": "7e2d0393-a36c-4c5f-a3ce-27cffb72053b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824997, "uuid": "baa03ff2-d9ec-46ef-af75-546f9238193e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eada3ac2-ffea-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741856989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856989, "uuid": "135be65e-d9ec-47e7-b083-5e0a777f8109", "comment": "Malware payload (SnakeKeylogger)", "value": "906b55eae679c02012dfa19c9df27e4b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856989, "uuid": "c171df96-b27d-4425-856d-a636985d5952", "comment": "Malware payload (SnakeKeylogger)", "value": "e50337355671948435c054c46ff0ab2bc1acb920414842e34f1203c40ac7464b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856989, "uuid": "1b54158c-c290-4549-b9a7-5cf32def168b", "comment": "Malware payload (SnakeKeylogger)", "value": "1bdaf20e8504d85b1e72dd7ca29618cd8180fac0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856989, "uuid": "d5c10442-4287-4b61-ad2d-caf22073799b", "comment": "Malware payload (SnakeKeylogger)", "value": "32494cef404864519bc394075a1da7fa71ada2f639cb4c0a49e4174c544ba7d8984869fdcef5a1f8bc5cfd6fd761d7c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856989, "uuid": "49274674-778b-4ab1-ab3c-ce6afe5bc8b3", "value": "T1C4B19444BBD1F48413E36BA7C31F75D8EB58A4862EF50D4EDA44F840299C95EEAA4B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856989, "uuid": "efaefd2e-9793-454f-bad4-3f50bf851e16", "value": "96:ZMjnwoLJk6uzoVXfuCThmAYBIr/O2mej+VbfeVVd+EUMGp5Gc2xi23Cy:Sn31k6uzoZfuCnYGTpdj+VbfeVP+EUMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856989, "uuid": "620ea1cc-4306-49f5-beee-94c01dd98fc4", "value": 5576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856989, "uuid": "2dbefb78-8379-444f-86cf-8ed284b714e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856989, "uuid": "f9aabcb0-26be-47b3-ab61-bb17185b0bd4", "value": "PO-2513203-PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826c8289-ffe2-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741853378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853378, "uuid": "d77030fe-d7d3-4ae4-8c3e-d0daadf8ef82", "comment": "Malware payload", "value": "d2410703e93be61a652b92efcf42789d", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853378, "uuid": "42b09c6a-c7f1-46b1-9143-9f122d27d0e0", "comment": "Malware payload", "value": "e5255d5f476784fcef97f9c41b12665004c1b961e35ad445ed41e0d6dbbc4f8e", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853378, "uuid": "7f3c06f1-c988-482d-92d7-88bc44733b46", "comment": "Malware payload", "value": "d74004bd257f4274bdfab89e0f781aaee91ed56b", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741853378, "uuid": "f984beb0-fe28-4621-9ec0-3ed704e5e56c", "comment": "Malware payload", "value": "c8c66b5e7035a9369c0d70f41bc40ef505e433ca23b41f660062c1c4bc1a44a86a84d299ea2e99268e7b6edcfd0593fc", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853378, "uuid": "79dfd156-dc16-43be-9fc7-60151f0f08e3", "value": "T1EE5232A1FCAAA0528273C55C496AD452D20F73075A291923FFECD2113F70539E2F9AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853378, "uuid": "1ff85ecb-4bc8-4365-9a8e-85c2401ce9ac", "value": "192:dHbppzfKD7Ph4ODBf7hyYfZU+Qr+vt93bQ91qT/RSikuqM5Z45iD+KWP+2:d9FiXh46f7IyDVx0+tD+vP+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741853378, "uuid": "83256261-97e1-40fb-85c4-9603a44e459d", "value": 13794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741853378, "uuid": "122ced96-b5f4-4294-bdb3-a0e9894b33b3", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741853378, "uuid": "9d791ad2-876d-4e59-8fc5-c982a969a9a3", "value": "e5255d5f476784fcef97f9c41b12665004c1b961e35ad445ed41e0d6dbbc4f8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5ecf44-003d-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741892372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741892372, "uuid": "b7156774-d0c4-439e-83da-6889042579d6", "comment": "Malware payload", "value": "f7810b8acf829fe54d1d38a72a16a6aa", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741892372, "uuid": "75c06798-6485-4ad8-9fe3-3d48d5d46351", "comment": "Malware payload", "value": "e56f1e40371ef49fb4cb7f4c03e962320cb5f9dfb8f64172eb4fdf8088a864bc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741892372, "uuid": "00bf2afc-832d-4256-8fb2-5e93dc509574", "comment": "Malware payload", "value": "495b94384a7fef81c724799349342f2d6fbd4753", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741892372, "uuid": "d4985442-820c-42ff-9fac-b1308c047ce7", "comment": "Malware payload", "value": "999fac4f977fc6fa7b51371245ddd31504fe652a94fdbcd3dfb43d92636ea2a1434d5e7fa8c43a5c8480dd9d7c581a54", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741892372, "uuid": "7a11063b-ed79-49c6-bd75-d6b61f0fd7b0", "value": "T1FA18AF1AF90DA827DDC7B1BCAD4B02D2F322BC195710C28A3812E20DFDA77D55B557A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741892372, "uuid": "59c20fc3-a716-4de0-b283-f8bd42f9367d", "value": "786432:TMXWURbmGrVL509fNPGz0226eJ4oUkyXi5X97D6Dn3MVi7/vSdmEmuj6CiQGZIwP:TrURNrVwfNGzLeoiXI316S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741892372, "uuid": "e0032bad-1b59-4337-a942-37a20a81062e", "value": 87013403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741892372, "uuid": "3854f789-8aa3-4106-8e59-f6879d989530", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741892372, "uuid": "5030df7d-842b-4970-baed-94ff9f910b4c", "value": "HK Polling System Beta_5.0.4_APKPure.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9708ae4-ffeb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741857417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857417, "uuid": "b9a338bf-e6f8-446b-848b-863d54803fc2", "comment": "Malware payload (Prometei)", "value": "d44ddb22b9192b5b9759b022a96db12a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857417, "uuid": "3cef9df6-769f-4f78-9278-312d3efc6545", "comment": "Malware payload (Prometei)", "value": "e6640ac77d989f33523f82c13b35236862a5027d58725398f90c05ac8cd06293", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857417, "uuid": "7e377f78-ad64-4033-8f09-8d54b818ed4d", "comment": "Malware payload (Prometei)", "value": "736e4f26130dd8141abe5ba43b25ef2887b8b424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857417, "uuid": "5113d2e8-bbf5-4a1a-a5ce-6037bb779e34", "comment": "Malware payload (Prometei)", "value": "ed125dc0339bcbada4729e035d4c3cf50e692590a92eb3a8c55f5a6a43786693ac96b1df56a10502c9ec60e5c03a872d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857417, "uuid": "df6eab0f-3884-4bcc-9fe9-1968d5a04e44", "value": "T157155B653700FF5EF29DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857417, "uuid": "27e02d74-5006-4527-9900-4e49084cbdca", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplk:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741857417, "uuid": "ceb92f56-7639-4907-9e7c-681d70603bf6", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741857417, "uuid": "627052e5-fb24-499b-9105-ebcd5d5d6c1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857417, "uuid": "d8c8df1d-eccd-4b40-b59e-92b4636bf503", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1145e90-002d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741885696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885696, "uuid": "633f0c06-e3dc-45bf-b5bc-75d735087f5c", "comment": "Malware payload (Meterpreter)", "value": "5be51cf12bee67de5b633fba686a9dcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885696, "uuid": "a0911d62-02f3-463d-8994-215ed520dea5", "comment": "Malware payload (Meterpreter)", "value": "e6eccd2bee53c125eeec1c844cd3950f79e922028c7d9f83a70716a9332aca86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885696, "uuid": "338d6b76-6b94-41df-959c-440c78cb4187", "comment": "Malware payload (Meterpreter)", "value": "9dc9b3991533a4a6cf3cf4378de585c0578aa0d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741885696, "uuid": "5a0e4587-f0e4-4722-8b82-b75cd5fce87b", "comment": "Malware payload (Meterpreter)", "value": "2e4cb515e01641521becacee1dc54c9ddc5aeeb568ff9cf2fedeaefb902388a42849dc217957d22e8a4bcba2c665578d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885696, "uuid": "42d003aa-1191-4c0a-8425-bfda6b72b3a3", "value": "T17373BF86E6C01472C296227E27B13AB66570F5BF2601C19A764CDDE4DFD1DF0932A3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885696, "uuid": "4bc88d10-82d8-49dc-a2aa-8160c67cb3d1", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885696, "uuid": "36a7db86-f5d2-4a80-bf1c-97287ff94aa9", "value": "1536:IagkerVlg93uUDPjyQ46RgMb+KR0Nc8QsJq39:ngHrVlgrDPjU3e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741885696, "uuid": "14ab8f7f-5164-4fbc-a169-a394c8c83517", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741885696, "uuid": "6d9c5bc1-d623-4ddf-988f-78526f99e04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741885696, "uuid": "2252edad-76e2-47d2-94e9-7e51d0693dfd", "value": "a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8c7128-0043-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895216, "uuid": "0899e212-4b4d-4bec-bc5b-91de868c1d69", "comment": "Malware payload", "value": "e94d7c0e116ff6f55071966af8c4e238", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895216, "uuid": "407fead7-94da-4aae-9a2b-d24d41c5b0f3", "comment": "Malware payload", "value": "e70d976f524d73561644e830a62e575b6d46f3b42f1dbcdfa35450c4d15f8b6a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895216, "uuid": "ee502c6b-7206-424c-ac91-746a549dd90a", "comment": "Malware payload", "value": "4068fe314b71a564bb5debffd687bb3ccd676408", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895216, "uuid": "c155f7dd-a5fc-47c2-abb1-18db94f39704", "comment": "Malware payload", "value": "546411e2df3d58c2dc393e034549568668c1d69bfa11c2aa091478acad6b49b4eff3f4b83d9136a043f594d60ec93bb5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895216, "uuid": "a09bff15-ebf4-4d82-ab02-0feca56d9fd2", "value": "T17F872331BD9E8036EA5E44B29536AA2AA47D7DE30BB044DB53E0F85B15314C3E335B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895216, "uuid": "e78be9f7-9480-4920-b4b4-b2f46fe28f51", "value": "786432:1FT9MFm8Gnty/Tmzag6CRzev0A6k8ZY6jv31T2HjESOtPI9F:1FT9MFmdns6zaTM/Z54HYSOpEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895216, "uuid": "e5b244f4-7d4a-4354-8778-f4d12991d62a", "value": 39089664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895216, "uuid": "8c8a6dfb-2f27-4d3b-8ea2-f9213492ba0d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895216, "uuid": "515547c1-0703-4108-8df6-58c83bdfc19f", "value": "63dafd.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9e2d2f-ffe8-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741855915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855915, "uuid": "9da2d2f4-436b-410a-a382-1c13cfbfa57e", "comment": "Malware payload", "value": "b1f33d2679c6d9d125c99757cf5f3ffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855915, "uuid": "c38f0f3e-256b-4992-8f6b-40409092cfc5", "comment": "Malware payload", "value": "e7700429185f1b843b54b90211e3adda005e52bc6733e63ac8f20453f3f6e026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855915, "uuid": "756dfb53-f8fe-4889-8557-070b79288c47", "comment": "Malware payload", "value": "f257add05cafab736335b5254915c041e203c475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855915, "uuid": "b1ad5df5-3e83-4300-8a35-3d5c89e9dd03", "comment": "Malware payload", "value": "64c60a8cbeb47d000e433bc6457c32a868abb14d92b854e67998b816c60ff07c9e754217ca0dda20552d39192176d0e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855915, "uuid": "5137c84e-6b9e-4f2c-bf31-3321ea2de2ea", "value": "T1A1356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855915, "uuid": "1849216d-c218-417c-af86-faf7b3ccc755", "value": "12288:E8dASOYRNCAJump208iJftl7zmfSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsOf8+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855915, "uuid": "ef8e2ee0-8566-40be-9268-6082ffbe89ce", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855915, "uuid": "331222be-3ab4-4b9a-99da-f89acbfee717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855915, "uuid": "a76c423f-3713-4ef2-b8b4-3e3489be1bc5", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798da786-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879563, "uuid": "155b5c27-9681-4da4-87e5-be392c2a16a9", "comment": "Malware payload (LummaStealer)", "value": "0896954792978df6b6f6965593ec07e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879563, "uuid": "79b8ee21-4fb8-436a-b2eb-d7b6cc546060", "comment": "Malware payload (LummaStealer)", "value": "e771e24ff1eeecc7c4c60e2b755a469518875a7737f614621356bc4572af7abd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879563, "uuid": "fe6dd6c6-2d9e-4ac2-b3b7-9e35d0d7a676", "comment": "Malware payload (LummaStealer)", "value": "718fd59a15a6bbdaee5e847e97be5afad3e8bb3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879563, "uuid": "78b3c70b-70ae-47b5-bcb4-c91fcf6f07c5", "comment": "Malware payload (LummaStealer)", "value": "d6c16ad5b3b8d89e7197f21e37ba2affa3c0458452ac9fde10f1bffc030d80bc717b3cf4568fcb0695d9cdf5ce26fafd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879563, "uuid": "3cf6fc5c-b187-48cd-af26-dd49a091bf3a", "value": "T10BA5225D16D1BB11F64DBF33B26AB2A16D4B7B1BEF82C90C5C205B54EA7B852C019C0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879563, "uuid": "015271e8-1a8f-4069-8dab-ffb988c03fb9", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879563, "uuid": "c80e4ddb-7b3e-4d58-ade5-96993b85beeb", "value": "49152:Kmcrh4PU6ndutjFVwl0TA/6fyWTgNCVW:ls4MtJGqFfDWCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879563, "uuid": "b0afad2d-4a7c-46c8-98f4-1b128323eff9", "value": 2084352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879563, "uuid": "6c99145f-9c4d-49a7-a4fa-fb6a239a8d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879563, "uuid": "26bb2b99-d0c7-4430-b379-11d11542c568", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0acf0b1-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741855603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855603, "uuid": "86b71086-a722-486c-9a50-5e3b716c6957", "comment": "Malware payload", "value": "e7ec8558cdf94427b39b403c22d993bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855603, "uuid": "e0c3b8a1-e12a-4b4b-992a-8f5818886a8d", "comment": "Malware payload", "value": "e86d441310dddc45480ea94f4f67f940250b98edde929cf715f6c54330ac1dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855603, "uuid": "340e48bc-a089-4466-80d9-fdf16be1d7fd", "comment": "Malware payload", "value": "04f0cadd3b2bb0555f45eb485d190598c6dba1bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855603, "uuid": "71854495-6e80-4fcd-8509-d7addef8a1f4", "comment": "Malware payload", "value": "5157ae51a741e6e7957bbe554e67a68f43bf2e14c030e6d05fc6953f80e35965f7444ca6098b92d1158b4b261531f267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855603, "uuid": "394b23da-d3f7-4751-ac7f-b90b982d3cc1", "value": "T1A3C6AD12F2FC01E8E5BBC178C9674517E7B278151720A7DB56608A692F37BE0AE3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855603, "uuid": "eb86cfab-6903-47a0-9d14-6201cd3c5053", "value": "43625dc3dd4e61b5fa5bcbcb6bbcf38e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855603, "uuid": "f9d2d61e-2547-43aa-a468-eaff363818f8", "value": "98304:M14bnz4wPFpAgxInF/Ob79oGsgEzmyQ6CRa6S+jPuZTc:g4V7KF/OPWGsgEzmLfRa6S+jPYTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855603, "uuid": "ec1a7602-a4ef-4241-9e4e-cba0c11ed42a", "value": 12137422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855603, "uuid": "45ef33e6-ff67-4e5f-ac3d-972da414b5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855603, "uuid": "6cb96e92-d4c9-45f5-8ae6-1e8d4dfb78ef", "value": "PrintSpooferNet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21327845-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869107, "uuid": "655f255e-256e-4e03-a938-35b2ddc7b2ab", "comment": "Malware payload (LummaStealer)", "value": "28ba19e1dcaeb26263becc4ee53ffe66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869107, "uuid": "d77c2573-e2cb-43b0-9e89-743afce17b8c", "comment": "Malware payload (LummaStealer)", "value": "e882d7327d79d9aff5d4c30c0c3b102faeabdb825fa004593518984b16d1ae4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869107, "uuid": "d753bfa2-e1ec-40e4-8088-f8f256b60bf5", "comment": "Malware payload (LummaStealer)", "value": "da456332601815ce52dcbb2908d1b23b3547aab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869107, "uuid": "872409a3-0993-4352-aa53-19c623e488d1", "comment": "Malware payload (LummaStealer)", "value": "d7b03521b69fa0a8caf0349af2ad5d2311a33b9f037632831db94a2e227ac8a2f6a9b8ebca29de31526cbb94df1ca5ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869107, "uuid": "b8a77242-2b86-4d7b-8138-a60f16c1e4ce", "value": "T1E455E07270C5D073F68199B23598E375146BF672DE2E0FC7A2B4E7789048AC117AA12F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869107, "uuid": "71ba330a-75a7-46b3-914f-ad493f85f70e", "value": "d462aa757f68629e41b3df6e6d4c6a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869107, "uuid": "3fd201fe-7cb8-4f7c-a008-da27af6d0bed", "value": "24576:QAi/c6dNtEWZ4B+UsxoxbzmXt68/9o2fjy68/9o2fj:20qNtnKB+UsxoxbzYtfoMmfoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869107, "uuid": "85d45532-ef55-4ada-b2fd-f2fdb53197f0", "value": 1365504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869107, "uuid": "062ac8ea-d0b3-4fba-ab78-c2cdc9e3c0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869107, "uuid": "0faac5ec-f69a-444c-b797-ed8266ff1d6a", "value": "FortniteHack.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0848b2-0044-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895455, "uuid": "918b6427-88ee-4922-8706-bbaa04a17988", "comment": "Malware payload", "value": "25cb3052628ee1ab814d08611f3c705d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895455, "uuid": "80070026-745a-4060-aba1-48f253d90354", "comment": "Malware payload", "value": "e897c978dee5e96b41276425cbaba157b69e37709116a65133a3d5ac59b9312a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895455, "uuid": "e62a4eb0-33b4-4d34-be79-94ca1b90fd7e", "comment": "Malware payload", "value": "557f28970d7039b66efc14dabbd610195549fb8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895455, "uuid": "e21e0d1e-5728-43e4-878d-04fd7cae49a0", "comment": "Malware payload", "value": "685063d30c8ad3a6365f03eb90247646eab802bac3bf69bbb7f879912b0ffa1a89d621225015e14d804f86f44684b052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895455, "uuid": "5a5ec91f-d425-48f3-836d-18ea07285345", "value": "T12C96DF21B68EC82BD56615B01A2C9AAF912CBD350F6148C7B3DC7D6B27B45C30633E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895455, "uuid": "6a24ff7a-e735-44fa-a26c-ae157333f410", "value": "262f7b623746b414d0e9c48c1d61145e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895455, "uuid": "3fd06524-f818-4ac7-a63f-aca9bbc9f108", "value": "196608:w0Fxb8yuO+JLA3DUuWsKj5TKzhrBglfBdAnBa0:w0Fxb8yuOgU3DUuWJjtKzhAdka0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895455, "uuid": "df4fdb7a-bc0e-4860-b03c-0da911004c8f", "value": 9447256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895455, "uuid": "9468128a-13f6-42fb-a104-de018bd7f105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895455, "uuid": "66b05358-20ed-4ac3-9478-256b0f095bcd", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055798f3-ffe0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741852309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852309, "uuid": "7f91ca70-5589-47f7-904a-a5ed2f5f0fc2", "comment": "Malware payload (Prometei)", "value": "bde6928b78cf62e0e4d14a3b0e7c1d1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852309, "uuid": "994804d7-edbe-48f4-8baf-21f935c4fb21", "comment": "Malware payload (Prometei)", "value": "e8fa7675e4a33d01047b9c956bc1b71a5563b71801d542e2ff346e1fceef0328", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852309, "uuid": "d8b842a2-ac42-418d-a80f-6d2c879c04b2", "comment": "Malware payload (Prometei)", "value": "d529562298669b76e6f28aa174cff3f59cba0873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852309, "uuid": "ea1be531-bc41-43e9-b1ea-aea003225c4f", "comment": "Malware payload (Prometei)", "value": "adbc6fe30a0670190edab961983fa461c10e1296aae49588470515d8daf03b083c7265b017e819dc37137e5aa561e17f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852309, "uuid": "0bd62458-2934-48f4-b712-57f993117f7d", "value": "T1D29423F8C83D2E3098169B3CBB5A8268F0A15772D9562F7AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852309, "uuid": "f50c0e16-361a-4f13-910f-4c0fe6b4f759", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg7:25WOSACZSV6eKRH5EPiamb4DsDwwcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852309, "uuid": "9fe31e22-4ae9-4490-a58c-77888e7e1483", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852309, "uuid": "ba56744c-8b27-498f-a484-99734b61181f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852309, "uuid": "ab5bb7c7-2501-4816-842d-59fd1a8048b8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5be3272-0043-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741895152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895152, "uuid": "b364d61f-4ab4-477e-b5c7-fb45c0c61f21", "comment": "Malware payload", "value": "d3fefcb061eae4661e717f5d721eaa49", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895152, "uuid": "4df0c25d-cf3c-4677-b329-b124d7d1b34c", "comment": "Malware payload", "value": "e900e5e53c1ebb06e5b8c51a026eebc5d457b6a8f7d4153e87cb513daaae62af", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895152, "uuid": "02c9b2d6-53a4-47d4-91a5-0986ed84dfbd", "comment": "Malware payload", "value": "f6a727a92b98580b5e1310a0ec1da55602153ea0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741895152, "uuid": "a1e501fe-2e76-47ac-b70c-b33645f16070", "comment": "Malware payload", "value": "2f3b70a2feee978c2faa74fd1872dc2e0e012b874d5f0630d86335cc146e655141e88ceafc8749c045afb0fbda2770d3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895152, "uuid": "b1f4ae57-9db7-4f82-821a-5d11481b7acb", "value": "T1EEB73331B99E8136EA5E44B1A93AAA2FA43D7DE30B7044DB53E4F85714315C3A334B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895152, "uuid": "3714503b-2d37-48c2-9a9e-986053ec4063", "value": "1572864:bFTalrePp7j7j4o3nipMi288l2R+3jUZFPohQAhI:bFTal6rng2FcR+TygaAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741895152, "uuid": "a2b7e6e5-a327-4eb3-a334-42d2c1443d32", "value": 51272704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741895152, "uuid": "d49b017d-88ff-4e26-890a-f1ba94de4156", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741895152, "uuid": "6c28b5ab-5871-4345-9bb3-60496eb197ee", "value": "setup (3).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a585b917-fff4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Adware.Generic)", "timestamp": 1741861168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861168, "uuid": "1824fb53-c1a4-401b-8ed0-b8618fe87e56", "comment": "Malware payload (Adware.Generic)", "value": "b6f0b9c984f7ff34a994d0a7d05129eb", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861168, "uuid": "cb74ba48-585e-44e8-a0a9-1cfb2cfb326c", "comment": "Malware payload (Adware.Generic)", "value": "e9127b9276a0c66b91f23a9c9dcfd59c9e409f376963e4c49d4eefa7b89564cf", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861168, "uuid": "e79dcf05-7c20-4a2f-ab60-ec241b85680a", "comment": "Malware payload (Adware.Generic)", "value": "ac0acc569ea2179c0ddb91527574d513782e7efc", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741861168, "uuid": "914cf457-4478-4202-b2b3-fe5aba3fe1fb", "comment": "Malware payload (Adware.Generic)", "value": "d9fb3c40c0ec8d9c9cec7cec37740c7aa01d6cce84a3365991c202bef27917e3f5589c79d109b87a31c08624a778d5a0", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861168, "uuid": "41eabacc-a65e-4da1-93e6-f31b05ea735e", "value": "T1E947333BF128623DC5AA1B7149728260997BBA2079198C2F47FC341DCF765701F7B62A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861168, "uuid": "81753e42-cdbc-424b-85eb-28079255b72b", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861168, "uuid": "61d6c26f-7911-4e59-9f62-25105960e058", "value": "393216:yzwMTLOzefF7chgxQy2A4u+ZvgKEzecO2WFkBpk7ibQMpdf25koG+dyo9n:yzNTLOafF+gy9gKIecO2WFkKfMpBKFZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741861168, "uuid": "e38af767-0eae-4ea4-9be6-cb797fd812d1", "value": 26309544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741861168, "uuid": "3fa119ca-e4e6-4c64-9c7f-81d4a085a7cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741861168, "uuid": "d77f8f04-1a68-4bd5-a166-81762ba8a889", "value": "SecuriteInfo.com.Java.SuspAttach.21407.13567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed60ecb-ffdf-11ef-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741852030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852030, "uuid": "05a5ae0f-f749-42ea-942e-9394f0e945f0", "comment": "Malware payload (SnakeKeylogger)", "value": "d18ab5998c51922215bf0210b3d47491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852030, "uuid": "9a31c979-0b79-4335-925c-62ce25e61f3d", "comment": "Malware payload (SnakeKeylogger)", "value": "e91f580c44b75485d8742039aa469e5c979e44db9d8fee5f2017e4f5c7cc0796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852030, "uuid": "4310e4bc-ccbf-4b0c-89ca-52eaac71784e", "comment": "Malware payload (SnakeKeylogger)", "value": "0e8e9cad6aa5715dcc0daa67782cde0ca8a971ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852030, "uuid": "47bcb70a-cbd5-47aa-8ada-710f7fb6ae6b", "comment": "Malware payload (SnakeKeylogger)", "value": "394fd2b9e3e1037fbc4fea2e02adbcba4a7583ab74038c8a161b1904bb155fb47521aeb6dcf1dda92d559c6f888d0fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852030, "uuid": "a2587b6d-c6c4-43a9-9c04-2b7c520d82de", "value": "T192E412A4A659EE63EFD807310932F3725768AF4EF5118383C7DCDDE77400666B60829A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852030, "uuid": "18eba56e-de82-417e-97e2-90f2d397723a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852030, "uuid": "a0ee43cb-0385-4d1d-a0c6-e3d6f08d2d76", "value": "12288:W5MOiV1fe1AfVyr5xBlLxkj6Y/86xqyf63kaXGIjrAhdxXqkEtfFFK3Ts//:W5MOiXfYAfVG0j6CPEyf+lX98LqtFCsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852030, "uuid": "501b2987-b999-402c-b06b-ae3f27d6147c", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852030, "uuid": "b73c348c-e160-4e2c-84a9-fa6d151e0b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852030, "uuid": "ad7dee38-74bf-4d46-ae6e-0429f02e48d0", "value": "SC110-11\u3000Order_Z01G-00008D Siparis PO15804-25 - H64PO1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48dd96a-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Meterpreter)", "timestamp": 1741855610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855610, "uuid": "3720af39-b533-4b81-8504-c32f280a1917", "comment": "Malware payload (Meterpreter)", "value": "f1cf38befb158fd1a899d5c0fb0a405e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855610, "uuid": "63fee72d-120d-4e43-b5dd-91a425194150", "comment": "Malware payload (Meterpreter)", "value": "e935942f50fa4dbbd692c5feaa02ddf29cd3eb40898ac6b97b688d19a1998385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855610, "uuid": "5ed07f07-dde1-4d52-af1a-9384e3886865", "comment": "Malware payload (Meterpreter)", "value": "6c3e30c892c98266e2eb42411a716d45788fad98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855610, "uuid": "0e92da0f-2a95-4ec2-9f2e-f43d7d700ad2", "comment": "Malware payload (Meterpreter)", "value": "89ae871985c2b94ef0d0d43611027f716017d85dc70e0152d69e3ca05c6f136c4a1ebe3bdc63cf89657408f611751d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855610, "uuid": "6550d5b6-e414-42f6-9a65-643e564d2346", "value": "T1B3E16543731548F6C894053A46A6F457745E9B213F1FD2EA9E18030B6862015A975646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855610, "uuid": "702e2408-3667-4a21-914f-38e64c30446f", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855610, "uuid": "357ae715-b38f-45d1-b1cf-043f68e66fee", "value": "24:eFGStrJ9u0/6Ok2/nZdsbBQAV2G1YhNYKQxaRwQeP9JbuqiksvcQOpmB:is0a2b4BQWqhNY9QeP9Jqqilk6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855610, "uuid": "130e7f66-4993-4d47-b1c3-28c8fe19b697", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855610, "uuid": "dea6f933-d9eb-4ce8-987b-9da5f8b1fe04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855610, "uuid": "1013d492-f87c-456a-afbf-7b2f5c0cf618", "value": "443_2003_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24996c4b-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879420, "uuid": "007bbb61-3e04-47a9-b5c6-1402f58cc7db", "comment": "Malware payload (LummaStealer)", "value": "b689eca05ca79b008387a5115c61f71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879420, "uuid": "507b0c1e-1348-4ba6-a884-f67d129e6684", "comment": "Malware payload (LummaStealer)", "value": "e9660d4168ce54a90597be7d9fb93e6f64b62b4b922beead20e06b823f15d35c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879420, "uuid": "bb8fb175-8ca1-4037-95ec-2d42ff3dffa6", "comment": "Malware payload (LummaStealer)", "value": "7a4cf8520f18130b4e434e536178ce67e3275edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879420, "uuid": "7d39bd12-a203-4c71-8cdb-69d1907114d5", "comment": "Malware payload (LummaStealer)", "value": "3ad294fbb9b0cb245c590c2fcedd6d57a55999d29db085002b2399ddbada5fda69f8d5c4860a6241d83301a66f550bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879420, "uuid": "df186453-6104-4d84-8b0c-1834b3371b79", "value": "T159A522442E736C8DF57E24F5611E0541FA8FBB346529B9220CBA2899E3CF431D9EF069", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879420, "uuid": "fc23b0a4-c392-405c-aff2-8fa5295f4adf", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879420, "uuid": "91841824-cd6c-4fc7-af79-4a576c2289cd", "value": "49152:YWO4lneR0Fl6rB3MNgTQLgB3ptDNv38QS:rOiRFl613MNHLgV5MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879420, "uuid": "5f548f2e-cbb4-44d6-8b30-7380944a833a", "value": 2108928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879420, "uuid": "5a32826d-adc0-4fba-888a-1b2b589737b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879420, "uuid": "d177e7d1-f3bf-4861-bc7c-f4c9704d0f9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ff82a0-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Gafgyt)", "timestamp": 1741833408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833408, "uuid": "87ffb023-8289-4392-875d-b374a21134c9", "comment": "Malware payload (Gafgyt)", "value": "10724555b29798b09b18b57a1d5ec9bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833408, "uuid": "e5d57aa3-b0cb-42c7-80c7-e7cd532bd58c", "comment": "Malware payload (Gafgyt)", "value": "e992a6fce1eff34082ba0f84a201c8c92a20be2feb7eff6f5bdca8ba78d7677d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833408, "uuid": "7910d140-2bcf-4d79-930b-022abd81cee6", "comment": "Malware payload (Gafgyt)", "value": "08d402d8d8ad2f5cfc134593244f76c02e0dc014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833408, "uuid": "775a6f11-11db-47ec-a2d3-c4f46d909c62", "comment": "Malware payload (Gafgyt)", "value": "ba232bcd656f591ea835e47edaa37d7029bbbc90dafad9f41f9654d43b1dc3311b2ed101cd4cc0f20089f003f6d58103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833408, "uuid": "d0308a21-edc4-414d-9166-df0e34b034e1", "value": "T17B43D51AEF504FBBD8AFCD3746AC075234CC650622B83B797574C928F25A54B0AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833408, "uuid": "918a329c-f86b-4430-a879-8db662975019", "value": "768:ju9KBgaFKH/Ed4FzVvve/evetVeqbIzOawxfQYHqZfz/0XiD2s22Te6pI:y97FzVvvuiwV9RvZJHqZzl2sjT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833408, "uuid": "9044d037-eb67-4ceb-a29d-267172f00729", "value": 59824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833408, "uuid": "8c8b166e-38a2-4cb8-94b4-ea7f19fb9656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833408, "uuid": "9fe69657-e896-45f4-aaf1-3f6e5a3bca5e", "value": "miori.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16682a77-0029-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883691, "uuid": "b647eb04-cfde-4917-bebc-75b9c7472416", "comment": "Malware payload", "value": "4268280c4b6f2561bbe0c7a1dc5fca85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883691, "uuid": "bf7ed40d-6bcf-4469-94c2-fc5a68e010a4", "comment": "Malware payload", "value": "ea3dd73219c50dbd7a58496c93529c0e2475e97f97e6b3c01ce0dddc337e4afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883691, "uuid": "7fbd8146-3d63-44b9-9a9a-ee7a6921c61b", "comment": "Malware payload", "value": "a17cc64efd96044ea2083442c6cdc74e8bdc10dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883691, "uuid": "3c9e20fc-db76-40e2-b242-9e3885a446df", "comment": "Malware payload", "value": "391351d7377e3306f255c1520737e5544b5441d820d70aa04639cb39fcef9b8194fd3bd3f1a330fe1f9c8a39fdf45ae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883691, "uuid": "e909c449-e2fa-4e03-8851-77b9428e4b1d", "value": "T129A5D023F2CBE03EE05D1B3B05B2A25494FB6A616422BE5796ECB4ACCF351501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883691, "uuid": "fb633deb-3492-48c8-ba1f-3b76b7e32913", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883691, "uuid": "77a0c4a6-3494-48d3-91a8-9c9f70e8fb83", "value": "49152:LwREDDMRMjVxXQ7Y8cY3ftiaOXziJD+QzMm1RBoBVtYHqgs:LwREtjTQ7AY3FMi9+Q4m1PQKqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883691, "uuid": "7670b6c4-729a-4815-a478-faa5fa7a4703", "value": 2241384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883691, "uuid": "e53051dc-9790-481a-8ea6-ca10ea56d8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883691, "uuid": "db7472e1-1413-45ab-9e85-f49244cb512b", "value": "uldpsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e47182-ffd2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741846616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846616, "uuid": "5fa1836b-915c-44ff-b73a-b28cc7a916f9", "comment": "Malware payload (Prometei)", "value": "a75364da05628ecc0b5582e77321101f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846616, "uuid": "30b8b25b-4235-4c4b-9542-06ef888175d9", "comment": "Malware payload (Prometei)", "value": "ea60d28dc4f2900107c9c478a246045c3c2f65343c18495d7bbeeae9a5e19085", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846616, "uuid": "475a917d-f963-467f-a9c3-de79a84fd469", "comment": "Malware payload (Prometei)", "value": "bf4fdb08e3dddf5ca5e28ed5d736609f3b78206c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846616, "uuid": "661e2a1d-23e8-41b8-b7b3-8f373fc4f8f8", "comment": "Malware payload (Prometei)", "value": "836d4cb0bb2cbc496d5c2e8efcdb1c881de2ecf629968b2562afd4a1e72922a6702a160dd3345faa4ef3c2211b092efc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846616, "uuid": "10444980-4ce7-4384-80fc-1ec5710e613e", "value": "T1C29423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846616, "uuid": "0c79978c-448a-4fca-aa63-a8f13e1c0c27", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgY:25WOSACZSV6eKRH5EPiamb4DsDwwcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741846616, "uuid": "46c9b007-a5d8-4042-9cbf-04c5a0f85f23", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741846616, "uuid": "f2adda2a-7110-4f12-b2f5-461734e84e92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846616, "uuid": "3f8d303f-146b-43b7-af2f-2e33182eac75", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa57955-0043-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741894954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894954, "uuid": "f88bdbf1-4581-4add-ab27-ac757e734407", "comment": "Malware payload", "value": "8525afb7131aefe09450621b340e4119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894954, "uuid": "479d2159-65a1-42c0-948c-a0165fc4d71f", "comment": "Malware payload", "value": "eb06513f80b7bdd459916da5a7b1692a8527e1ef0ac3a0f3ea3f7177619b121c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894954, "uuid": "69e0b18b-fa36-4c4a-8239-4ebb74212e66", "comment": "Malware payload", "value": "9b340fd2ad5f649dc88c3ae099187806224861d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741894954, "uuid": "89a324c1-df70-47ad-b20b-b23d6e22d6b5", "comment": "Malware payload", "value": "c8285e21d52176833eef613eb42cd380bcdc4ec9ec7f26736d807ec1eb58c76eca2c27c63a9ec376e015d28e3f74cef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WINSTA SPORTS PRIVATE LIMITED", "colour": "#58161A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894954, "uuid": "6443ce44-ceb9-42c4-a674-03aedbd3f72c", "value": "T1B0C69D12E3FC01E8E5BBC178C5675927E7B278551720A7DB22648A692F33BE05E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894954, "uuid": "abb6f54c-6adb-4b0d-a709-49977cf78f62", "value": "4b1892ce4fbcfcf064c6f69d693fc6a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894954, "uuid": "36975610-7dc4-4d90-89c6-7497b6e16da5", "value": "98304:27tdyiF5UESXlGD469gGilFvjFEHesiZYNlQ4GJmfZys1iaumKjf9fGPpPg:2ZdyirGA46KGiTjG1XG8ZpTumKjfVGBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741894954, "uuid": "41945c44-b18d-4643-9ff1-5913c670089f", "value": 12330888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741894954, "uuid": "30c38a33-964c-4961-b21d-1c0a9a4aeaf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741894954, "uuid": "3bf8a04e-b032-4fa4-86e5-ce699e9ad75b", "value": "MSIInstaller.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fe217d-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824985, "uuid": "2e645607-3f24-4b90-9a45-5127fa62016e", "comment": "Malware payload (Prometei)", "value": "8156651623c3b4badb3854d1b5ecd719", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824985, "uuid": "e2200b73-b879-47dc-afd3-ae12cbf6842c", "comment": "Malware payload (Prometei)", "value": "eb1225cad6d6cafaca678853e13be484079c0b0a81f5abee3e7ef6c6d8df8519", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824985, "uuid": "c8ce043d-30cb-4108-9dad-9291c4368028", "comment": "Malware payload (Prometei)", "value": "f1ea9ba1e2cb59304a92bfa0345834bc09533e41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824985, "uuid": "2b93a16a-91e3-4b32-9dbb-dcb1a2148376", "comment": "Malware payload (Prometei)", "value": "53a330dc534cbfb10eda1253436e020cd78557c826bbd228a85964f9a804ed142254307c01987e7693cd69b6934f0045", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824985, "uuid": "5b68293b-cc2a-42dd-8d75-6e58e8f3a7e6", "value": "T1E29423F8C87D2E3098169F3CBB1A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824985, "uuid": "195156fa-6b56-430e-8508-4a7b64235266", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitga:25WOSACZSV6eKRH5EPiamb4DsDwwcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824985, "uuid": "49a26baa-43be-406e-a5db-f63a1487071c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824985, "uuid": "e03b2a3d-7890-4a49-a487-428aa5d160bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824985, "uuid": "3bc59fe0-3807-462b-8014-7de539421c1c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862defa9-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741825038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825038, "uuid": "79acb872-9e7d-4344-82ca-b2ce566aa709", "comment": "Malware payload (Prometei)", "value": "8edb5d820aa8074eb970c8e754353fa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825038, "uuid": "0046859d-66a2-4fb0-b321-422e626d13bb", "comment": "Malware payload (Prometei)", "value": "ebe1415642fc9e01b3402343e5d22667afb31334a484264d03f56e7b6ec2dbf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825038, "uuid": "6aece6ef-ecee-4cb0-af06-8eae0e6a5467", "comment": "Malware payload (Prometei)", "value": "9ba7fac080a1b4057a2bb5a28a10b043f46b89c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825038, "uuid": "9865fe4b-b72b-477a-9fbe-4fb9d1a5af93", "comment": "Malware payload (Prometei)", "value": "0c3d1a03cb14c3a6557ff4718e931f6e100ac0e36851f96bdd5a77527d8f5963a9313250f3098437f024221b5b975a0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825038, "uuid": "52efce03-b16d-431a-98fe-d719d0f5dc5f", "value": "T1889423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825038, "uuid": "0a36ed86-b8fd-451b-abcd-475bbe36e554", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgk:25WOSACZSV6eKRH5EPiamb4DsDwwc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825038, "uuid": "294574bb-c00f-417c-afdf-f2321a65564d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825038, "uuid": "2ab6f954-5292-4a08-a219-ca77e9f3c509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825038, "uuid": "6e1a2463-152e-452e-9c14-59b882208777", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c071fcc-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824994, "uuid": "a66ca5f3-2365-4376-9c5f-d160915bccbb", "comment": "Malware payload (Prometei)", "value": "911e5a5146facdc68055f8577cfbb6e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824994, "uuid": "50861a0e-688e-48e5-a33a-79121b7a4f54", "comment": "Malware payload (Prometei)", "value": "ec2e622a9b91392ce971adc4cc08dd98d62b92f40fd1a22aa0593325306f9ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824994, "uuid": "325138b2-d51a-4086-9fe5-239b0846cadc", "comment": "Malware payload (Prometei)", "value": "9231fd3199797105c7d7a058d30bf5f501d6db76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824994, "uuid": "2c780db8-7225-431f-94e7-73ccbad9fade", "comment": "Malware payload (Prometei)", "value": "4a9cdf7deb17e251afab20ccd1e3dc46b0deff1dc1264bf870e56f22322132b54697663c9a562a3d341658d23ab8b653", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824994, "uuid": "b9ce1ab0-272b-49a0-ae18-5469bee76dcf", "value": "T14A9423F8C87D2E30D8169F3CBB1A8268F0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824994, "uuid": "d24cda76-dbbb-46f1-98ed-31dc5b3a5851", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgo:25WOSACZSV6eKRH5EPiamb4DsDwwcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824994, "uuid": "eec805a3-0c89-4e58-aa04-0be897ae7257", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824994, "uuid": "054d66bb-a552-4d3e-8d79-88c13dbe9b7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824994, "uuid": "cec10c85-48be-4d87-b811-0f7c29e743b0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9089c5d-ffaa-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741829499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829499, "uuid": "993e5691-2f7a-4d75-85dc-95ba8d36ee11", "comment": "Malware payload (Prometei)", "value": "3581b848d55584810aff6648323bc6c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829499, "uuid": "4e6530a5-27b8-4c82-92d1-19a9b9939bdf", "comment": "Malware payload (Prometei)", "value": "eccd0a464dd909b01ca9a8de54623ef0ec4512e784c8f8b0dfec43162a8482d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829499, "uuid": "40940102-38b6-4338-b9f1-c8f678f483e4", "comment": "Malware payload (Prometei)", "value": "581d8450100531ef23610c21bfad41829a9fbb7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829499, "uuid": "32a56afe-789f-4b1a-ae4f-22e014cac248", "comment": "Malware payload (Prometei)", "value": "22d5bb6504d1f1a3ef47a3379dc9a3c8cdd719106ad1ff07e027ba73f9eed211e8e825d50c67fbd14550da3b7ed6d292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829499, "uuid": "d4cd884d-ee2b-45f6-ae2f-511ed03d6d2f", "value": "T1D49423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829499, "uuid": "2a68ac72-7e28-47eb-bf5f-ee2adab87fec", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgy:25WOSACZSV6eKRH5EPiamb4DsDwwcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741829499, "uuid": "ea018041-75e9-46e0-8143-d836bf13fd7f", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741829499, "uuid": "48cddf25-7021-4da8-9dad-0bccbbca911a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829499, "uuid": "d22b042f-c5f1-4cf4-a4b7-31b3952a8d05", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ab6769-ffd9-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741849621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849621, "uuid": "6c52fdbc-d81b-4def-81c5-6c797eab60ba", "comment": "Malware payload (Mirai)", "value": "76ca907a40efc01b06ad929261710e7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849621, "uuid": "9e5500d7-faec-48c9-9e22-12f12fc979a3", "comment": "Malware payload (Mirai)", "value": "ed19853ec713d8da478dd870f47f05b5de75a7d38a32d2b4abb645c9157ae3f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849621, "uuid": "ce26f1a7-b898-46f1-b8e8-f9502c830a7b", "comment": "Malware payload (Mirai)", "value": "88ca02690865f963f00bd2f86ecd14f8c411a7cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849621, "uuid": "ffa67128-ce05-4319-8b1a-050d166de257", "comment": "Malware payload (Mirai)", "value": "90e919d9927bf4323d13ad127443a5ee63353a4aad6d8740ea572f3a56bde901820eb88548ad9ef1cbe550609229d8ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849621, "uuid": "8a59c056-449a-41a8-80da-c1a73e1b28b0", "value": "T1BBB2D03C1B121BA8DE1EC0BD83AC1B2138B41B2591429D4B6207FDD3AF9B8747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849621, "uuid": "ee635546-4171-4040-92e4-6b9386def92e", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiLsCmdzJgGlzDpH7uNj1JN:neD8ZSWvZHZbs1row697qohQvg9wCizi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849621, "uuid": "d785bb7c-65a7-4aff-836f-b75caf8ef4de", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849621, "uuid": "02917072-62e7-4bdb-88de-c4955349d04a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849621, "uuid": "e93b6f16-f538-4dcb-8e9a-380c06c4f150", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8acf0a-000d-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741871894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871894, "uuid": "984d7266-ad3a-4ee7-8856-b7f718027ad6", "comment": "Malware payload (LummaStealer)", "value": "554d420d25c37c69258386c6ca4c5896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871894, "uuid": "61300b36-c458-4dbb-9312-55f7497c721e", "comment": "Malware payload (LummaStealer)", "value": "eda503252b71d8e453b1c18f9f81fac90ad8af7a4c285a4899c8301df39081b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871894, "uuid": "f8484a27-4d08-42dd-8108-f6414b7430de", "comment": "Malware payload (LummaStealer)", "value": "87a1ef09573a136a1922d46b3ab7687a62cfad82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741871894, "uuid": "d1c0d1bb-7a97-436d-bba0-b7850981e87b", "comment": "Malware payload (LummaStealer)", "value": "18c84ea4efa9c43b304594acfc852979041cb685d0728a59d7debade95c367a3221f6045e0d65be7b8efec1132842ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871894, "uuid": "11c7be96-6296-44bc-986b-bda8c696afbb", "value": "T1A05533F266CEA0BCC01A437CEE6466E2FD59BB4FC14A482EDDB5E02C84754117264FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871894, "uuid": "a7e29932-789e-4adc-a22a-3b749283031b", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871894, "uuid": "6ae0ffc3-397d-4616-863a-0b637b9f08f0", "value": "24576:udhTSCUSvKypfjVo3sCcJbJ7SWVIwFew0Egi0KMKUGpHuVBA:OUS/pfJTCcJblHVImd0EgBfK/OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741871894, "uuid": "77685b50-592f-4660-aba9-4199324dfcff", "value": 1311232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741871894, "uuid": "c365bc70-1392-41a9-a75d-3d3690b59cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741871894, "uuid": "5844b525-a073-4251-b30f-abd9679ca0bd", "value": "notyhkkadaw.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26abde51-0007-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741869116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869116, "uuid": "7b06fd1d-0974-424b-bf84-0a861c9e413d", "comment": "Malware payload (LummaStealer)", "value": "a2f90072225a24e54afd50bb7e6d9b22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869116, "uuid": "e853a086-04fd-4a99-a48b-25de97815252", "comment": "Malware payload (LummaStealer)", "value": "edb5eafb528ee827210fa70e02a614a3332d9ffbb991f5d7b748e85972b44e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869116, "uuid": "f66705ec-98d0-427c-8eb2-ba34d1e13532", "comment": "Malware payload (LummaStealer)", "value": "5e98f0335ae6dce3fe2702202e9fe2f5983fa776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741869116, "uuid": "ee9efc6d-82b1-460c-8fdb-7bfd2c3dbd5e", "comment": "Malware payload (LummaStealer)", "value": "f22bd8720fa78ca36761aa9e029f43e8f89eb9ec2e9555ea4c88e3f38078fae44eb00b6f92854bfe0603c1511beeccc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869116, "uuid": "c59f0125-5d3e-4be2-9ed1-e005d6140dc0", "value": "T1F2F4D046B892D1B3EE1638B25928E7C50D6B6A204F3095FBBBDC6D646F736E04532313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869116, "uuid": "5bc8a37b-357c-4187-8e2c-8adb4cd083b9", "value": "033c5f85fb620246315503dc218ebc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869116, "uuid": "96ad853d-e2b5-40e2-98e2-0a1501d346cd", "value": "12288:EIJQ/s2kiatVPnIpbWiJ621POPAANU/4ab9eItZgZ295Fy52RI8uyB1lKpJ:VBnIpnJhdQAANeJIty5c5Q53zuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741869116, "uuid": "a1b83bc3-f4e7-49cf-97a4-874bf29b0d0c", "value": 781120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741869116, "uuid": "0f21f0ab-3de3-4bb9-b7b9-3b71bfe832df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741869116, "uuid": "fc8fb02b-a021-4fbc-be0f-09cc528fba86", "value": "ModMenu.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07353657-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741879371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879371, "uuid": "e25f1e41-79bc-459d-8b8a-2b4deb642c55", "comment": "Malware payload (AsyncRAT)", "value": "5b0fab4037669cea89f171d499b29aef", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879371, "uuid": "6466a014-001b-46a5-a83d-f12e811b3cd6", "comment": "Malware payload (AsyncRAT)", "value": "edea6e496cefdb6e4c566480d1fef75933e5cacc24c77cb16c2eac785b8f4916", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879371, "uuid": "a5bb3bc6-c006-4cf9-90ed-4836a3f8d647", "comment": "Malware payload (AsyncRAT)", "value": "d38e7adcc7bab109b69b721a6c33897742c99dac", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879371, "uuid": "70322aaf-dace-45f0-9802-c565b1755de0", "comment": "Malware payload (AsyncRAT)", "value": "f090f3316705c5c8f770c532d21fee22c7cbc636693d4e64a76c5a71ce95e2f7f9adcbcfeb78b76474e0c5c490f772e0", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879371, "uuid": "5202b539-9da9-423d-9b22-b52d7e2d804f", "value": "T14A037D04BBE04616DAEE1BB169B375060730E613AE13FB9E09D499DA1B77BC4CE003D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879371, "uuid": "db97326d-d7a8-4ecf-a80f-6262f4c71412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879371, "uuid": "a2559238-6806-4ba6-90b4-abbbb05e51f8", "value": "768:JBxPSWITDj+SYbr4p1l4IHPeFv9eKJ5O+hyq7B:zx+Cq1lAFv9eKJ5O+MGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879371, "uuid": "f103892b-bb23-4176-9b42-b6481c9b370b", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879371, "uuid": "784e23f3-2718-4445-a9d8-4ac27cb25999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879371, "uuid": "e554ba83-89b7-42d2-93da-929e7251d261", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc1b109-ffe8-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741855837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855837, "uuid": "34db5687-d906-4dad-834e-565505579618", "comment": "Malware payload", "value": "7e287e5f835ef3b491383dd8626eead6", "object_relation": "md5", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "THE PACK Shanghai Corp", "colour": "#534007", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855837, "uuid": "283317ea-17e5-4374-a701-cd6e372d4142", "comment": "Malware payload", "value": "eef6cf314280f0a8bd7724dc8095783596fa6657ac95ee63a01c4b0228f26833", "object_relation": "sha256", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "THE PACK Shanghai Corp", "colour": "#534007", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855837, "uuid": "280ac89c-e53b-43fa-bb0c-a81705ad1351", "comment": "Malware payload", "value": "3a8a61f315d73a881a591f246fa8c12d594f9d53", "object_relation": "sha1", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "THE PACK Shanghai Corp", "colour": "#534007", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855837, "uuid": "36d41081-7164-4b12-a824-a4472ca8be45", "comment": "Malware payload", "value": "c80dbf751769084abaac1feeea3ee4aaae43373a51d77cc3f66d7085c7ffae30b5b64174b67c707bc905b798caa17c21", "object_relation": "sha3-384", "Tag": [ { "name": "eatertoken-com", "colour": "#24E728", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "THE PACK Shanghai Corp", "colour": "#534007", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855837, "uuid": "61ce7f6f-e993-4177-b412-3998066195b3", "value": "T13AC47C0BE39604A8D072D538CE5A594FF3753C990732868F27A43D963F7B290BD2A391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855837, "uuid": "631bbfaf-c0d6-4e98-8aa4-5a43cbc14649", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855837, "uuid": "4493535a-f8d8-4ad7-8500-ee626c720cbe", "value": "12288:LyveQB/fTHIGaPkKEYzURNAwbAgWfVzapB2ao:LuDXTIGaPhEYzUzA0WzapB2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855837, "uuid": "d711d5de-fe89-4623-9efa-85f4eb89e576", "value": 565744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855837, "uuid": "c12407a3-60f4-4044-8ba8-f0d21b4d9b6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855837, "uuid": "8c345d9d-8dfc-42da-b01d-3f80e9459997", "value": "eef6cf314280f0a8bd7724dc8095783596fa6657ac95ee63a01c4b0228f26833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9ea852-ffe7-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741855706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855706, "uuid": "4daa771b-69f7-4d61-89f1-eec3984b16bf", "comment": "Malware payload", "value": "dac5116bf710241e7729114b54d5f38b", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855706, "uuid": "d442c652-e388-4bd7-ae36-5ed6a812582e", "comment": "Malware payload", "value": "ef93353c2ecc677d4db0854d9eac80717a496af273ee0f2f5a21fda5682e248e", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855706, "uuid": "aca740b3-1189-401a-812d-b869b79008ce", "comment": "Malware payload", "value": "05aafe7b876d9652b40eb01d3a52941202764d1d", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741855706, "uuid": "3be57a15-d5ae-4941-8c93-b9c0a22a202e", "comment": "Malware payload", "value": "6e86dfd306bcf72c6f99b185ed1d8fe28aa5a78b415adf7fd85c8e01bfc2e27da1d46539fa1f86efcc552e4285eb3af1", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855706, "uuid": "9b781115-1628-4b5b-89fe-9eb246fc1b34", "value": "T1EA11965AB0133164CA005C9F8F16E54CC499CF713B1676DBE7550657A96A823A4F04C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855706, "uuid": "50d3e315-75d7-4a6c-9280-7538454a6aab", "value": "24:ioYLYKSn2DOIRwSeBf092WydwqPtKbuqiksvc4:i/LYRCO1SeBMW6qqilk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741855706, "uuid": "5943cdf6-4ee8-46fa-92a4-28ad8496b94d", "value": 888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741855706, "uuid": "393d15b1-c3d0-4cf3-9d1b-d88fc064ee63", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741855706, "uuid": "cdcbecbe-954e-4c41-81b1-0530cbe41b67", "value": "443_2003_x86.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487e1ae7-0031-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741887211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887211, "uuid": "b4fc2f92-4cd5-44d9-98af-bcbb68bdb5f0", "comment": "Malware payload", "value": "ff1b2563fd7d7b175c931f793e9bd258", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887211, "uuid": "a9176dd0-57a4-4f41-9d1a-67666deac875", "comment": "Malware payload", "value": "f00959854fb574ec9f23560d25ab097b590423efa417b7c562e7aae30eaddbd1", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887211, "uuid": "9eca5079-bc54-4e69-bafa-0614dcb69afb", "comment": "Malware payload", "value": "41d8c5fafef743a18188c62192fa3d3b52d2fa93", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741887211, "uuid": "4696e168-6dc0-4ce3-964e-3c68729d3305", "comment": "Malware payload", "value": "f2d3e1c9f271eb5cdf511641b56e86b4722633824fe152a4ce08361156cec700feefb10f4da301a693088c654d7a5d32", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887211, "uuid": "637343cf-cf89-494f-b6ef-98346de32c9c", "value": "T13023190EBED4D471D1E02EF41470BA96A6AEB8B20759E3C733D00477998A1EE4C70E5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887211, "uuid": "cd500b76-9278-4c1e-9529-d7fd11eb4f13", "value": "f935d47239c5117ffe474ff29eda74af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887211, "uuid": "8994fc4c-b876-403d-897c-44478a7ad1c0", "value": "768:Qh6DBRPD0r6mexG51WO77BsRqaNkt1QPpADAMimWGHIRwpxi4ROn7:JDrPD0rZf51WO77yRqlHM2DAJGHIR8Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741887211, "uuid": "3be84401-cef1-439d-b448-5d85a7e8d7d8", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741887211, "uuid": "37f764ea-2ddb-43a2-b489-717b4e79e9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741887211, "uuid": "848c74d5-0ce7-432b-a84e-7af6c7d85898", "value": "bchtrwdzkql.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7710fec4-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (RemcosRAT)", "timestamp": 1741825012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825012, "uuid": "39da6459-d100-4141-92cd-d9cc7b6568a6", "comment": "Malware payload (RemcosRAT)", "value": "cf3b6732c7211035855546f8fa2227fc", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825012, "uuid": "df3bde00-d8e8-4146-b5d1-5923bc0442fe", "comment": "Malware payload (RemcosRAT)", "value": "f074713527338c9f54003af9683c34ab92346ffd903166d7756726c52f836e49", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825012, "uuid": "c1c6e64e-a9cb-4e7a-b075-28012d9e3964", "comment": "Malware payload (RemcosRAT)", "value": "9aa0af09172a094dce30bb0bc2caabf5bd419360", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741825012, "uuid": "564c05ff-ddb1-497b-adcf-a6fe90df9f21", "comment": "Malware payload (RemcosRAT)", "value": "28dfd29b2a2b364b62523588b0cd227c73ef08b2d7feefd90199318bc83887f2d8197ccb1fd951b4885a273ae6aa0f48", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825012, "uuid": "b55a228d-b4a2-457c-8a1e-47bcc352c66e", "value": "T1FB62D9C50C11BED0579661A214FEE8E1BC0D9B4D482242F6F9EC84E383692ACC8DE1DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825012, "uuid": "c776bfff-f52a-43d9-acfc-c7ef1b98cb3b", "value": "96:/JYjX8Y+TX2Lmj4qsqX9BkR9CYiY5yX/Y+:BqsHTmLE4ZgJNvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741825012, "uuid": "c3e05e24-f5ac-49fd-847e-35cc9635be54", "value": 15084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741825012, "uuid": "fd91ef94-3b82-4d86-9b22-b8723104300c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741825012, "uuid": "562485be-e277-4a80-85b2-de2913b7b512", "value": "everynicepersonwalkingentireplacesgoodformegreat.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6260a80-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848714, "uuid": "2ceb8f9b-5d83-452e-88d7-8b967045a346", "comment": "Malware payload (Mirai)", "value": "9cc0caf50ef9603347b263f269a21603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848714, "uuid": "956a4344-2ea0-4f29-bb7a-cc52a02149da", "comment": "Malware payload (Mirai)", "value": "f2982a27f4056288b8a8e25618b30e88af45d141900fd897420c9e6c3e3513a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848714, "uuid": "a99783ff-e0b0-4dd6-86b8-67ca70a25304", "comment": "Malware payload (Mirai)", "value": "40679c1531307f1b714e2d7e0a67a5b260c35356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848714, "uuid": "b7b114ad-8d80-421b-a368-8fc7f867ec75", "comment": "Malware payload (Mirai)", "value": "e1208bdbf9889c7fa9f36ac9e57c0c2ccd4f8acb989b820ba335bafe024cbdfc528c9c5537363a7f481e8629df38b541", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848714, "uuid": "b9f7dc8e-64dd-4a0a-a8d4-ba3c8e6f010e", "value": "T1B4A31902BD829A23C1D2137AF6AF558D372077E993CF33069E146F743F8665E0D6AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848714, "uuid": "5a159f66-8544-422f-890f-f0dfcd156eb1", "value": "1536:Zuy/cDNZAhYWssIx+8MskyInZ5JIE+sm5mLaitkIjOjwZOb/YnLZMlPYr:ZuYcDNZA9bZFh2hipCkZObg+lP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848714, "uuid": "18416380-f9b6-4555-a675-78046e4664a4", "value": 106426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848714, "uuid": "fb4ad478-427b-4ba2-a672-aa49d895678d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848714, "uuid": "e767ed06-2d99-445a-9ff0-bc17b478addb", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b78ce7-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741879454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879454, "uuid": "b3aa021d-54bd-4502-8583-c2e22f008917", "comment": "Malware payload (LummaStealer)", "value": "1255e23ea313bb1a6e71d78b2f829262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879454, "uuid": "9bf5679a-f7ad-4d0d-bea0-6168909eca2b", "comment": "Malware payload (LummaStealer)", "value": "f311de293f2e7fb8487bfc25da196a92c2060cb3bb41117928b80ffde70c196f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879454, "uuid": "5aa294b0-ba91-44ae-b26b-6bf1692bd6c2", "comment": "Malware payload (LummaStealer)", "value": "a225deb67ab2cc828e79812b0e7a935505ca286a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879454, "uuid": "90b7256d-4d01-470f-b4b3-3fc1ffe621a6", "comment": "Malware payload (LummaStealer)", "value": "d6195c689f8bb7a2d8b06c02ee46ebddb1f28bc6b1a2a67b917bd0987b0bbe409d53c28fb1e8dfcbacbaa3fd07fbfa29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879454, "uuid": "390963b1-c1a0-4364-9d48-bf1597f5d5ee", "value": "T179A5228782B6AA12F06919300786C6321D6A0995C96C0F9D7537E9DC4F17BCBF3FB41A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879454, "uuid": "45543456-c9cd-4ed2-a2a6-e8d7b84c629d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879454, "uuid": "4ee275a7-ebb0-480d-8326-95ed3a9a5fbd", "value": "49152:1BbYgmRTzLNWB2J5iPsNL6KnaY+4MCZAfEjDBz:IgmRfLks5iPsB6tTwZxjlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879454, "uuid": "19403aa7-c139-44d8-958c-dc5d71da20f1", "value": 2087424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879454, "uuid": "a7b3f65e-c4e9-41fa-82c4-7984eb780b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879454, "uuid": "1f26c65c-42a4-4a75-9d63-b9815b73bba0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01218eef-ffa6-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741827392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827392, "uuid": "d07232dd-3cc5-4134-8f03-f837bc03d084", "comment": "Malware payload", "value": "7bd4cf0f352d6b21fe229acea80002fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827392, "uuid": "a04df76f-0080-4ddf-9cc5-8632234df189", "comment": "Malware payload", "value": "f33886b6061a165eb3efe122044dab00bf14375a1c5522973f6458b23de4d546", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827392, "uuid": "ab339bce-3a63-4964-8f9f-95879fc474a2", "comment": "Malware payload", "value": "d1bc829c2503a2e986637f62a66299db698f5d66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741827392, "uuid": "cd10376a-a3ff-477b-ad29-be3ab4bd5d6c", "comment": "Malware payload", "value": "d7dbfbb426ec0e3c299992f84f87aa278a4d818f9a275580da69ef80a78414f02ce632da036b377cc9dd84775cb0e3f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827392, "uuid": "60366993-7de2-40fc-b026-884bb54826b5", "value": "T10C356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827392, "uuid": "758d3f45-bbde-454f-adb7-9dc06bb263fb", "value": "12288:E8dASOYRNCAJump208iJftlzzmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsOP8+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741827392, "uuid": "f5733060-5c5b-4814-b44e-da60e9220651", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741827392, "uuid": "99f2227a-1bbc-4e60-a3aa-31e326808e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741827392, "uuid": "067e0b93-6bf6-4f12-a2ce-410e79c268af", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688627d6-ffa0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741824988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824988, "uuid": "67d24a82-9a0e-49dc-8a4f-2ec568f37658", "comment": "Malware payload (Prometei)", "value": "e8b6e8a14423ca2de9829bccb06426cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824988, "uuid": "15bb6253-8ea0-45ad-92af-2cf05ff05648", "comment": "Malware payload (Prometei)", "value": "f360f72646f421c7bdcd24adc2378403015e158061b11796adec4939531b9c10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824988, "uuid": "acfa69e6-488d-4a5d-b79a-11e3ee9d23e7", "comment": "Malware payload (Prometei)", "value": "907fa15951f47d68216593878fcb76ab5ebb2375", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741824988, "uuid": "a26368cc-599c-4dda-80b4-1b38aba3699c", "comment": "Malware payload (Prometei)", "value": "c209fa7eb7e8c5caa810c1118354052c97ec1e4c6c0c4b54e9af04d238733c5895476bfb95b803fce11c50e0c169be59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824988, "uuid": "610c6cc6-bdd8-4916-96ac-47a2c3640889", "value": "T1FC9423F8C83D2E3098169B3CBB5A8268F0E15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824988, "uuid": "f7960554-36b8-46ac-a6f5-865c754c53fb", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgc:25WOSACZSV6eKRH5EPiamb4DsDwwcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741824988, "uuid": "38a120f5-e277-42ba-ae62-aefa419a92db", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741824988, "uuid": "bb88463d-8688-4bb5-a2d0-9d762d02c8c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741824988, "uuid": "8438abb5-c778-4e92-a1a8-09ea77ac7e47", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ece03b-ffc1-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741839103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839103, "uuid": "87487d1a-021a-4821-bbd1-ef0213702d5c", "comment": "Malware payload (Prometei)", "value": "5831ef71554e6700c6b4b1f6d556cfa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839103, "uuid": "ba4336fd-f5af-4423-bf53-0523fc43b0f8", "comment": "Malware payload (Prometei)", "value": "f3893457ca6357a73ac9ce081cd2f7ad76ef408b8b5a151c6a73c5b09f450b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839103, "uuid": "5b22a81f-7e26-4aaf-bfe0-0a20527b6b2e", "comment": "Malware payload (Prometei)", "value": "cbe1c53ede43087d08ea1291b7ca33a6bf39636a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741839103, "uuid": "2ad96957-ad13-4fab-97b8-55d385c87c2b", "comment": "Malware payload (Prometei)", "value": "9ccaa9ef7dd3be9933523c31be7259a1a6f102347e7765e96f78b9417ab5647fbc27d8788e191a8b4824b8339ac28665", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839103, "uuid": "0b7b0e57-706c-4a35-b69c-d47b032e8c1f", "value": "T1959423F8C83D2E30D8169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839103, "uuid": "8cfe0414-d7c6-42c1-b3fd-8c6b17a80147", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgr:25WOSACZSV6eKRH5EPiamb4DsDwwcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741839103, "uuid": "a68711d5-cb9c-4bf8-8695-b30e32bcfdf9", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741839103, "uuid": "06c07f18-237d-4e48-81b1-d79cefd58aa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741839103, "uuid": "92a2ac88-cab4-4d49-bd3e-1e5dc36f918c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875ecf5a-ffd2-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741846515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846515, "uuid": "a6f454ed-efa7-47b3-9f15-42aebb4950ba", "comment": "Malware payload (Formbook)", "value": "cea17cb79fdac82a98d271b34374feea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846515, "uuid": "9b4d5f91-96c7-43fd-9f0d-ccfa73672c7e", "comment": "Malware payload (Formbook)", "value": "f38a008406f2bca311aa8014976f27669d52d494286f3dbc1dd10259f8382324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846515, "uuid": "8f92b62f-6ea2-4236-a2e9-c1e93632f9a6", "comment": "Malware payload (Formbook)", "value": "6399a821c39c79fb9ac57bced57536d757cf0766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741846515, "uuid": "a39b2bc4-c741-49d2-a41d-e84d0c17890f", "comment": "Malware payload (Formbook)", "value": "74355a9146f148b72b4e921b75eb6b253a221f14a64e332bf1832fad0de59e876ac5dbf77ff87cb9d8bbbc6836f69d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846515, "uuid": "ff6fbbbf-e3c7-4862-bba5-335bcf1db25b", "value": "T1B4D412A46B49DAA2EED517720931E27203BD6EAEF411D3578BECFDD77000239B0096E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846515, "uuid": "a48c79d2-054a-4eda-b4fe-6fc6d4203540", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846515, "uuid": "1563e360-c383-4fd8-a302-7b0008da623d", "value": "12288:o5MOiV1rn81HWrlgOVF+d4pVBqFuJakxfb+BKz+xOLSMZyL/nFAHTOJ:o5MOiXrA2rit42uJfGKz+ALSMZyLFM6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741846515, "uuid": "1b9cef54-8fac-4779-95b5-488f45d27b12", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741846515, "uuid": "d812585f-b1ba-4a8e-9478-1202bb90c770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741846515, "uuid": "359899ea-1b2a-407a-9c36-376e2d1e9888", "value": "SecuriteInfo.com.Win32.DropperX-gen.28100.31863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb99dbe9-ffec-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741857769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857769, "uuid": "5613692b-beba-4648-9a56-210b6d16a988", "comment": "Malware payload (Prometei)", "value": "6bedb028fe8e0bcaa4762f607dce5f30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857769, "uuid": "1c691a73-f9ae-4b34-a0e8-df3648e4acc8", "comment": "Malware payload (Prometei)", "value": "f3c205dbfa4e9ffd915f16da50239a9e71af4e010e08a16799de649687224779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857769, "uuid": "de4788fb-15b3-47b8-929a-28a652086fe1", "comment": "Malware payload (Prometei)", "value": "48c6905420751d2545e79e9a70132d685ce5c176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741857769, "uuid": "a87bf526-28d5-400a-98a3-a3cdafa02e19", "comment": "Malware payload (Prometei)", "value": "401d27f0b87e08c043b0364ba064a39287f2e331a742a3a3e327b9b7e92395136211061e7122a6202955d5642b5af190", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857769, "uuid": "23d8cf91-d18e-4d2d-b4de-503384af7266", "value": "T1869423F8C83D2E3098169F3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857769, "uuid": "335b52dc-b46f-4157-a9b6-f40a258a166d", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgN:25WOSACZSV6eKRH5EPiamb4DsDwwc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741857769, "uuid": "f36b2ed8-58e6-4955-b534-f90fb73a797b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741857769, "uuid": "42259f6a-8e33-4e9c-81d7-f6548d3b1959", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741857769, "uuid": "1e4e9d2e-b153-4315-b692-e6ed7180655c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80168979-003f-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741893318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741893318, "uuid": "0fbf2fad-8fc4-411e-afb8-d2e6390d2317", "comment": "Malware payload", "value": "132e3b4ba94821e62f78c3cbed94acdf", "object_relation": "md5", "Tag": [ { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741893318, "uuid": "39aebe09-4c6b-4b14-b2ac-c354bb1843fd", "comment": "Malware payload", "value": "f43b4138d5b60d8db05fc9c382f2e6430cf89e1f622a04186c0748b1be94cd3e", "object_relation": "sha256", "Tag": [ { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741893318, "uuid": "e56cd971-dfa1-4502-93ac-39ab5fea23c3", "comment": "Malware payload", "value": "643a4b21c3fc539985f31a83c6a50b915395eb2e", "object_relation": "sha1", "Tag": [ { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741893318, "uuid": "1a795dab-4700-4eed-840d-0b96f0b98fc5", "comment": "Malware payload", "value": "b7e186c4b7dffe56b19b998efbf72dcccb13e6801fdf24bc046b4b88b406a14c5269506cff2f2f279b008c5b8c4bc744", "object_relation": "sha3-384", "Tag": [ { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741893318, "uuid": "910ada23-0f67-4447-b9fe-abe4c8f37e05", "value": "T109C52C9AB7884AF892589BDD8307348E5391913B5FBF128C55E1844FB92FE237234D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741893318, "uuid": "8f6b17a4-9d59-4647-8394-aa13f83b58de", "value": "6144:JI3Yjgd/vd/sd/e1O2VfevpSmub73uojnqB3cwMk5gRKK3Tveg1sejuwipd/Ad/8:cd62ZOeNdiyl0LBUhU7eflAxNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741893318, "uuid": "24c942d1-1a31-4cd5-82c4-5a595c0ed242", "value": 2643944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741893318, "uuid": "022d2a1a-65dc-456d-a2ff-f795e2ebc5e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741893318, "uuid": "5c97aeb6-e287-4310-94aa-b5031f610aeb", "value": "809e682faadb839aaf9e5e6b171dfa3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be6cca3-ffe0-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741852535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852535, "uuid": "9c5f16ce-6031-4836-8ee4-ef5c9e52f5dc", "comment": "Malware payload", "value": "900f1300d90bfa52a3ed722e1bec268d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852535, "uuid": "97a90c35-bd15-42b0-84bb-fcf8b72766d7", "comment": "Malware payload", "value": "f451fda960cfea8177fddecc8937408f9c9e916f3843d7094da36e76fbe94062", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852535, "uuid": "6b28680c-1e50-4bcb-a1d7-8502bdb5e48e", "comment": "Malware payload", "value": "e7a5ef718f29754aa28995ba3cf9dc911b269ae6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741852535, "uuid": "6dc3a660-21b8-4677-a332-a31b328abe25", "comment": "Malware payload", "value": "a65868ea75f12d3655c5830620c45fa286d95e9fde21a25479b78ed7473f4ccc3bcdde16131a2f90eb8e242dc590570e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852535, "uuid": "1c7256aa-1f25-477a-bf11-cce44fb8694a", "value": "T13D252326B8E90783C297F6310A73CA4187D8CD153233D7166B31B609FA75FF4D98A299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852535, "uuid": "f5500aa6-6837-4695-b2f5-57fd10cc9d3b", "value": "24576:s4fS61xhQYS1EjZDBq7PUJPFhwak5v99CciyJDwal5K:s4fSYjvZBrTANjJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741852535, "uuid": "7c747d78-9b3d-4b32-bb27-9f7e8b8b6814", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741852535, "uuid": "ee967c4a-d56a-415f-93a3-50450ff4da1a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741852535, "uuid": "f19e6dfb-f8f8-4d16-85cb-b535a6a42a47", "value": "dok PZ 2025-03-11_142242 fin_Orygina\u0142.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29074809-ffc6-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741841202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741841202, "uuid": "bddca49d-e623-45fc-aff7-407c079b599f", "comment": "Malware payload (Prometei)", "value": "1d556cd916602afa6dd357663e2c55dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741841202, "uuid": "ae867bfc-d571-4646-9a14-2fe2a315cb7e", "comment": "Malware payload (Prometei)", "value": "f48e1907746ba5993e271abaa87cc5d5b04312d612defb92928587f6ccaf6b54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741841202, "uuid": "0208faa7-5ace-4352-b6a8-e187a20566e8", "comment": "Malware payload (Prometei)", "value": "716561e7232cbd8ee41877dfd427fe3311b71ded", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741841202, "uuid": "fb91c4bd-4889-4b00-838a-8844b5eec8fb", "comment": "Malware payload (Prometei)", "value": "bfebbd6ec076544eef2fc4033ebf4df03c05e93758d8ce474e5a22135d2aa114ca8cb391bcf40a8b86e2d6cb7b3bca9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741841202, "uuid": "b6fcbe96-1729-4609-bb35-e03e1f0e474f", "value": "T1EE9423F8C87D2E3098169F3CBB1A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741841202, "uuid": "887ee9ad-f99f-4477-bdb9-e9ef3644c54b", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgV:25WOSACZSV6eKRH5EPiamb4DsDwwcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741841202, "uuid": "30bc971f-009c-484c-add0-a6880566cb72", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741841202, "uuid": "da5dfe7f-bcde-4a55-aae6-757dcd420604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741841202, "uuid": "e697bcd1-16e0-4f4b-9c3d-4c39bd6f7b7f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89086c75-000a-11f0-ad17-42010a9c0004", "comment": "Malware payload (AgentTesla)", "timestamp": 1741870569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870569, "uuid": "ec74e703-3fc5-4a12-9ff3-93acd73b849b", "comment": "Malware payload (AgentTesla)", "value": "c90383f74059262086948ca44f2b1fa9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870569, "uuid": "593e0311-df86-4c27-8f97-f541024ed91c", "comment": "Malware payload (AgentTesla)", "value": "f4cce73cd41b988bb97b055a3fd9952de8b66e35b8f869f83275ceffe94b3e0a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870569, "uuid": "4d396247-2bf2-44b0-aeb8-a21d50483f2a", "comment": "Malware payload (AgentTesla)", "value": "7e65cb43536eb39f9ddb809d37fe1d58f0f6fba1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741870569, "uuid": "173eecad-44a0-4fad-99f5-1169b372d0a7", "comment": "Malware payload (AgentTesla)", "value": "2230ce643588ffd8ba995402df3fe3473699be39786cfa05fc16f2879bbcca5a9775ba4e56727b0528f8f5068a98f7c9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870569, "uuid": "972e6c88-6929-4fcc-b1d2-9a15e1be8a39", "value": "T18AA312254819FF702E7DF675A01A068D28F948928A7387B317F95E0793090AE25CCF7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870569, "uuid": "5a3fd1d9-98a6-4db1-86ff-07d8e9d37d11", "value": "3072:sNUP7sV4B4Zv0hKqG66TWAVRHKH1PNSFZ90:/hKGpAPHKHLSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741870569, "uuid": "19a3388f-973c-43ad-bdb4-987a18587a7f", "value": 104362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741870569, "uuid": "eef293ed-db29-4c37-822e-9e1e8605ad11", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741870569, "uuid": "a0020db5-738e-45a0-96c1-832d7671a55d", "value": "purchase order T&B19-20PO128.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0b6037-ffea-11ef-ad17-42010a9c0004", "comment": "Malware payload (AsyncRAT)", "timestamp": 1741856698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856698, "uuid": "052dd09e-7eb4-4ced-9a86-84c0e39511d9", "comment": "Malware payload (AsyncRAT)", "value": "6104f3d5a192780d27eab1a3fd295ca9", "object_relation": "md5", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856698, "uuid": "b1e768a4-a5a6-49f8-8d96-765430c32480", "comment": "Malware payload (AsyncRAT)", "value": "f56b4f388118aa3ed36fcfc6174799592a7a4ef78753b0c9fcf7ce5de643b7d9", "object_relation": "sha256", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856698, "uuid": "9679513a-a380-425c-964c-9f9121e26fe4", "comment": "Malware payload (AsyncRAT)", "value": "d71ee9864838a432de2cf585d8d01d193c489f15", "object_relation": "sha1", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741856698, "uuid": "8b5ff5c9-37ef-4981-a4d8-c378b433c3ed", "comment": "Malware payload (AsyncRAT)", "value": "4920905b98b509af9eac8e2013f41d7c1b2fc7f47fe57d2bceeb7ef77a91793b1df46aac38b89aefe74e74de1c4aca4a", "object_relation": "sha3-384", "Tag": [ { "name": "92-255-57-221", "colour": "#60C4D7", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856698, "uuid": "49912c0a-64e0-4b96-9b17-6962522ee041", "value": "T18B43D073138602AFD1844FD0401B2A5F39B6D95E37683444DBF329AE7E2B9DFA434962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856698, "uuid": "19f08d5a-adda-4894-b343-9e72f590b771", "value": "384:iq8L4RHnoOFF8d/cz+zMNCWlzGOmskpNjKQGK33HtZ0e:+kRHn9FG7n0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741856698, "uuid": "31de4209-d09f-4eb7-a5f0-f86e008d2ac8", "value": 56845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741856698, "uuid": "fe906e33-d818-46cf-bd10-31ad8830f21c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741856698, "uuid": "415ae471-b87c-44bc-b87c-9dbbe2313b6a", "value": "a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951713eb-ffc0-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741838807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838807, "uuid": "46f127c4-a7de-44a8-b50e-63407360560f", "comment": "Malware payload (Mirai)", "value": "0c4b1545c5de546febe45ba205cbc911", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838807, "uuid": "ff3d93e9-47a9-4e15-be7f-112d3bb5f820", "comment": "Malware payload (Mirai)", "value": "f59273c546b64d514eecf06374bc0bae793688b1ef8d7475af928e74ed2f9d28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838807, "uuid": "749c7afc-5a48-4942-a462-ddbd12717bd5", "comment": "Malware payload (Mirai)", "value": "439659891e2f952680dbceaf1d89d5b6cf79ad15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741838807, "uuid": "06861001-8aa0-4d04-86d3-dcb643272225", "comment": "Malware payload (Mirai)", "value": "fcfc47c20668ce028776c7a15c8347b39a09a7c3cc387aa22b24ae450a5a810a43afdb88aeacb326ba390cb1fae13ea6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741838807, "uuid": "921409df-2dfe-4887-9510-ebbcc71ef55e", "value": "T16651DBC74D489D301C6BEA97EAF65318308AA453ACF2AF95DDC4FAE8064EF147141B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741838807, "uuid": "4bee2526-c0d3-484c-b2c4-d6e7a474b774", "value": "48:vSD7/D7N7hSDwD6GSDgIDzPSDADKWSD+DoUSD7+D7o7USDfZD3bSDvD9RSDKDcgZ:vSD7/D7N7hSDwD6GSDgIDzPSDADKWSDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741838807, "uuid": "edb87f4c-14ab-4361-8b7b-e49d430cdb35", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741838807, "uuid": "30ad279e-bfcb-4478-b004-b26e0420ae34", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741838807, "uuid": "d786c31b-70b1-43fa-a8ff-964af4695ed4", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c890051a-fff7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741862515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862515, "uuid": "d41f0d29-535d-426a-947a-632538e23c08", "comment": "Malware payload (Formbook)", "value": "1b0ba023c6d5a79557e2d25b3d22131b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862515, "uuid": "ba4bcee4-4360-4c0d-b8ae-b87423381bf9", "comment": "Malware payload (Formbook)", "value": "f5bf548a92e16ade13e22e9def6ba5bc424c9ff797570e5992b615d9adce311c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862515, "uuid": "e0de68af-4373-447f-a9d1-ece972286d38", "comment": "Malware payload (Formbook)", "value": "9c0b497dfe5ad0aa92221839522713ecb2cad33e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862515, "uuid": "0828d005-eb6a-4666-aa25-9d9963700a1f", "comment": "Malware payload (Formbook)", "value": "1e4a6dc555a4eebcc9138e65d15c8c1e44c3c228945f84ea8e64ff6c98cff829b12a154dcddce67b70b37c67227951e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862515, "uuid": "968512e5-6008-48e8-93e3-8740644e2b56", "value": "T161050185FA588B60DA6947FC0D68D5B243B11DF8A431C2122EDEBCE7F6D0B13A618753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862515, "uuid": "ba2b435f-38a3-4a6b-a4fc-6b6469384441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862515, "uuid": "d613c887-f309-468f-9fd4-7012269fbeaf", "value": "24576:BnOeSMOiXBVlVlVVVrhrI+1PFOmmE+/aPqOysAoVlVl:+MpRPPPPlOmmE+SPPycP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862515, "uuid": "1d7267a8-f789-4170-b5f4-becbcf6a6faf", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862515, "uuid": "312ed934-b30a-4f79-8c89-b55b5671002c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862515, "uuid": "72dfc070-e196-4ad4-af07-8d85c7cb461a", "value": "xrNDP8ydHiSLVec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5aaf598-001d-11f0-ad17-42010a9c0004", "comment": "Malware payload (Copybara)", "timestamp": 1741878805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878805, "uuid": "cfa7dcf6-5a30-4f05-a6f9-d2ec33a92523", "comment": "Malware payload (Copybara)", "value": "3c9dcaa7516dc2aeccd082b37aaa40d7", "object_relation": "md5", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878805, "uuid": "fcbf9b64-a427-4059-95b0-a923211a0865", "comment": "Malware payload (Copybara)", "value": "f717e9449835314b9923aaa5ad0d41ee76bd2803044cb190a77c9b3f4e982d6f", "object_relation": "sha256", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878805, "uuid": "65a88f2e-041b-4ab0-be00-a17f9df4269e", "comment": "Malware payload (Copybara)", "value": "07290e9f13d85d79b7f743230a5dceed84c4f6c6", "object_relation": "sha1", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741878805, "uuid": "847a03c3-0864-4d44-b5f9-440d6e0ae2dc", "comment": "Malware payload (Copybara)", "value": "cff4b3bffed31a549301f3f41f59b62a2ec038cdd93654328de4a5b0444d321e00e322fda18b5b7b7596cedfa497a0f5", "object_relation": "sha3-384", "Tag": [ { "name": "45-86-231-15", "colour": "#C8381A", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bank-android-ITA", "colour": "#32918A", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-app-xyz", "colour": "#051DBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878805, "uuid": "7a61cebf-9035-4cae-934c-14265e3fc454", "value": "T1E3C63357E7A5D51FE4F75B3E183905260933D926DBE3C24BEDF0A2B804AB2C08B55AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878805, "uuid": "a01dde04-5a72-4589-a4a9-b3a952902f61", "value": "196608:W0+UCcH+tP2FiD7RHKnMxcLpuLqp8IwcFyWIoU8GcsD4Uc/koGgYJ1yyDDD4DRDu:W0+UCcH+wQDVHIMEumqYZIoUwRko7YJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741878805, "uuid": "0165cd85-622b-4f47-aa29-fa23e638bfdf", "value": 12150664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741878805, "uuid": "84297abe-5151-4abc-b501-17338489e9b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741878805, "uuid": "85e9618c-076e-49a8-b75d-181b37e61c30", "value": "3ac1b_ISPToken.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91c49ce-0033-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741888340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888340, "uuid": "c5cc0ca3-a336-4be9-bef3-ca4d1b8e9861", "comment": "Malware payload", "value": "46246500e111b96f810aca0f954a0296", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888340, "uuid": "adb9dc97-501f-4674-9830-2c2601b21ec7", "comment": "Malware payload", "value": "f8438ab77d6a45fa18b717ce1e4fb5104af070a4f1a421ecbfeea3e312853ee8", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888340, "uuid": "5ecf8d40-fc87-48cf-bb23-6741ea34d6bd", "comment": "Malware payload", "value": "f1eab2ec58168100317bfdab0cf6bc9d85802a53", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741888340, "uuid": "a90db37d-fefd-4da9-b99d-c571915f16d3", "comment": "Malware payload", "value": "b7987631ec011837fe8d250a0b335c1d8bcef5401feee99a631b675f60a675740428af4979906fcf89482aaed438fffc", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false }, { "name": "skid", "colour": "#8994C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888340, "uuid": "8ea0cadc-8c9b-4331-9332-91834008d348", "value": "T16A34C2D0700091C2E0BACB3D55E79C5C4D116D26BA26CBE6BF8C7EE9A43151A8D2F71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888340, "uuid": "64a04368-ae71-45cf-8af8-e1be99839913", "value": "325ddf2142611b06e12a1449ea86f725", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888340, "uuid": "2fd0ef96-d473-41c1-a2f6-1b59ed4c9c73", "value": "3072:427Nk3HPKEwHdJUtyTMHzBK1JOeoc33sEMD1kV8zno5PkdfZ:NycvMTBK1fossEM3nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741888340, "uuid": "3594658a-6abe-483c-a020-ee6dbd342f2e", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741888340, "uuid": "a5258311-8ae1-422c-970b-045b61ed548d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741888340, "uuid": "55bd10d8-2f17-465a-8fde-203ac088ca20", "value": "meitnerium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11dba7c5-fff7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741862209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862209, "uuid": "8dc152a5-cba5-4ca9-8d4b-914bdf148173", "comment": "Malware payload (Prometei)", "value": "577cfadec341276c71dc6d47d1e759d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862209, "uuid": "8c787981-c504-4fef-9a61-89dc742365e1", "comment": "Malware payload (Prometei)", "value": "f9252a3f88b542cb3229c46a328091273b312f3b298534cc65078969107114a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862209, "uuid": "3570c941-a280-4201-b024-69d48d5a9377", "comment": "Malware payload (Prometei)", "value": "e14721a7ff39df95690dae6176e17f6e1923b48b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862209, "uuid": "a38c1d88-2251-48af-b335-947be6b9d623", "comment": "Malware payload (Prometei)", "value": "3b611c85dc7d693dea5cd134bbed129581206da0ce2f222da16627d923901daf58b392e26d7be83b33ab60564f4ed5aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862209, "uuid": "5302bb02-feaa-4f71-8080-5edc84e15b56", "value": "T10B155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862209, "uuid": "55281aaf-4e4f-4946-b140-62eeff1af9ef", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplM:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862209, "uuid": "5df2a708-5ce6-408f-b186-0b49c5c45a76", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862209, "uuid": "be7bc85c-7d1c-4afb-8341-20bf6e8d91cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862209, "uuid": "34c48f51-644b-485f-b291-bd9be9b9bf6d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f42b120-fffb-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741864164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864164, "uuid": "59475476-330e-4f48-b561-3ada2237f50e", "comment": "Malware payload (Mirai)", "value": "e085b6b2b798914268dd3fd16b33fc21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864164, "uuid": "03b5a286-2b50-4791-92d9-aea4a4da9b47", "comment": "Malware payload (Mirai)", "value": "f99b8e04c93106c367e524f0e9fc761fb80d914c0178718d896ea7c63cf07bc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864164, "uuid": "94df69bd-9199-4212-973f-13ceec38f3b3", "comment": "Malware payload (Mirai)", "value": "5c78be3eec310b8ae6de1875d136df912664a682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741864164, "uuid": "ba563fa8-22e6-455d-b41b-8ed7c9ea5090", "comment": "Malware payload (Mirai)", "value": "1c04690670c7c3b2f35059c0ff87f9df2a5acf2fed8358217490eabab96a0585b916623ca69309ceb0fc72d15d07ae05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864164, "uuid": "6909d383-d3cd-4b7c-9b4e-78b04fedafa6", "value": "T10A23F16020463CD0E0E04436F2E9E8E251B756B5E3BB3BA3290485EC91EC59764FCDAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864164, "uuid": "5e563201-c525-4f03-98af-28ce74b9e424", "value": "768:T4vtt+xX6bffqf8no0R2CGkL/Y+OE5KIxAq2uP6J2vRLgs3Uoz91:T4FYxX6bXbnoARZnpkIiqV6UvLz91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741864164, "uuid": "e5f6d2c2-ac8b-40f0-9d2b-7bad617152be", "value": 48308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741864164, "uuid": "8f506c82-ea55-46d8-970f-d6d0c7681e3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741864164, "uuid": "2e1870fa-7e05-4f2a-9dac-257721de2f0d", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048333ec-001f-11f0-ad17-42010a9c0004", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1741879366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879366, "uuid": "9c826ae6-5f46-4c52-b0f6-02bc4dc21af3", "comment": "Malware payload (SnakeKeylogger)", "value": "ab5663a35b01e88deedb0739a3266f2f", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879366, "uuid": "c169dcff-4610-4287-84f1-7441083ec7ae", "comment": "Malware payload (SnakeKeylogger)", "value": "f9fdb051571ebd3003ed9a8605cc48af2e79a3383e48486b69b0becbb3436b57", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879366, "uuid": "b1c0b467-b638-42f4-ac8c-01f3e237c01a", "comment": "Malware payload (SnakeKeylogger)", "value": "9ab0ff2ed6a6441caccb18fd1429a33b14f79541", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741879366, "uuid": "78d37e25-bd01-4997-9cf5-b6b7c1af84dc", "comment": "Malware payload (SnakeKeylogger)", "value": "192676021f86b5bc6a4f8c17182758ff47ab9d27d87b419262bc7317158e5d1acb75a931825e7f5c04024d64af0ff16a", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879366, "uuid": "05351829-8a83-4c74-b108-a020be88ad33", "value": "T1B244A48AAFE85811E6FF843392B1C114C6FE74A3492D8E2E16D1E8153B39954DF0AF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879366, "uuid": "9860b301-3284-4c3c-9b71-c304987aa0ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879366, "uuid": "bf184247-ebdf-4851-a754-440e3022ba39", "value": "3072:vbbOAI6D2D/F/YDeQLTL+r7QXuBAYM9W2UhnNb7LUXZmiLtYTKBgfiwbbY:ad8h8NbMjub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741879366, "uuid": "671f418f-fe94-446c-a532-5e5551859e40", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741879366, "uuid": "cab6c56b-038d-454c-ada3-8b90bff06f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741879366, "uuid": "fb116285-eee6-404e-881c-014acc116e20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133a685d-0029-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883686, "uuid": "b34c6643-2663-4617-862f-1beb624910eb", "comment": "Malware payload", "value": "73da454688b9cfe8cd6dde63713f0e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883686, "uuid": "2d702819-eb81-4bd2-991f-832f7e41dda0", "comment": "Malware payload", "value": "fa411a8d421ec10792c39091ea7f7a114893ca00a4e4924686ab0c71d9ce03b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883686, "uuid": "e685a4e6-74a1-4b1b-bdda-603cf6788730", "comment": "Malware payload", "value": "8560d9a3be8667a022120547bce4951b0f600cb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883686, "uuid": "2d9ce890-2983-416b-ab07-c3a10d1eda2e", "comment": "Malware payload", "value": "75ccc57b3b14dda8f3e9b2b5fe7c2f11f2122c62d2af1e203280c39fae2cdfdac3ea7a75f791f2bd527d1bc3e5ddd13c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883686, "uuid": "7778fcb8-ff84-421c-90e2-5a97ba6c7d1c", "value": "T102A5D023F2CBE03EE05D1B3B05B2A25494FB6A616822BD5396ECB4ACCF751501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883686, "uuid": "fe3ab897-f389-4efe-acb6-a3b6c1539a41", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883686, "uuid": "88c64096-7d6f-4955-9652-88445a28b04e", "value": "49152:ewREDDMmh5Ub/hp4e3ftiaOXziJD+QzMm1RBoBVtYHqgN:ewRExhe8e3FMi9+Q4m1PQKqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883686, "uuid": "25d37c2f-2263-44ad-a2ab-522a17984ab7", "value": 2240664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883686, "uuid": "19b9b462-0f69-4f1d-b3a3-a2606772bec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883686, "uuid": "52af5d60-1a75-4b09-8efe-2dae82b72bab", "value": "obtsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8af2839-ffd7-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741848718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848718, "uuid": "1acebf20-6ab0-4085-bb81-4f17b44bb08c", "comment": "Malware payload (Mirai)", "value": "9e80b39a4f5a7d7a2da84fc88516762a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848718, "uuid": "c6f0fd56-42cb-4cd9-84d6-a9a88e9efcaf", "comment": "Malware payload (Mirai)", "value": "fb32199bbd61069f25e7c6b6134305f99787755374163eedc6d95c1167cbad77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848718, "uuid": "753222dc-e1b8-4804-9630-aae847b5718f", "comment": "Malware payload (Mirai)", "value": "288434eed84afa51219a5b5ab24ccb0f9e3ecf4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741848718, "uuid": "da488c58-3557-42b7-b65e-1c5e95cc9139", "comment": "Malware payload (Mirai)", "value": "04dee9d1ceac203e60f2ac4fe83a8044585823034ffa27f0da07199d42b0ae218b9c99d5dc1ca84669623dd3c4764b13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848718, "uuid": "016a7f32-4857-4573-afdb-9df3ff0269e9", "value": "T1B3C32942B8828923C4C6177AB66E418D3322B7A593CF7312DE106F743FC665F0E76A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848718, "uuid": "7690e000-a66e-4a9e-909b-c695ef8e7818", "value": "3072:U0AT/hiRlBFrZt3q59LuRYLdp9JtV0//Offs/45Aw6c2:U0A7hiRlBFrZt3q59aYLdpDtVGOffJ6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741848718, "uuid": "a764177c-b510-431a-bef3-35e7da9680a7", "value": 121733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741848718, "uuid": "e6450038-280b-4cd7-abde-682a808e9e25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741848718, "uuid": "f6f79b08-d243-4bd4-8abb-65575895cb9f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043b3b17-ffb4-11ef-ad17-42010a9c0004", "comment": "Malware payload (Mirai)", "timestamp": 1741833410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833410, "uuid": "bb186c2f-c2d5-4a42-a2e7-e6038ff991c2", "comment": "Malware payload (Mirai)", "value": "456f983296d097580cbd15513a9d176d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833410, "uuid": "38ad8800-c8f5-4dc2-861c-1596b653e28f", "comment": "Malware payload (Mirai)", "value": "fb8d5249f1849364ac1d036560c1d5d8db7fd781fcf2acf93e3b0d76f104f489", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833410, "uuid": "70a860e3-089a-497c-8801-03b7a54e6882", "comment": "Malware payload (Mirai)", "value": "a70879c5b4c57305fabd979551b88e36d0a90e5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741833410, "uuid": "03ffa709-39a8-46d1-bd0f-89f9e85cc3af", "comment": "Malware payload (Mirai)", "value": "28e5143bd7fe2a1118acb758b38af3d2570a0fb7dd2b1d32f5540de37c92c1f94f4764ff1a998c0601d2609455310c50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833410, "uuid": "d8661838-b3d2-4656-8d71-e089e15362f1", "value": "T1B7236B33265880FDC4ABC2B46A6A6636D537B5BC0336715833D4FD366E4BD221EAF640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833410, "uuid": "38b540bb-ff45-40c8-8fe0-97c2847c6141", "value": "768:XE9E2gTZlyFNhYq99hL6Z7M4hhKbCE5c70zYtc1/f39kRIR5:XQwnAjL6Z7zRE5c7NWuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741833410, "uuid": "41086f87-e622-4cb6-998d-18bc0722188c", "value": 45856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741833410, "uuid": "0ca6b46a-87cf-42d5-97f1-2044e7900e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741833410, "uuid": "af36a055-137a-43ca-9155-7bbdd180d1b4", "value": "miori.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bff78a3-fff2-11ef-ad17-42010a9c0004", "comment": "Malware payload (ValleyRAT)", "timestamp": 1741860266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860266, "uuid": "c7133e07-28c5-412b-a160-d486f72356a2", "comment": "Malware payload (ValleyRAT)", "value": "c279939887a8049435c4a38b0e254c86", "object_relation": "md5", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860266, "uuid": "fbee3ab1-6507-4bae-b1bd-d8e0d48b955a", "comment": "Malware payload (ValleyRAT)", "value": "fcd89e9706329dbdfeee7efec248480bbd72686dcde1fa17565c63d7afbba55f", "object_relation": "sha256", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860266, "uuid": "7158e6bc-1162-471a-bd37-284d181dbddf", "comment": "Malware payload (ValleyRAT)", "value": "1a4705968d14cfc0600f980196663dc8aeae339d", "object_relation": "sha1", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741860266, "uuid": "2b989b9c-596d-47eb-a82c-6ce38a633d7d", "comment": "Malware payload (ValleyRAT)", "value": "6235200a1cbfddf6f94a0dcc006a803ce60274f07e03c73f890d568657cfba6434a7a23fed908cf678a90edd99c3b463", "object_relation": "sha3-384", "Tag": [ { "name": "27-124-3-142", "colour": "#088A5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860266, "uuid": "ee4bf2ce-0dfa-4916-b8d2-835cc832928b", "value": "T1A526B641EF80D5C8D93955FC0AE6F372F7D53AA03762982C24E25B121AF6ACCC772A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860266, "uuid": "3e4c84d2-7899-4671-a60f-6b3aac03ba01", "value": "12defe8cb0483ecd701e00b88ceca9e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860266, "uuid": "7d933967-c3e0-4b6e-baf2-44218aa8871a", "value": "98304:ZE2BPEe2lKeoNS3+7M9eewS6XntrMM3vkSGoTrwEV:ZEFUe5gM8eYn4oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741860266, "uuid": "dee4bc3b-57bb-4d10-a829-951396f238c0", "value": 4702208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741860266, "uuid": "346d4952-897c-41bc-b578-e4e0efafd6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741860266, "uuid": "b5402b4d-1065-4acf-8cd3-cbd696ea4d6d", "value": "fcd89e9706329dbdfeee7efec248480bbd72686dcde1fa17565c63d7afbba55f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65311763-0001-11f0-ad17-42010a9c0004", "comment": "Malware payload (Formbook)", "timestamp": 1741866644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866644, "uuid": "2bae0da0-592e-4c35-9a6f-b23d332d92ea", "comment": "Malware payload (Formbook)", "value": "ecadc7f10bcc4d10c75ac90a3f500d0c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866644, "uuid": "a255c917-5585-459c-98bc-a37b360b7678", "comment": "Malware payload (Formbook)", "value": "fd86a25ca0fde7309da962625c791b6c6ce371fb046c8c97da07d8bc38bdb66a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866644, "uuid": "4854d680-ec90-4baa-8ebe-2a9f7bae2143", "comment": "Malware payload (Formbook)", "value": "a9dff78fc7cdba8b766db260547b989074bcbfd3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741866644, "uuid": "88285d40-d77d-4c18-989b-b954f18fea0e", "comment": "Malware payload (Formbook)", "value": "3d34c7a800489247e535e488315f132cfb7a4c66b8ac90f3b209b28d9015c51d7fff0145ef1abe38aa0133203462b921", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866644, "uuid": "3d128bdf-6295-4496-ba11-ae94a364caf3", "value": "T1729533860FCCAE19E1759A2113B089AD83279E36365846C9EE65C007CCDDED3DEDDC1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866644, "uuid": "3ea65f3b-c0be-4fea-8212-103f2edab829", "value": "49152:aQ/aBSULIrdEGY6fQLOfSkU/Lwb4XFMSMZ9drAAKDBWb:jyBkrdEryf1oiwbA83DAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741866644, "uuid": "1446895f-cee1-4b50-bc86-4f62c29956a9", "value": 1988929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741866644, "uuid": "a786ce34-912c-4a06-91bd-64b69d65c7d3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741866644, "uuid": "c67560f8-513e-4c46-b3d9-68c64abef381", "value": "PO #S149102025.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33d5a7e-0010-11f0-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741873217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873217, "uuid": "1f40c118-d26a-485c-b726-9c8b1c7f5b29", "comment": "Malware payload (LummaStealer)", "value": "4a0c3d026246920f6b8bd466cc5fdd8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873217, "uuid": "bae2c211-aa18-4d00-a8ed-886d447bb841", "comment": "Malware payload (LummaStealer)", "value": "fdba4cab6bb651c5ffecf92d1bfd3de70ef5433a6aea4976db9753742799b7a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873217, "uuid": "b17d72bb-3124-4d7f-b675-6a073fd90cea", "comment": "Malware payload (LummaStealer)", "value": "2536873426bdcd8cdc5fa40b54d68cdf1a0766ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741873217, "uuid": "113747be-38df-4029-ba2c-e346a52bbcda", "comment": "Malware payload (LummaStealer)", "value": "c07244c599a987dce8d918366f63fb2023c68a7bf777dff27bc31de88eac405b364aaf6397dbd4ea01e0929c4107353e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873217, "uuid": "68f6044e-d23e-4533-98da-8e1954683a69", "value": "T13B5533C90DE29A4FE9E3E1F99A98754F03A08D18F9CB6F7429439350E1949935FCB270", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873217, "uuid": "8cbd445e-cef0-44a6-ba64-eff35ec00cd8", "value": "71cc5af9daad65e58c6f29c42cdf9201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873217, "uuid": "1a29d121-8894-47bc-9137-b4538530842a", "value": "24576:V+Fh6DotPSJFFV3jAos1aMYC8VhKbcFMaQkVHDr5fGBuBRxsP4:4FcDmSfjE1aM9Q4c2r8leBCRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741873217, "uuid": "635e13a6-dc04-4c7a-81bc-e032a22372ea", "value": 1311232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741873217, "uuid": "27a6b691-f00b-4289-8ae5-363607e745b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741873217, "uuid": "0c303d73-44b2-4088-aa04-a8137ff4949c", "value": "nvtoaldlrg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764b6601-fff8-11ef-ad17-42010a9c0004", "comment": "Malware payload (Prometei)", "timestamp": 1741862807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862807, "uuid": "bc4c72a6-b9ac-4e29-a783-6271257698ed", "comment": "Malware payload (Prometei)", "value": "b8b9e632088aeac6bbbc91c2e9cd49af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862807, "uuid": "f0e99925-0a0e-47c8-aecc-52b7903fa5f2", "comment": "Malware payload (Prometei)", "value": "fe2103834d267a04771174e0fdd3bed47cf716c0ff9caf7bb0662f8d5824120d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862807, "uuid": "57951284-96fc-4e39-bb4c-acddf8c43c73", "comment": "Malware payload (Prometei)", "value": "b8fff3be1531509d5525ba570e21b8e270bf4c2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741862807, "uuid": "02b9de6d-3f1e-41e5-ab50-5ddababefeb1", "comment": "Malware payload (Prometei)", "value": "916fa43039b9abbbb4a4ef55c6461f56d9de45ea9e3e8ae8465e61f8a8b7969309c2443a4297aebfb0995736d72c6ea4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862807, "uuid": "131a9558-c3b8-466f-b861-b193a01e4690", "value": "T1709423F8C87D2E3098169B3CBB1A8268F0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862807, "uuid": "abeb9af5-3c2c-45f3-acff-96658de37b35", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgP:25WOSACZSV6eKRH5EPiamb4DsDwwc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741862807, "uuid": "1e1cf46a-7d72-4e24-80cd-453d0952db7b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741862807, "uuid": "028a65c2-1a30-46d4-a51a-b13ebb44f7f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741862807, "uuid": "88d09d07-b628-482e-a8a0-95cb3a4bb590", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a08f14-0028-11f0-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741883529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883529, "uuid": "87636c65-be30-4651-90cd-548fd595945b", "comment": "Malware payload", "value": "952f1b8bc3be4bc468daf18ec38396c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883529, "uuid": "d49e7760-363b-4728-930a-48479826b170", "comment": "Malware payload", "value": "fe647aa9a7404e34b71814424db08efeef8e8deb2c168bf72d5a107d278d6185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883529, "uuid": "48e45a6c-079a-4de2-9221-c7a18d1574b7", "comment": "Malware payload", "value": "597491d501a1ff433ce10d3dd48193787ca3c9d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741883529, "uuid": "6dff1c33-7f25-4e08-9db6-5ca137cbb1ee", "comment": "Malware payload", "value": "d6f6e96b9781d2f8bbfbca2f8ea9b0bdad1a85119ec5f68128e710684637eeedbf28457a85e6014394ae47f74697cd9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUDDA FOODS (SMC-PRIVATE) LIMITED", "colour": "#7B59B3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883529, "uuid": "8672e7c7-5f5f-4baf-8314-3409e40851a2", "value": "T1CDA5D023F2CBE03EE05D1B3B05B2A25494FB6A616422BE5796ECB4ACCF351501D3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883529, "uuid": "76b3fbd9-60e2-4189-a23b-9593ade890b4", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883529, "uuid": "8047aa81-8097-44d2-9066-43bb731ed431", "value": "49152:JwREDDMslTZJkImI33ftiaOXziJD+QzMm1RBoBVtYHqgt:JwRE7lHaA3FMi9+Q4m1PQKqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741883529, "uuid": "838541c2-c256-4992-b93e-1253ab912a86", "value": 2241824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741883529, "uuid": "fef3e164-7b7e-4073-b08c-e6938a4556da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741883529, "uuid": "4953b747-4d64-4b22-82a8-b25d603319c9", "value": "ydpsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c747af3-ffaa-11ef-ad17-42010a9c0004", "comment": "Malware payload", "timestamp": 1741829182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829182, "uuid": "8e32c929-3064-42cf-9bfc-c597a2dc233f", "comment": "Malware payload", "value": "b5104457321663c4e3833f87c5717794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829182, "uuid": "3e7bc5bc-3069-416f-8b8d-c9460a4dff84", "comment": "Malware payload", "value": "feb26e2a9cfaf305b9d840bf37983abeb62150114d9f60a7ca18e94478391c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829182, "uuid": "23d94856-e5e2-4579-bab8-46166612674b", "comment": "Malware payload", "value": "5736b960ba82b520f3b66b30c9514b17964badfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741829182, "uuid": "6e6f44e3-d88b-4fc9-8fd2-bb2570c1cb31", "comment": "Malware payload", "value": "50c48c1f47694cb4332158534344a828589cc6c0aedca60ab84572d264e6e424bea159c33fed24477bee09241394bf27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829182, "uuid": "f4b18492-6f1a-48e1-a26f-81d9e38c11e4", "value": "T199C53388B09272ABF694BD70267671C586557253248A3F74DE43DDE080F49C7E39BA33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829182, "uuid": "70ac8d3e-38d5-4bc0-9d6a-e113b4f7dda9", "value": "c3ccc080fb1ec5dfe659108fd5b131cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829182, "uuid": "ac640475-fad8-493f-8953-18e98bba4066", "value": "49152:iBHgX9vR6YRdQ9CT8d6jFw4WNZeMVtBWWE6HNiby+Gy9oNdTxXOsvVuEysjxR7jH:wG9ZLRdQ9CI0jiFNZeMVjEkEyQU6s9ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741829182, "uuid": "5a8b38a6-7ab9-432d-b060-d70092682b41", "value": 2672128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741829182, "uuid": "8ae896f4-927c-43cd-8aaa-3e39c1d53667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741829182, "uuid": "91a56435-3008-4ce5-89d2-5ada5e8d6ea9", "value": "SecuriteInfo.com.FileRepMalware.26489.28570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548cbfe7-ffda-11ef-ad17-42010a9c0004", "comment": "Malware payload (LummaStealer)", "timestamp": 1741849865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849865, "uuid": "f10c59df-d983-4818-982d-7ac94838c447", "comment": "Malware payload (LummaStealer)", "value": "39b24539f3d52b50a8a2baadaa8c3809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849865, "uuid": "d321b2cd-7fa5-4987-9845-afa915910763", "comment": "Malware payload (LummaStealer)", "value": "ff46d44172c60afe531588726a01b2cfaf1faf7eab1bf0ada2a68925a3939560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849865, "uuid": "6edb8f0c-732e-4ee3-ae3c-e5055ea65a83", "comment": "Malware payload (LummaStealer)", "value": "179437cd32daf8d5504368f144fc8735e912d8ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1741849865, "uuid": "4aa8c8f3-2ce0-4bfc-ac90-82f160d64108", "comment": "Malware payload (LummaStealer)", "value": "81598cd064cf8199a4adb4ee0c1de16afb1d195caf6c948e64660812a4def68d0ff6a9602bbc8dab33417fafda4b146a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849865, "uuid": "191cf64d-5845-4b80-b4d5-941ab6c5ff4e", "value": "T1EBE4AD06E72389A0CA8749B528CAA33FAF78832567388FD39750C7552C737D1BE7550A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849865, "uuid": "a8139265-cd6a-49f8-a746-ab25118352ab", "value": "2d87d4aca8b7331aa8ca7dbe0fbbd797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849865, "uuid": "7d48797e-d2c1-4635-bdb5-07adb9f674b5", "value": "6144:gpkUR+H4q+AF5grJLPDViaZLZfViPhFLtCxwoFcxRZWQRZWFFM2fT07MNTGu5tnh:ucHjJFuJLPDwK92tCKoFcmNTGumjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1741849865, "uuid": "ae83a7f2-3258-4a0b-83f9-16845e2a9f28", "value": 721760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1741849865, "uuid": "6b9f8f81-0793-46a1-a462-c610a0d41b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1741849865, "uuid": "3c5cbdfa-95c5-4006-a65d-68ade4807f0c", "value": "ff46d44172c60afe531588726a01b2cfaf1faf7eab1bf0ada2a68925a3939560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }